Repository navigation
ci: fix the root causes of main's red checks (stacked on #147) - #150
Merged
Merged
Conversation
The three ABI modules had never typechecked: their module names did not match their paths, Types.idr had 11 errors, and Layout.idr / Foreign.idr had more behind those. Several of their proofs were vacuous or false. They now sit at PanelClades/ABI/, typecheck under Idris2 0.8.0, and are built by check-abi.sh and CI with Grades.idr. - Types: C sizes over a closed CType universe (Idris cannot match on Type); HasSize/HasAlignment admit only the true size; DecEq through a retracted tag instead of a catch-all `No absurd`; Handle/CladeId witnesses built with `choose`; C tag round-trip theorems; Elem-based exhaustiveness; IO stubs that printed "verified" replaced by checked facts; thisPlatform is the constant it always was. - Layout: alignUp is units x alignment, so alignUpCorrect holds by construction; decDivides decides alignment by an equation; struct size is the furthest field end rounded up; verifyAllPlatforms checks every platform; the example's 24-byte size is computed by Refl. - Foreign: string primitives declared before use; one resultFromInt. - check-abi.sh fails on a PanelClades/ABI module missing from the ipkg and on escape hatches; three new expected rejections. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
A clade's declared state budget and loss tolerance are now parameters of its contract, declared in the `resources` block of its config.k9.ncl. scripts/gen-budgets.sh generates PanelClades.ABI.Budgets from those blocks; check-abi.sh fails when it is stale or a block is malformed. CladeResourceContract is parametric in a CladeBudget, and declaredContract builds one from a config's values: it typechecks only when the declared peak fits the budget and the declared loss fits the tolerance (tests/reject/BudgetTooSmall.idr). Setting neurosym-bridge's budget below its peak fails the build at neurosymBridgeContract. The values stay DESIGNED: declared, not measured. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
- Replace "NEVER use npm/bun — Deno only" with the estate order (Bun, then pnpm, then npm; Deno retired), per the owner (2026-10-14). - Mark the deno task commands stale: #108 removed deno.json, and the Build Validation `validate` job fails on main for that reason. - Record the owner's preference that decisions are asked through the selector, batched, with a recommended option first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
panll has no actions.lock, so Governance / Actions lockfile verify is red. The lock needs GitHub API access the agent sandbox lacks, so this job runs standards' scripts/update-actions-lock.sh (gh-actions-lock v0.1.6, as the gate pins) and prints the result. It is removed in the commit that adds the lock. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
ijson-jcs check reported it NOT CANONICAL; rewritten with ijson-jcs fix. Content is unchanged; only the serialisation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
gh actions-lock refuses 4be9e76 ("no tag or branch contains this
commit — a symbolic ref is required for the lockfile"), which blocks
panll's actions.lock. Use the estate's pin (standards: e2a55d2, which its
lock resolves to v1). With a commit pin the toolchain is not inferred
from the ref, so e2e.yml now passes toolchain: stable explicitly, as
build-validation.yml already did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
The lock was generated in CI by standards' scripts/update-actions-lock.sh (gh-actions-lock v0.1.6), run 38544579402. The lock's sha256 there was 4a61c354…f09055. The tool's rewrite of the workflows is kept as the estate model requires: symbolic refs in the YAML, immutable resolution in the lock, and its "managed by gh actions-lock" header line. The tool cannot see job-level reusable-workflow refs (upstream #129), so the rest of standards' repair chain was applied: - scripts/complete-job-refs.sh added the six workflows that call hyperpolymath/standards reusables. - Two leaf dependency records for hyperpolymath/standards@092deda and @412a703, in close-lock.sh's shape. The ids are the ones every estate lock records for standards (owner 6759885, repo 1116521501). - Empty entries for the two zero-uses workflows (labels, label-triage). Both lock-sync gates pass: standards' check-lock-sync.sh, and rsr-template's, which also checks transitive closure (0 dangling edges). The temporary bootstrap workflow is deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
main-estate-audit.yml was the copy rollout_estate.sh pasted in: 26 gate steps pinned at cicd-suite 5a10b72, no SPDX header and no top-level permissions. The last two fail Governance / Workflow security linter. It is now the thin caller rsr-template-repo ships: permissions contents: read, calling cicd-suite/.github/workflows/main-estate-audit.yml at 4f54042 (main, #49), whose gates are pinned at 1aa6bfb. actions.lock follows the rsr-template-repo shape for the callee: cicd-suite@4f54042 -> actions/checkout@3d3c42e + cicd-suite@1aa6bfb -> the deed/k9 validate-actions it already recorded. The unused cicd-suite@main record is removed. gh actions-lock v0.1.6 --verify-local is valid, standards' check-lock-sync.sh passes, and so does rsr-template-repo's (0 dangling edges). Refs #137. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
The estate Code Hygiene Gate failed on 734 untracked debt markers. - 726 are the stub line `// TODO: Complete semantic implementation`. #107 left it in every .affine file it created in place of the deleted ReScript. That is real debt, so the markers are linked as TODO(#148) rather than allowlisted. #148 records what #107 removed and the decision it leaves. - 4 are real unfinished FFI/ABI work and are linked as TODO(#149): copro_free leaks, panel_clades_register stores nothing, Idris callback registration is missing, and the container entrypoint is template residue. - 4 are not debt. They are listed in .cicd-hygiene-allow, each with its reason: run-maintenance.sh is itself a marker scanner (help text and rg pattern), and voicetag_engine_test.js asserts the display labels "TODO"/"FIXME". cicd-suite code-hygiene-check at 1aa6bfb, run locally: passed. Refs #137. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Dogfood Gate / Validate K9 contracts failed with 117 errors. - The validator was locked at k9-ecosystem 89f3c27 (2026-07-25). That version demands a literal `K9!` first line in .k9.ncl files, which is a Nickel syntax error. k9-ecosystem #41/#43 repaired the validator for the Nickel dialect: `magic_number = "K9!"` or a pedigree-schema import also counts, and estate coordination files are skipped. The lock now resolves @main to 20f6be5. The dogfood-gate.yml `uses:` line is unchanged. - Under the repaired validator, 102 files still had no marker. The 98 panel-clades/clades/*/config.k9.ncl files get `magic_number = "K9!"` in their pedigree, as in k9-ecosystem's examples. The 4 layouts/*.k9.ncl files get it in their pedigree metadata override. Checks, run locally: - validate-k9.sh at 20f6be5: 110 scanned, 0 errors. - nickel 1.18 exports all 98 clade configs. - The 4 layouts already failed `nickel export` before this change, on a destructuring error in their import of pedigree-layout.ncl. This change does not alter that. - gen-budgets.sh --check: unaffected. Refs #137, #68. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Rust CI died at manifest load: `gossamer-rs = { path =
"../gossamer/bindings/rust" }` names a sibling checkout that exists on
one machine. Gossamer lives at metadatastician/gossamer, and its build
script supports Git dependencies ("use the git repository dependency").
- gossamer-rs is a git dependency pinned to c234fea (gossamer main,
2026-10-13). Cargo.lock gains exactly one `source = ...` line.
- It is optional, behind a `gossamer` feature that the panll-gossamer
bin requires. gossamer-rs's build.rs compiles libgossamer from Zig
source (exactly Zig 0.15.2, plus GTK 3 and WebKitGTK 4.1). As an
unconditional dependency it ran even for `cargo check --lib`, so the
"GTK/WebKit-free" library the manifest describes did not exist.
- E2E's Rust job, which already installs GTK/WebKit, installs Zig 0.15.2
(goto-bus-stop/setup-zig v2.2.1, the estate's pin, now in
actions.lock) and builds with `--features gossamer`. Cargo.toml and
Cargo.lock now trigger that workflow.
- Rust CI's first run past `cargo check` exposed `cargo fmt` drift in 11
files and one clippy::for_kv_map. `cargo fmt --all` is applied, and
the loop uses values_mut().
Checked locally on rustc 1.97.0 and on 1.99.0, the stable CI uses:
- Rust CI: `cargo check --locked --all-targets`, `cargo fmt --check`,
`clippy --all-targets -D warnings`, and `cargo test --all-targets`
(23 passed) all pass.
- Desktop shell, with Zig 0.15.2 and the GTK/WebKit dev packages:
`cargo build --release --locked --features gossamer --bin
panll-gossamer` links, and `cargo test --features gossamer` passes.
- Lockfile: gh actions-lock --verify-local is valid, and both
lock-sync gates pass.
Refs #137.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Contributor
|
Important Review skippedToo many files! This PR contains 879 files, which is 779 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters: 3
📒 Files selected for processing: 879
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
hyperpolymath
marked this pull request as ready for review
October 14, 2026 10:39
…ion) The owner decided (2026-10-14) to port the frontend to AffineScript, not restore the ReScript, and to remove the dead gates now. #137 already allowed this: `validate` "runs under bun or is removed". Removed: - Build Validation / validate: Setup Deno, deno install, the ReScript build gate, the Deno test gate and the pcc panel-wiring gate. The first four need deno.json, which #108 deleted. 136 of the 143 tests import src/**/*.res.js, which #107 deleted. pcc scans .res files, and before #107 it also failed on every panel (MSG_NAMESPACE_MISSING: it never learned the src/msg/ split). - The GTK/WebKit apt step in `validate`. The default-feature library does not need it. - E2E: the e2e-deno, crosscutting and bench jobs. Same imports, same missing deno.json. The bench job's `| tee` also hid its failure, so it was a false green. Kept: - In `validate`: `cargo check --locked`, `cargo test --locked --lib`, and the pcc compile. - E2E's Rust job, which builds the desktop shell with `--features gossamer`. - The tests stay in tests/. #148 re-adds these gates against the AffineScript frontend. actions.lock drops setup-deno from both workflows and upload-artifact from e2e.yml, and removes the now-unreferenced records. Checked locally: - gh actions-lock --verify-local: valid. Both lock-sync gates pass. - Governance linter: parse, duplicate-key and SPDX/permissions steps pass. - The new `validate` steps pass on rustc 1.99.0. .claude/CLAUDE.md's stale-build note now records the decision. Refs #137, #148. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Hypatia's workflow_audit flagged 13 jobs with no `timeout-minutes`, which means the 6-hour default: a hung fetch or runner burns budget. Each now has a timeout sized from recent run times, with headroom: - build-validation validate: 20 - dogfood-gate, all five jobs: 10 - casket-pages build: 45 (about 2.5 min with a warm cabal cache; a cold build is much longer) - casket-pages deploy: 10 - boj-build trigger-boj: 10 - codeql analyze: 30 - labels sync, label-triage triage, instant-sync dispatch: 10 It also flagged codeql_missing_actions_language. The matrix gains `language: actions` (build-mode none), as rsr-template-repo's codeql.yml has, so CodeQL scans the workflow YAML for injection. No `uses:` changed, so actions.lock is untouched; gh actions-lock --verify-local is still valid. The linter's parse and duplicate-key steps pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Owner
Author
|
SonarCloud Code Analysis is red: "C Security Rating on New Code". I can't fix it from here.
What I need: open the PR's Sonar issues.
I have no permission to re-run third-party checks. Generated by Claude Code |
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 14, 2026
#150 landed this branch's first eight commits (through a00b667) plus its five CI fixes. Resolution: - panel-clades ABI files and scripts: this branch's. Main's copies equal a00b667, so ours carry only the later review fixes. - workflows, actions.lock, .claude/CLAUDE.md, .cicd-hygiene-allow: main's. This branch had not changed them after a00b667, except main-estate-audit.yml (SPDX + permissions) and .cicd-hygiene-allow (the same two paths). Main's thin caller already has both. Checked: check-abi.sh OK (6 rejections); actions.lock in sync; k9-ecosystem validate-k9.sh at 20f6be5: 0 errors, 3 warnings (main: 5). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t
This was referenced Oct 14, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 14, 2026
…K9! preambles (#152) ## Summary #150 (squash-merged) carried #147's original seven commits. #147's branch then gained four useful commits; this PR carries those four and nothing else. **#147 is superseded and will be closed** (owner decision, 2026-10-14). | Commit (from #147) | Change | |---|---| | `ed617ad` | `gen-budgets.sh` reads `state` / `crossing` / `status` only from inside the `resources = { … }` block, not from anywhere in the config. | | `d746ff9` | `check-abi.sh` checks every `.idr` under `src/abi/PanelClades` (recursively) for ipkg membership and escape hatches, not just `PanelClades/ABI/*.idr`. | | `78105d3` | Doc comments for the ABI contracts (Foreign, Grades, Layout, Types) and the budget generator. Comment-only. | | `1d02597` | Doc comments for `check-abi.sh`'s pass / err / die helpers. | ## Deliberately left out - **The bare `K9!` first line** that #147's autofix commits (`42af967`, `d657fbc`) prepended to all 98 `panel-clades/clades/*/config.k9.ncl`, the 4 `layouts/*.k9.ncl` and `container/deploy.k9.ncl`. - A bare `K9!` is a Nickel syntax error. With nickel 1.18, **98/98 clade configs export on `main` and 0/98 on #147** (`unexpected token` at 1:3). - The K9 validator already passes on `main` through the `magic_number = "K9!"` field that #150 added, so the line buys nothing. - **The duplicates of #150's fixes:** TODO links, `.cicd-hygiene-allow`, and the estate-audit SPDX/permissions. - **`a00b667`'s SHA re-pin** of every `uses:`. When #150 was merged into #147, that merge already dropped it. If you want inline SHA pins with a SHA-keyed lock on `main`, that is a separate change. ## Verified - `panel-clades/scripts`, `src` and `tests` are byte-identical to #147's head (`1d02597`). `panel-clades-abi` passed there: 5 modules and 6 rejections against typed-wasm's kernel. - `shellcheck` is clean on both scripts, and `gen-budgets.sh --check` says `Budgets.idr` is current. - The cicd-suite code-hygiene gate passes, and the K9 validator (k9-ecosystem `20f6be5`) reports 0 errors. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3 --- _Generated by [Claude Code](https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3)_ --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#147 cannot go green on its own: every red check on it is also red on
main. This branch is #147's seven commits plus five fixes, one per root cause.It is stacked on #147 rather than based on
mainfor two reasons:uses:and addsactions.lock.Merge order (owner's choice): merge #147 first, and this PR's diff shrinks to the five fixes. Or merge this PR alone, which lands both.
main)main-estate-audit.ymlwas an inline copy pasted byrollout_estate.sh: no SPDX header, nopermissions:, gates pinned 3 weeks stale.rsr-template-repoships, calling cicd-suite's reusable at4f54042. Lock updated..affinefile.TODO(#148)for the stubs,TODO(#149)for four FFI/ABI gaps. Four hits that are not debt (a marker scanner, a test's expected labels) go in.cicd-hygiene-allow, each with its reason.89f3c27, from before its Nickel-dialect repair, and 102 configs had no K9 marker.@mainto20f6be5.magic_number = "K9!"added to 98 clade configs and 4 layouts.gossamer-rs = { path = "../gossamer/…" }, a sibling checkout CI never has.c234fea, optional behind agossamerfeature that the desktop bin requires. That exposedcargo fmtdrift and one clippy lint; both fixed. E2E's Rust job installs Zig 0.15.2 and builds the shell.validate, E2E Deno jobsdeno.jsonthat #108 deleted.pccscans.resfiles.tests/; #148 re-adds the gates. The bench job's| teehad been hiding its failure, so it showed a false green.CI on this branch
On the first push (4 fixes), these went green for the first time:
rust-cicheck, clippy and fmt;rust-citestThe fifth commit removes the remaining dead gates.
Verified locally (before each push)
1aa6bfb, including the DEED (f9d999b) and K9 (2155aa2) validators nested inmanifest-check. The K9 validator at20f6be5scans 110 files with 0 errors, andnickel 1.18 exportsucceeds on all 98 clade configs. The 4 layouts already failednickel exportbefore this PR, on a destructuring error in their import, and still do.clippy -D warningsand test pass on rustc 1.97.0 and 1.99.0. The desktop shell builds and links with Zig 0.15.2 and the GTK/WebKit dev packages.--verify-localis valid, and the standards and rsr-template-repocheck-lock-sync.shboth pass. Every reusable pin (standards092deda,412a703; cicd-suite4f54042) is reachable from its repo'smain.Not fixed here
sonarcloud.iois unreachable from the agent sandbox, so this is not confirmed.ssh-keyscanwith an emptyvars.GITEA_HOST, and the Disroot repository does not exist. Both are settings fixes.Refs #137. Tracking issues opened: #148, #149.
🤖 Generated with Claude Code
https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3