Repository navigation
fix(k9,deed): route --- per the coordination grammar; align IANA drafts - #1232
Merged
Merged
Conversation
The K9 contract's dialect discriminator routed a first line of `---` to k9-coordination with or without the K9! magic. The coordination grammar (v1.1.1, ruling D318) requires the magic and has no `---` production, so every such file was routed to a grammar that could only reject it, and a plain YAML file with a .k9 suffix was waved through as "out of scope" instead of failing K9-E005. A `---` file is now routed only with the magic (to be rejected there) and is unclaimed without it. The validator matches, with self-test assertions for all four magic/no-magic cases. No committed .k9 / .k9.ncl file changes verdict. IANA drafts brought up to date with the specs they register: vnd.k9 (registration .txt and form-ready .adoc, Revision 3): - LF-only line endings; the old "MUST accept CR+LF" contradicted K9-E003 - the K9! line is envelope, not Nickel (envelope-strip rule) - `version` parameter names pedigree.schema_version - links moved from the retired k9-svc/ path to 1-formats/k9/, citing the normative K9-CONTRACT-SPEC - non-existent k9-scan/k9-sign replaced by k9-validate.sh - the .k9 extension and K9! magic shared with coordination.k9 recorded as an OPEN DECISION (subtype vs parameter) that blocks filing vnd.deed (Revision 2): - a leading BOM is INVALID, as the spec and ABNF say (the draft said parsers MUST accept it) - cites spec v0.2.2 / ABNF v1.1.0 at 1-formats/deed/ - restores the :media-type: attribute the draft cites to the current spec Also: SPEC.adoc warns that its freedesktop glob mislabels coordination.k9, and svc/k9/README.adoc drops the withdrawn vnd.k9+nickel and dead k9-svc/ links. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GqfpQtLuMczxtgG1U9PkLW
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 17 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (7 skipped: 7… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Title check The title clearly identifies both primary changes: the K9 discriminator routing fix and the alignment of the IANA drafts. Description check The description is directly related to the changeset. It explains the K9 routing change, validator updates, and K9 and DEED IANA draft alignment.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files. (7 skipped: 7 unsupported.)
✨ Finishing Touches
-
📝 Generate docstrings
-
- 🤖 Coding Agent task started for docstring generation.
- Create a new PR
🛠️ Fix failing CI checks
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit checks the magic line,
Then sorts each file in turn.
The K9 notes get paths anew,
While DEED’s BOM rules change.
Two formats find their fields in place,
And hops the rabbit home.
Comment @coderabbitai help to get the list of available commands.
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38468050155 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Owner
Author
|
Resolved in 7a2d919. All four actions-lock checks now pass: Cause. #1231 (Dependabot) bumped Why the automatic repair didn't fix it:
Follow-up, not in this PR. Generated by Claude Code |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
|
🤖 Completed: Fix pre-merge checks in PR #1232 — View commit |
hyperpolymath
marked this pull request as ready for review
October 13, 2026 21:17
Contributor
|
🤖 Completed: Generate docstrings for PR #1232 — View commit |
hyperpolymath
enabled auto-merge (squash)
October 13, 2026 21:18
hyperpolymath
disabled auto-merge
October 13, 2026 21:21
hyperpolymath
enabled auto-merge (squash)
October 13, 2026 21:21
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38469924272 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
Contributor
|
✅ Coding Agent task started: View task and status The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.
⏭️ Checks skipped: 4 · already failing on `main` (not caused by this PR)
|
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38470102024 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
hyperpolymath
disabled auto-merge
October 13, 2026 21:26
hyperpolymath
enabled auto-merge (squash)
October 13, 2026 21:26
The deleted-workflow pass reads gone.txt first and told it apart with `NR == FNR`. gone.txt is usually empty, and then NR == FNR holds for every line of the lock, so the whole lock was swallowed and written back empty. The next --verify-local fails with "dependency lockfile version is required". It hit any run with a stale ref and no deleted workflow, which is exactly a Dependabot action bump, so the regen chain could never repair the #1231 drift. Tell the first file apart by FILENAME instead. Adds the missing regression case (stale ref, no deleted workflow): 0 lines left before the fix, whole lock kept and only the stale ref pruned after. On this repo's lock the fixed script prunes exactly the 18 refs #1231 orphaned. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GqfpQtLuMczxtgG1U9PkLW
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38471279094 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Contributor
Regenerated with gh actions-lock and the repair chain (relock-sha-keys, complete-job-refs, close-lock, prune-stale). The asana/push-signed-commits and actions/setup-python@v2 records, used only by the local composite .github/actions/signed-push and invisible to gh actions-lock (#1122), were restored unchanged from the previous lock.
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/38473359759 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
hyperpolymath
added a commit
that referenced
this pull request
Oct 13, 2026
…ative signed-push (#1233) Follow-up to #1232. This PR covers its three open items, each in its own commit, plus two fix-ups. ## 1. `application/vnd.k9.coordination` (owner ruling 2026-10-13: own subtype, not a parameter) - New registration draft: `2-protocols/k9-coordination/docs/iana/application-vnd.k9.coordination-registration.txt`. The format is pure data, with a YAML-like body governed by its own ABNF, and uses the `.k9` extension. - `vnd.k9` registration (Revision 4) and its form-ready copy: - the open decision is settled; - the type claims only `.k9.ncl`; - it is ready to file alongside the companion type. - MIME recipes in `SPEC.adoc`: - The two types get separate freedesktop entries. Filename globs decide the type; for files with no extension, a nested `metadata:` match tells the two apart. Checked against every committed `.k9` and `.k9.ncl` file. - A UTI is added for the new type. - A note says `mime.types` cannot express `.k9.ncl`. - The K9 contract spec and the coordination spec now name each dialect's media type. ## 2. Coordination grammar v1.2.0; the repo's own `coordination.k9` conforms (Owner ruling: extend the grammar for what belongs, move the rest out.) - New `coordination-k9-grammar_v1.2.abnf` adds two optional sections: `build_commands` and `innervation` (afferent / efferent / reflex). The change is additive, so every v1.1.1 file is still valid. - The v1.1 file stays, marked superseded, so existing links resolve. Every in-repo reference now points to v1.2. - The root `coordination.k9` now parses under v1.2.0. I checked this with an ABNF parser (apg-js), and the file correctly fails v1.1. - Before this change, it failed at its `---` line. - **Moved out:** `ports`, `verisimdb_port` and `crg_grade`. A2ML is retired, so neither fact went into a `.a2ml` file: - The VeriSimDB port is already set in `.verisimdb/config.toml`. - The CRG grade (B) belongs in a root `READINESS.md` under the CRG spec, and `just crg-grade` reads it from there. This repo has no `READINESS.md` yet, so the `coordination.k9` header comment records the grade and where it belongs. - **Stale facts corrected:** - the languages now match the tree; - the protected entries for the deleted `a2ml/` and `lol/` are gone; - the banned-language lines follow the current policy. - **Flagged, not changed:** the `pmpl-license-only` invariant contradicts this repo's MPL-2.0 classification. Licence content is flag-only. - The generator's parser reads the new file. As a side effect, `consumers` now parses as a list instead of a string. ## 3. `signed-push` without `Asana/push-signed-commits` The Asana action is written in Python and has no licence file. It also uses the tag-pinned `setup-python@v2` and runs an unpinned `pip install`. It is replaced by `.github/actions/signed-push/push-verified.sh`, which uses bash, `gh` and `jq` to call `createCommitOnBranch`. - **Same contract as before:** - the remote branch must exist and must not have diverged; - commits are replayed oldest first with their messages, and each call names the head it expects; - the local branch is reset to the remote afterwards. - **Stricter than before:** - binary files are pushed intact; - merges, symlinks, submodules and mode changes are refused before anything is sent; - the pushed tree is compared with the local one. - **Tests:** `scripts/tests/signed-push-test.sh` runs 13 cases against a stub GitHub, with no shellcheck warnings. Writing it caught a real partial-push bug in my first draft, which is now fixed. A mutant that stops sending deletions fails 4 cases. - **Lock entries left in place:** the now-unused `asana/push-signed-commits` and `actions/setup-python@v2` records are not hand-edited out of `actions.lock`. All lock gates pass with them present, and the next tool regeneration drops them. - **Not changed: the regen job's composite guard (#1122).** `prune-stale` still cannot see refs that a workflow reaches through a local action, so action bumps here still need a hand-run regeneration. Relaxing the guard safely needs a live check of how GitHub validates locks for local composites. ## Testing - ABNF: `minimal.k9`, the spec's new examples and the root `coordination.k9` pass v1.2. Negative controls fail. - `k9-validate.sh --self-test` and the `validate-k9` hook pass. - Script tests: `signed-push-test` 13/13, `validate-sha-pins-test` 22/22 (with mikefarah yq), `descriptile-policy-test` 11/11. The docstring scan shows 100% on the new code. - Lock gates pass: `validate-actions-lock` and `check-lock-sync`. These also pass: `check-workflow-duplicate-keys`, `check-standards-map`, `check-canon-lockstep`. - Full shell suite: 77 of 81 files pass locally. The other 4 fail identically on `main` here, because this sandbox lacks KYAML-capable yq, the JCS tool and Ruby. CI is the authority for those four: `check-actions-lock-gate`, `check-ijson-jcs`, `kyaml-format` and `science-ci-security`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01GqfpQtLuMczxtgG1U9PkLW --- _Generated by [Claude Code](https://claude.ai/code/session_01GqfpQtLuMczxtgG1U9PkLW)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
---contradiction. The K9 contract's dialect discriminator (K9-E005) routed any file whose first line is---tok9-coordination, with or without theK9!magic. The coordination grammar (v1.1.1, ruling D318) requires the magic and has no---production. So every such file was routed to a grammar that could only reject it, and a plain YAML file with a.k9suffix was reported as "out of scope" instead of failing K9-E005.K9-CONTRACT-SPEC.adoc: a---file is now routed tok9-coordinationonly when it has the magic line (where the grammar then rejects it). Without the magic it is unclaimed.k9-validate.sh: implements the same rule. The self-test now asserts all four cases:---orkey:, each with and without the magic line. A mutation check confirmed the new assertion fails against the old rule.IANA drafts brought in line with their specs:
vnd.k9(Rev 3)vnd.k9K9!line is envelope, not Nickel; envelope-strip rulevnd.k9version= "K9 specification version"pedigree.schema_versionvnd.k9k9-svc/links (dead); v1.0.0-alpha1-formats/k9/; normative K9-CONTRACT-SPEC v1.0.0vnd.k9k9-scan/k9-signtoolsk9-validate.sh(the other two don't exist)vnd.k9.k9with no mention of coordination.k9extension and magic recorded as an open decision that blocks filingvnd.deed(Rev 2)vnd.deeddeed/(dead)1-formats/deed/vnd.deed:media-type:attribute the current spec lackedDEED-GRAMMAR-SPEC.adocAlso changed:
SPEC.adocnow warns that its freedesktop*.k9glob mislabelscoordination.k9..machine_readable/svc/k9/README.adocdrops the withdrawnvnd.k9+nickeland the deadk9-svc/links.Lock repair fix (
scripts/prune-stale.sh), needed to getmaingreen again. #1231 bumped four actions without regeneratingactions.lock, andmainhas been red on the lock checks since. Running the repair chain to fix that exposed a bug: when a stale ref exists but no workflow was deleted (the normal Dependabot case),prune-stale.sh's deleted-workflow pass read an empty list viaNR == FNR. That condition then held for every line of the lock, so it wrote the lock back empty, and--verify-localfailed with "dependency lockfile version is required". The pass now tells the list apart byFILENAME. A new regression case inscripts/tests/prune-stale-test.shfails before the fix (0 lines left) and passes after (15/15). On this repo's lock, the fixed script prunes exactly the 18 refs #1231 orphaned. The regeneratedactions.lockfollows in a separate commit.Open, for owner ruling
The coordination dialect needs either its own subtype (e.g.
application/vnd.k9.coordination) or a parameter onvnd.k9. The drafts record this as undecided and block filing until it is ruled on.Not changed: the repo's own
coordination.k9still opens with---, so under the coordination grammar it is non-conforming. Its verdict is unchanged by this PR, and fixing it is left as a separate dogfood-conformance item.Testing
k9-validate.sh --self-test: all assertions pass, including the 4 new ones.k9-validate.sh --fixtures: 6 positive, 21 negative, 0 failures. CI runs the 2 L2 controls with Nickel and they pass..k9/.k9.nclfiles are identical before and after.scripts/check-canon-lockstep.sh: passes.prune-stale15/15,close-lock9/9,regen-dependabot-locks34/34,check-lock-sync10/10,update-actions-lockpass.🤖 Generated with Claude Code
https://claude.ai/code/session_01GqfpQtLuMczxtgG1U9PkLW