From 1c1833b839834eabb8aed308757e2ad40af6cdf2 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 00:58:32 +0000 Subject: [PATCH 1/2] docs(reorg): standards tidy-up deep dive, 220 issue dispositions, bot plan; fix four reds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds docs/reorg/2026-10-14-tidy/: the plan (district-model execution, placement rules, single-source matrix, eight phases of bot packets, owner decision sheet D335 onward), every open issue's literal/golden/mischief record, the workflow audit, the sibling wiring audit (40 drifts) and a rulings ledger snapshot (D1 to D334) compiled from #787 and #1234 after the workstation wipe. Phase 0 fixes landed here: - standards-map.toml: map READINESS.md (Gate D red on main since #1235) - Debtfile: drop the resolved shell-scripts-missing-spdx entry whose acceptance expired 2026-10-01 (debt-measure red) - readme-derive-reusable.yml: remove the concurrency block that collided with every caller's group and cancelled the run before any job (README Derive red for 36 consecutive runs) - Justfile: v1-audit path, build/clean no longer name a missing dir, lint delegates to validate, llm-context reads the .adoc warm-ups - .github/funding.yml: remove the lower-case duplicate (case collision with FUNDING.yml; names another owner) Debt-exception: shell-scripts-missing-spdx — count reached 0 and the entry's acceptance expired 2026-10-01; entries leave the ledger by reaching zero (Debtfile preamble) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- .github/funding.yml | 4 - .github/workflows/readme-derive-reusable.yml | 8 +- .machine_readable/Debtfile.a2ml | 10 - Justfile | 24 +- docs/reorg/2026-10-14-tidy/README.adoc | 1050 +++++++++++++++ .../2026-10-14-tidy/issue-triage-089-497.adoc | 461 +++++++ .../issue-triage-1049-1234.adoc | 764 +++++++++++ .../2026-10-14-tidy/issue-triage-633-910.adoc | 915 +++++++++++++ .../issue-triage-911-1037.adoc | 1148 +++++++++++++++++ .../rulings-ledger-snapshot.adoc | 572 ++++++++ docs/reorg/2026-10-14-tidy/wiring-audit.adoc | 547 ++++++++ .../reorg/2026-10-14-tidy/workflow-audit.adoc | 341 +++++ standards-map.toml | 15 +- 13 files changed, 5827 insertions(+), 32 deletions(-) delete mode 100644 .github/funding.yml create mode 100644 docs/reorg/2026-10-14-tidy/README.adoc create mode 100644 docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc create mode 100644 docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc create mode 100644 docs/reorg/2026-10-14-tidy/issue-triage-633-910.adoc create mode 100644 docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc create mode 100644 docs/reorg/2026-10-14-tidy/rulings-ledger-snapshot.adoc create mode 100644 docs/reorg/2026-10-14-tidy/wiring-audit.adoc create mode 100644 docs/reorg/2026-10-14-tidy/workflow-audit.adoc diff --git a/.github/funding.yml b/.github/funding.yml deleted file mode 100644 index e4f7c0778..000000000 --- a/.github/funding.yml +++ /dev/null @@ -1,4 +0,0 @@ -# Funding Configuration -# See: https://docs.github.com/en/repositories/managing-your-repositorys-custom-fields/displaying-a-sponsor-button-in-your-repository - -github: metadatastician diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml index f3899bc0b..d3c277088 100644 --- a/.github/workflows/readme-derive-reusable.yml +++ b/.github/workflows/readme-derive-reusable.yml @@ -35,10 +35,10 @@ permissions: actions: read contents: read -# Read-only check workflow — safe to cancel superseded runs. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true +# No concurrency block here on purpose. Inside a called workflow github.workflow +# resolves to the CALLER's name, so a group declared on both sides collides and +# the run cancels itself before any job starts (README Derive: 0 jobs on every +# main run from 2026-07-28 to 2026-10-13). Callers own concurrency. jobs: derive-readme: diff --git a/.machine_readable/Debtfile.a2ml b/.machine_readable/Debtfile.a2ml index 8b7806bee..d1c47b490 100644 --- a/.machine_readable/Debtfile.a2ml +++ b/.machine_readable/Debtfile.a2ml @@ -48,16 +48,6 @@ forgotten. ## Hygiene -### shell-scripts-missing-spdx -- description: Shell scripts under scripts/ without an SPDX-License-Identifier in the first three lines -- probe: n=0; for f in $(git ls-files 'scripts/*.sh'); do head -3 "$f" | grep -q 'SPDX-License-Identifier' || n=$((n+1)); done; echo "$n" -- count: 0 -- ceiling: 1 -- severity: medium -- policy: remediable -- tri: eliminate -- accepted-until: 2026-10-01 - ### todo-fixme-markers - description: Files carrying a TODO or FIXME marker. Advisory — a marker is a note to self, not a defect Re-baselined 2026-09-22 (round 2, issue #953): fossilized at 77, measured 80. Probe corrected 2026-10-06: `*.ncl.in` templates are excluded, because their `TODO` fields are placeholders by design (copy, then fill in every TODO), not notes to self; measured 84. - probe: git grep -I -l -E '\b(TODO|FIXME)\b' -- . ':(exclude).machine_readable/Debtfile.a2ml' ':(exclude)docs/DEBTFILE-SPEC.adoc' ':(exclude)*.ncl.in' | wc -l diff --git a/Justfile b/Justfile index f789bb4cb..4945938e3 100644 --- a/Justfile +++ b/Justfile @@ -133,14 +133,15 @@ validate: # Print role-appropriate LLM warm-up context (machine front door) llm-context role="dev": @echo "# Front door: 0-AI-MANIFEST.a2ml (machine) + README.adoc (human)" - @cat "llm-warmup-{{role}}.md" 2>/dev/null || cat 0-AI-MANIFEST.a2ml + @cat "llm-warmup-{{role}}.adoc" 2>/dev/null || cat 0-AI-MANIFEST.a2ml -# Build all sub-project artefacts +# Build all sub-project artefacts. The canon ships specs, not products: the k9 +# Rust binding moved to hyperpolymath/k9-ecosystem (#491) and the groove ipv6t +# reference is not in this tree, so there is nothing to compile here. Kept as a +# recipe so `just build` stays a valid estate entry point (and says so). build: @echo "=== Standards Monorepo Build ===" - @echo "[2/3] k9 Rust binding — moved to hyperpolymath/k9-ecosystem (rs/) under #491" - @echo "[3/3] 2-protocols/groove/reference/ipv6t" - @cd 2-protocols/groove/reference/ipv6t && zig build 2>&1 || echo " SKIP: zig not available" + @echo "nothing to build: specs only (k9 binding -> hyperpolymath/k9-ecosystem, #491)" @echo "=== Build complete ===" # Run all sub-project test suites @@ -160,17 +161,14 @@ fmt: @echo "=== Standards Monorepo Format ===" @echo "=== Format complete ===" -# Lint sub-projects -lint: - @echo "=== Standards Monorepo Lint ===" - @echo "[1/2] Rust clippy" - @echo "[2/2] Deno lint" - @echo "=== Lint complete ===" +# Lint. The repo's lint surface is the structural gates, not a per-language +# linter run (there is no root crate; Deno is banned). Delegates to `validate`. +lint: validate # Clean build artifacts clean: @echo "=== Cleaning ===" - @cd 2-protocols/groove/reference/ipv6t && rm -rf zig-out zig-cache .zig-cache 2>/dev/null || true + @rm -rf .cache/stale 2>/dev/null || true @echo "=== Clean complete ===" # Run panic-attacker pre-commit scan @@ -179,7 +177,7 @@ assail: # Stable release gate audit v1-audit path=".": - @./release-pre-flight/v1-audit.sh "{{path}}" + @bash 3-practice/release-pre-flight/v1-audit.sh "{{path}}" # Self-diagnostic — checks dependencies, permissions, paths doctor: diff --git a/docs/reorg/2026-10-14-tidy/README.adoc b/docs/reorg/2026-10-14-tidy/README.adoc new file mode 100644 index 000000000..4f2b3db9d --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/README.adoc @@ -0,0 +1,1050 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) += Standards tidy-up: deep dive, dispositions and bot execution plan +Jonathan D.A. Jewell (hyperpolymath) +v1.0.0, 2026-10-14 +:toc: left +:toclevels: 3 +:sectnums: +:icons: font +:status: Draft for owner ratification. Structural moves that touch a canon.lock artefact are step 1 of the Change Procedure; everything else is applied-unless-struck (D113). + +[.lead] +This pack is the deep dive the owner asked for on 2026-10-14: what the +`standards` repository is, why it is hard to read, what its 220 open +issues actually ask for once read literally, sensibly and for the mischief +they were filed against, how it is wired to the seven neighbouring +repositories, and a phased plan that cheaper models can execute packet +by packet. It is written to survive a lost workstation: every count was +measured on the tree at `7d2041a2` (main, 2026-10-14) and every ruling +cited is on #787 or #1234. + +== Summary + +* The repository is a *canon* (specs, policies, grammars, gates) that has + absorbed products, telemetry, session plans and three generations of + machine-readable format. The owner has already designed the cure, the + district model in `standards-map.toml` (0-canon, 1-formats, 2-protocols, + 3-practice, 4-readiness, 5-machine, 6-telemetry, 9-archive, onramp, + root), and executed the first two moves (0-canon extraction, 9-archive + move). What remains is executing the rest of that map and removing what + the map itself marks deprecated. +* The design document the map cites (`03-STANDARDS-REORG.md`) is not in + any repository and is presumed lost with the workstation. The `target` + column of `standards-map.toml` is the surviving record of the design; + this pack re-states it so it cannot be lost twice. +* Root clutter: 62 visible entries plus 11 dot entries. The target is + about 28 visible. The map already names a target for every entry; the + plan sequences the moves so each PR is one mechanical packet with a + mechanical acceptance test. +* Retired formats are still load-bearing: 222 `.a2ml` files, of which + the Must gate, the Debt ledger, the Hypatia rules, the DYADT claims + file and the canon criteria are live inputs. The canon has no + `standards_chora.deed`, so it fails its own D312 rule. +* Issues: 220 open. 63 can be closed or merged today with a pointer + comment (29 done, 9 moot, 6 superseded, 19 duplicates). 69 are small + in-repo fixes a Sonnet-class model can do. 48 are estate campaigns + where standards owns the policy and the file changes land elsewhere. + 24 need one owner answer each. 16 are blocked on credentials or + rulings. Every record, with the literal, golden and mischief reading, + is in the appendices. +* CI: 59 workflows, 23 self-gates, 15 reusables, 6 dead. Only three + checks are live-required on `main` and all three are admin-bypassable; + the 20-check gate ruleset has been disabled since 2026-10-05, and a + Dependabot PR was merged through red on 2026-10-13. Two reds on main + are this repo's bugs and are fixed in this PR. +* Wiring: no phantom pins, but 40 drifts across the seven siblings, six + of them high. Siblings copy policy text instead of pinning it; hypatia + carries a stale licence register; six of seven build the Hypatia + scanner from a floating ref. + +== Method + +Each issue was read in full (body and every comment) and then tested +three ways, as the owner asked: + +Literal:: What the text asks for, as written. +Golden:: Whether the literal reading now produces an absurd or + contradictory result against the current facts (A2ML retired, the + spec registry retired, Deno and Python banned, the RSR tree archived, + the workstation wiped). Where it does, the sensible reading is stated. +Mischief:: What defect the issue was filed to remedy, and whether that + defect still exists in the tree. This is checked, not inferred: the + record cites the file, commit or run that proves it. + +The rulings on #787 (D1 to D331) and #1234 (D332 onward) were compiled +into a ledger (<>) and applied before any disposition was +written, so nothing already ruled is re-asked. 317 of 334 ids have +text; 17 were never posted and two (D297, D315) are declared lost. + +Measurements: `git ls-files` counts, `scripts/check-standards-map.sh` +(Gate D), `scripts/check-canon-lockstep.sh` (Gate A), +`scripts/run-mustfile.sh`, `scripts/run-debtfile.sh`, +`scripts/link-rot-guard.sh`, the Actions API for every workflow, and +grep over the seven sibling checkouts. The local toolchain lacked Go +`yq`, `nickel`, `shellcheck`, `actionlint` and `just`, so 16 of 81 +shell test files fail locally for want of tools while Self Test is +green on `main`; CI is the oracle for those. + +== The repository as found + +=== Root + +73 entries at the root (62 visible, 11 dot). Of the visible ones: + +* 8 directories exist only to hold one `POINTER.adoc` each + (`agentic-a2ml`, `anchor-a2ml`, `ecosystem-a2ml`, `meta-a2ml`, + `neurosym-a2ml`, `playbook-a2ml`, `state-a2ml`, `k9-svc`). The map + marks all eight `deprecated`. +* 4 readiness-grade directories that the map sends to `4-readiness/`. +* 14 machinery directories and files that the map sends to `5-machine/` + (`scripts`, `hooks`, `config`, `hypatia-rules`, `tools`, `templates`, + `tests`, `tasks`, `launcher`, `standards-update`, `_shared`, + `licenses`, `LICENSES`, plus `CICD-WORKFLOW-CATALOG.md`, `CLAIMS.a2ml`, + `REGISTRY.adoc`, `repo-catalog-template.toml`, `setup.sh`). +* 3 telemetry entries the map sends to `6-telemetry/` (`audits`, + `.verisimdb`, `.hypatia-baseline.json`; the last must stay at the root + because the scanner reads it there). +* 2 residuals of the archived RSR tree (`rhodium-standard-repositories/` + with only `actions-allowlist/`, whose content duplicates + `config/settings/actions-allowlist.json` with fewer keys). +* `licenses/` and `LICENSES/` both exist. So do `.github/FUNDING.yml` + and `.github/funding.yml`. Both pairs break a checkout on a + case-insensitive filesystem. The funding pair is fixed in this PR; + the licence pair is licence-adjacent and goes to the owner sheet. + +=== Retired formats that are still load-bearing + +A2ML is retired (D99, D269c, D312, D313) and the spec registry was +retired on 2026-10-09. The tree still carries 222 `.a2ml` files, and +these are live inputs, not history: + +[cols="2,3,3",options="header"] +|=== +| File | Read by | What has to happen before it can go + +| `.machine_readable/contractiles/must/Mustfile.a2ml` +| `scripts/run-mustfile.sh`, the required K9-SVC contractile check +| The two-file versus four-file contractile ruling (ruling 2 in the + critical-path plan, still open) and a k9 runner for the Must checks. + +| `.machine_readable/Debtfile.a2ml` +| `scripts/run-debtfile.sh`, `check-debt-ratchet.sh`, `debt-measure.yml` +| A deed or k9 form for the ledger (DEBTFILE-SPEC is draft). The weekly + measure run writes new counts into an `.a2ml`, which CLAUDE.md forbids. + +| `hypatia-rules/*.a2ml` (8 rules) +| hypatia's RuleLoader, from the scanned standards checkout +| A deed or k9 rule form, adopted in hypatia and standards together. + +| `0-canon/rsr/rsr-criteria-v2.a2ml` +| `canon.lock` (hash-pinned artefact), hypatia `rsr_score` +| kyX conversion (D313); D320 already skips it in the UUID checker. + +| `CLAIMS.a2ml` +| `dyadt-verify.yml` +| A deed form for DYADT claims; D32 says rewrite DYADT against its spec. + +| `.machine_readable/descriptiles/*.a2ml`, `CLADE.a2ml`, + `anchors/ANCHOR.a2ml`, `integrations/*.a2ml`, `rsr-profile.a2ml`, + `bot_directives` (still under the deprecated directory name) +| Agents, `0-AI-MANIFEST.a2ml`, `check-rsr-profile.sh` +| Fold into `standards_chora.deed` (D312). The checker cannot yet read + a deed profile (#1227). +|=== + +Everything else in `.a2ml` is history (the seven format specs under +`1-formats/a2ml/`, the templates, `SATELLITES.a2ml`, the scorecard +archive, audits, the UUID v7 standard) and belongs in `9-archive/`. + +=== Contradictions register + +Each row is a `contradiction` in the constitution's sense: two committed +texts disagree. The plan resolves each by an authorised change that +names what it supersedes, never by a silent edit (Intake Rule 8). + +[cols="3,3,2",options="header"] +|=== +| Texts in conflict | Evidence | Who resolves + +| `NOTICE` says the project is licensed PMPL-1.0-or-later; `LICENSE`, + the README badge, `.claude/CLAUDE.md` and `coordination.k9` say + MPL-2.0. +| `NOTICE` lines 4-5; `LICENSE`; `README.adoc` line 4 +| Owner (licence text is manual-only). + +| `PALIMPSEST.adoc` names three PMPL repos and its header summary says + "Hyperpolymath original code — standard: AGPL-3.0-or-later"; + `3-practice/LICENCE-POLICY.adoc` names five and says MPL-2.0. +| `PALIMPSEST.adoc` lines 15-16, 86-88; `LICENCE-POLICY.adoc` lines 47-53 +| Owner (#497 is the open flag). + +| `.machine_readable/licensing-policy.toml` says "EXACTLY three repos" + and 007 is out of scope; `LICENCE-POLICY.adoc` registers five and + puts 007 under Rule 4; `.claude/CLAUDE.md` calls 007 All Rights + Reserved; D134 and D246 say MPL-2.0 code / CC-BY-SA-4.0 docs. +| `licensing-policy.toml` lines 35, 51; `CLAUDE.md` line 18 +| Owner: one row on the decision sheet settles 007. + +| D271 rules insolvency-tycoon a game (AGPL); the PMPL register lists it. +| `LICENCE-POLICY.adoc` line 52; #787 D271 +| Owner. + +| `coordination.k9` invariant `pmpl-license-only` ("All original code + uses PMPL-1.0-or-later") against Rule 1; invariant + `a2ml-in-machine-readable` and `self-dogfooding` require A2ML files + that are retired. +| `coordination.k9` lines 56-80 +| Bot (rewrite the invariants to the deed era; the file is the format's + own reference implementation). + +| `3-practice/LANGUAGE-POLICY.adoc` says Bun offers "Native TypeScript + execution" and TypeScript "is permitted only where AffineScript cannot + reach"; `.claude/CLAUDE.md` (2026-08-27 ruling) says TypeScript + "should not exist at all" and leaves the exemptions table flagged. +| `LANGUAGE-POLICY.adoc` lines 26, 60; `CLAUDE.md` TypeScript note +| Owner: ruling on the exemptions table (#663, #921). + +| Two "canonical" language policies: `0-canon/rsr/LANGUAGE-POLICY.adoc` + (v1.6.0) and `3-practice/LANGUAGE-POLICY.adoc` (the map's canonical). + Siblings cite both. +| `standards-map.toml` lines 700-708; farm `runtime-policy.yml:4` +| Bot: archive the 0-canon copy as a redirect. + +| `.meta/REQUIRED-FILES.adoc` requires `.tool-versions`; `.gitignore` + ignores it; the provisioning standard replaced it with `mise.toml`. +| `.meta/REQUIRED-FILES.adoc` line 15; `.gitignore` line 76 +| Bot. + +| `hooks/pre-commit` says Python is allowed for Ansible; the policy says + fully banned. +| `hooks/pre-commit` line 40 +| Bot (the whole `hooks/` tree is a duplicate of `.githooks/`). + +| `0-AI-MANIFEST.a2ml` tells agents `.machine_readable/descriptiles/` is + authoritative for state and to read `STATE.a2ml`; D312 says the deed + is. +| `0-AI-MANIFEST.a2ml` invariant 2, startup checklist +| Bot, after the family-7 ruling (<>). + +| `ROADMAP.adoc` says "Current State (2026-05-28)", lists the A2ML + family as complete and the registry as live; `EXPLAINME.adoc` lists + "A2ML over YAML/JSON" as a durable decision and routes new projects to + the retired A2ML template. +| `ROADMAP.adoc` lines 8-24, 60-64; `EXPLAINME.adoc` lines 36-37, 55 +| Bot. + +| `QUICKSTART-DEV.adoc` lists Deno as the protocol runtime and + `a2ml/bindings/rust` as a sub-project; both are gone. +| `QUICKSTART-DEV.adoc` lines 12-18, 62-75 +| Bot. + +| `hypatia/lib/rules/cicd_rules.ex` registers three PMPL repos (one + misnamed) and puts paint-type on the PMPL exception list; + `LICENCE-POLICY.adoc` registers five and makes paint-type AGPL. +| `cicd_rules.ex` lines 1649-1738 +| Owner approval, then hypatia reads the register from standards. +|=== + +=== Duplicates and dead machinery + +* Two hook systems: `hooks/` (8 files, installed by copying into + `.git/hooks`) and `.githooks/` (18 files, meant for `core.hooksPath`). + Every shared validator differs between them (`validate-spdx.sh` 25 + versus 132 lines). The spine uses `.github/hooks/`. +* Two Justfiles: the root one and `tasks/Justfile`, whose recipes are + stubs ("Build not configured yet") plus two recipes copied from the + root. `tasks/Mustfile` is a three-line stub. +* Three test locations: `tests/` (6), `scripts/tests/` (78), and the + per-sub-spec `conformance/` directories. +* Three audit locations: `audits/`, `docs/audits/`, + `.machine_readable/audits/`. +* Four template locations outside the spine: `templates/`, + `1-formats/templates/`, `3-practice/provisioning/templates/`, + `docs/proofs/spec-templates/`. +* Three nested `.github/` trees whose 21 workflows can never run + (GitHub executes root workflows only): `1-formats/a2ml/meta`, + `2-protocols/0-ai-gatekeeper`, `2-protocols/axel`. +* Absorbed-satellite boilerplate that the README says is inherited from + the root: 70 copies of `LICENSE`, `CODE_OF_CONDUCT`, `CONTRIBUTING`, + `SECURITY`, `MAINTAINERS`, `.editorconfig`, `.gitignore`, + `.gitattributes` and `.nojekyll` under `1-formats/`, `2-protocols/`, + `3-practice/outreach/` and `standards-update/`. (D278b leaves + `3-practice/outreach/` untouched; the plan respects that.) +* Session detritus in `scripts/`: `triage-2026-09-24-apply.sh`, + `triage-2026-09-29-apply.sh` (never run; their planned closures are + why several fixed issues are still open), `propagate-gitignore-67-68.sh`. +* Four Ruby scripts (`plan-ruleset-constraint-repair.rb`, + `reconcile-scorecard-actions-lock.rb` and two tests). Ruby is not in + the allowed-language table. +* Two Python files D313 says are deleted (`1-formats/deed/tools/ + a2ml_to_deed.py`, `deed_lint.py`) plus `migrate_a2ml_to_deed.sh`, + added by a direct push on 2026-10-05, which plans to call the deleted + converter. +* `.hypatia-baseline.json`: 71 of 189 entries name files that no longer + exist; 21 entries expire on 2026-10-21 (#975, #1222). +* Stale front-door text: README says "~7,000 files" (2,907 tracked) and + routes protocols to `*-protocol/` directories that do not exist; + `llm-warmup-user.adoc` tells consumers to copy the seven A2ML files. + +=== `docs/` as a catch-all + +`docs/` holds 419 files: 22 normative policies and specs that belong in +`3-practice/` or `1-formats/`, 10 ADRs, a 993-line generated estate +board, 28 audits, 283 per-repo proof requirement specs, a wiki +scaffold, two session plans, a generic Rust command cheat-sheet, and +four archive sub-trees. The map's verdict is `DISAGGREGATE`; the +placement rules in <> decide each file. + +=== Implementation inside the canon + +#479 evicted 6 of 9 product trees. Residue: `2-protocols/axel` (17 +implementation files including a website, DNS zone, `Containerfile`, +Zig FFI and a banned `deno.lock`), `2-protocols/overlay` (Zig FFI and an +Idris2 ABI), `2-protocols/0-ai-gatekeeper` (FFI, examples, dead CI), +`.verisimdb/` (a Rust crate and container), `hooks/playbook-to-recipe` +(a Rust crate that consumes retired PLAYBOOK.a2ml), +`tools/scm-to-a2ml-bot-directives/migrate.jl` and +`1-formats/templates/state-scm-to-v2.jl` (A2ML migration tools). The +k9-coordination generator and `k9-init` stay: they are the reference +tooling for a live format, like `1-formats/deed/tools/`. + +=== Self-dogfooding gaps + +* No `standards_chora.deed` (D312). The canon mandates one deed per repo + and has none. +* `coordination.k9` carries invariants that contradict the licence and + format policy it sits beside. +* `READINESS.md` was added on 2026-10-13 without a `standards-map.toml` + entry, so Gate D failed on main (fixed in this PR). +* `0-canon/CRG-SELF-ASSESSMENT.adoc` (grade C, 2026-04-09) cites test + suites in evicted code (`a2ml/bindings/rust`, `mcp-repo-guardian`). +* The provisioning standard (v1.0.0, 3-practice) requires `launcher.sh`, + `mise.toml`, `mise.lock`, `manifest.scm` and `channels.scm` in every + repo; standards has none of them and still ships `setup.sh`. +* No root `Mustfile`, although the build-system rule says every repo + uses Mustfile/justfile (the same is true of all seven siblings). + +=== CI and community health + +* 59 workflow files: 23 self-gates (two do nothing: `elixir-ci` with no + `mix.exs`, `makefile-blocker` which exits 1 unconditionally), 15 + reusables consumed by the estate, 2 both, 13 housekeeping, 6 dead + (`changelog`, `check-suite-monitor`, `dependabot-lock-regen`, + `echidna-verify`, `instant-sync`, `pages.yml`). +* Only three checks are live-required on `main`, all admin-bypassable: + `governance / Actions lockfile verify`, `uses ⊆ actions.lock`, + `scan / gitleaks`. The 20-check gate ruleset is disabled since + 2026-10-05 (#890). `gates.json` lists `codeql.yml` as both a gate and + never-required. +* Dependabot PR #1231 bumped 13 workflows without regenerating + `actions.lock`, failed every lock gate, and was merged through red on + 2026-10-13; main stayed red for about seven hours until #1232. +* Red on main at `48e0ed9`: *README Derive* (this repo's bug: the + reusable and its caller both declared the same `concurrency` group, so + the run cancelled itself before any job for 36 consecutive runs; fixed + in this PR), *Mirror to Git Forges* (infrastructure: five of seven + destinations unprovisioned or unset, D261), *GitHub Pages* (one deploy + run has been queued without a runner for 13 days and holds the shared + `pages` group), *debt-measure* (a resolved entry with an expired + acceptance; fixed in this PR), `propagate-hooks` (29 failures, and it + can only propagate to itself), `settings-drift-detect` and + `tag-ruleset-canon` (credentials not provisioned). +* Four PR-time gates check `actions.lock`; `scorecard` and + `scorecard-enforcer` both publish on every push; standards scans + secrets twice per push (once from a six-week-old pin inside + `ci-pipeline`); `uuid-v7.yml` already runs the v8 checker and + duplicates governance. +* Community profile: `SECURITY.md` is at the root but + `CODE_OF_CONDUCT` and `CONTRIBUTING` exist only as `.adoc` under + `3-practice/`, where GitHub does not look. No `CITATION.cff`, which + the spine's `root-allow.txt` requires of every RSR repo. No + pull-request template (the #1231 failure would have been caught by an + "actions.lock regenerated?" checkbox). `.github/ISSUES/` holds seven + issue drafts from 2026-06-05 that were never filed and now contradict + doctrine. `.github/copilot/coding-agent.yml` runs an unpinned `npx` + against `http://localhost`. `CODEOWNERS` names a `Makefile`, a + `3-practice/SECURITY.md` path GitHub does not read, and claims + `require_code_owner_review: true` while no live ruleset has a + pull-request rule. The wiki and Discussions are enabled; D295 says + the wiki is not to be enabled (BerryWiki lives in `docs/wikis/`). + +== Issues: 220 dispositions + +The eight dispositions used, and what each means for a bot: + +[cols="1,3",options="header"] +|=== +| Disposition | Meaning + +| CLOSE-DONE | The defect is gone; a fixing PR or commit exists. Close with a pointer comment naming it (Intake Rule 7). +| CLOSE-MOOT | The premise no longer holds (wiped workstation, archived tree, banned tool). Close citing D110. +| CLOSE-SUPERSEDED(#N) | Another issue or ruling carries the work. Close naming it. +| MERGE-INTO(#N) | A duplicate. Copy any orphaned evidence into #N first, then close. +| OWNER-RULING | One yes/no question for the owner; the exact question is in the record. Goes on the decision sheet. +| BOT-DO | A small fix inside this repository, with files, steps and acceptance named in the record. +| ESTATE-CAMPAIGN | Standards owns the policy; the file changes land in other repositories, one PR per repo, never admin-merged. +| KEEP-OPEN-BLOCKED | Blocked on a credential, a ruling, or another issue, named in the record. +|=== + +Counts: BOT-DO 69, ESTATE-CAMPAIGN 48, CLOSE-DONE 29, OWNER-RULING 24, +MERGE-INTO 19, KEEP-OPEN-BLOCKED 16, CLOSE-MOOT 9, CLOSE-SUPERSEDED 6. + +Six issues (#1219 to #1224) are all titled "Problem". They are not +spam: the owner filed them as deliberate follow-ups to the 9-archive +move and the filing script took the first heading as the title. Each +needs retitling, and each has a real disposition below. + +[[dispositions-table]] +=== The table + +One row per open issue. The full record (literal, golden, mischief, +state, steps, tier, risk) is in the appendix for the issue's range. + +[cols="1,2,6",options="header"] +|=== +| Issue | Disposition | Title +| #89 | KEEP-OPEN-BLOCKED | Epic: -iser regeneration-cartridge pattern — wire all 28 -isers into boj-server (unified gated adapter) +| #90 | OWNER-RULING | Roll unified-gated-adapter + SSE + regen-trigger into the iseriser scaffold +| #91 | KEEP-OPEN-BLOCKED | http-capability-gateway tier-2 production-wiring (ADR-0004) +| #92 | OWNER-RULING | Idris2 as source-of-truth: generate/verify Zig FFI from the ABI +| #93 | KEEP-OPEN-BLOCKED | Stop committing generated/ — gitignore + regenerate-on-trigger +| #100 | MERGE-INTO(#91) | Phase E — Production wiring + staging validation + rollout/rollback runbook +| #124 | CLOSE-DONE | Epic: estate proof-debt remediation (2026-05-18 reconciled audit) +| #156 | BOT-DO | [#92 Class D] abbreviation / acronym-boundary drift across DB + cloud cartridges +| #239 | OWNER-RULING | [campaign] TypeScript → AffineScript estate migration (UMBRELLA) +| #252 | ESTATE-CAMPAIGN | [campaign] ReScript → AffineScript estate migration (UMBRELLA) +| #272 | MERGE-INTO(#252) | [campaign #252] STEP 5 — TAIL BATCH: smallest tail-end repos (≤20 files × ~50 repos) +| #276 | MERGE-INTO(#252) | [campaign #252] STEP 6 — MID-TIER: 20-100 file repos (~15 repos) +| #278 | MERGE-INTO(#252) | [campaign #252] STEP 7 — LARGE REPOS: 100-500 file repos (~6 repos) +| #279 | MERGE-INTO(#664) | [campaign #252] STEP 8 — MEGAPORT: idaptik (516, was 1235) + panll (726) batched conversion +| #281 | OWNER-RULING | [campaign #239] Estate seam audit: stale .claude/CLAUDE.md language tables + carve-out candidate pattern +| #288 | ESTATE-CAMPAIGN | [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) +| #306 | ESTATE-CAMPAIGN | ci(estate): Pages enablement decision needed across 48 repos (failing 'Setup Pages' on every push) +| #309 | ESTATE-CAMPAIGN | [campaign] Python residual cleanup — ~45 estate-authored .py files remain (banned) +| #323 | MERGE-INTO(#288) | [standing] Estate CodeQL cron drift detection + 6-week budget review +| #324 | MERGE-INTO(#288) | [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos) +| #331 | ESTATE-CAMPAIGN | [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + http://) +| #343 | ESTATE-CAMPAIGN | audit: dotfile drift across estate (2026-06-02 sample) — .editorconfig / .gitignore / .gitattributes +| #346 | OWNER-RULING | governance: hoist bridge-forbidden-phrases check into reusable workflow +| #348 | ESTATE-CAMPAIGN | automation: hypatia ruleset + gitbots should be able to fan-out doc + descriptiles + contractile refreshes themselves +| #401 | BOT-DO | Docs: complete the audience-split education layer (docs/wikis/) +| #403 | OWNER-RULING | Build the Estate Manifesto & Atlas (front-door, owner-gated) +| #404 | CLOSE-SUPERSEDED(#787 D265/D270) | Estate licence cascade (PMPL -> MPL/CC-BY-SA axis) — per HANDOFF +| #408 | ESTATE-CAMPAIGN | policy: estate settings standard — merge opts, protection, required-checks = 🔴 Gate set (WS4) +| #409 | BOT-DO | promote CI-CRITICALITY tiers (Gate/Check/Advisory/Auto) → standards + rsr-template +| #410 | BOT-DO | standard: MCP settings template = boj-server cartridge config (WS6) +| #411 | ESTATE-CAMPAIGN | standard: discussion + wiki templates + discussions-toggle policy (WS5/WS8) +| #438 | ESTATE-CAMPAIGN | Estate recovery: audit + revert unauthorized mass migrations (README .adoc→.md sweep; protected rescript/v-ecosystem repos) +| #443 | KEEP-OPEN-BLOCKED | Estate campaign: roll SonarCloud across all repos (parked, resume later) +| #446 | OWNER-RULING | Proposal: an honest, adoptable readiness/insight badge framework +| #460 | CLOSE-DONE | [umbrella] Estate audit & optimization — make the enforcement real (Waves 0–6) +| #462 | KEEP-OPEN-BLOCKED | Implement the DYADT production verifier (hyperpolymath/did-you-actually-do-that) +| #463 | BOT-DO | Complete the per-language testing guides (Zig, BEAM, proofs) + Julia refresh + AffineScript SSOT +| #479 | CLOSE-DONE | [campaign] standards carve-out: evict products/impls, keep the canon +| #493 | BOT-DO | [carve-out 4/9] rhodium-standard-repositories/ cleanup: de-vendor satellites/, merge templates, delete the lying .gitmodules +| #495 | BOT-DO | [carve-out 6/9] Data out of spec dirs: grade data → archive, PORT-REGISTRY → verisim-data, retire SATELLITES.a2ml +| #497 | OWNER-RULING | [carve-out 8/9] ⚠️ OWNER-ONLY licence-flag items: 007 audits in public canon; PALIMPSEST.adoc narrative +| #633 | ESTATE-CAMPAIGN | [umbrella] Estate control plane: close the automation loop +| #634 | ESTATE-CAMPAIGN | [umbrella] Template family rationalisation: variant packs, not variant repos +| #635 | ESTATE-CAMPAIGN | [umbrella] Surface the buried projects (DYADT; detector) +| #636 | KEEP-OPEN-BLOCKED | [charter] git-logistics-office: estate control plane (repo lifecycle) +| #645 | KEEP-OPEN-BLOCKED | Fix the scaffold that propagates "License: PMPL-1.0-or-later" (runbook §7a) +| #646 | OWNER-RULING | AGENTIC.a2ml instructs agents "Never use AGPL", contradicting the licence rules +| #653 | ESTATE-CAMPAIGN | 40 referenced-but-absent files across 19 repos +| #657 | CLOSE-SUPERSEDED(#803) | MEASURED: a lockfile policy kills 77% of dead workflows +| #658 | ESTATE-CAMPAIGN | Deno→Bun: 30 deno.json; 18 blocked on npm packages that don't exist +| #659 | ESTATE-CAMPAIGN | Language policy duplicated into ~372 per-repo CLAUDE.md files +| #662 | ESTATE-CAMPAIGN | wordpress-tools PR #57 deleted 108 source files and added nothing +| #663 | OWNER-RULING | TypeScript retirement measured: 308 of 613 .ts were never exempt +| #664 | ESTATE-CAMPAIGN | 43% of estate .affine files are 200-byte Harvard Engine stubs +| #668 | BOT-DO | gh search/code silently undercounts; adopt enumerate-then-filter as doctrine +| #669 | ESTATE-CAMPAIGN | Orphaned/phantom action pins still live: dtolnay ×35, trufflehog ≥20, codeql ≥14 +| #670 | KEEP-OPEN-BLOCKED | Dependabot bumps uses: without regenerating actions.lock +| #674 | CLOSE-DONE | Scorecard PinnedDependencies is wrong for lockfile-enforced repos +| #675 | ESTATE-CAMPAIGN | Idris2 postulate misconception in civic-connect and ideas-to-alphas +| #677 | CLOSE-MOOT | 13 repos have a damaged git object database +| #678 | ESTATE-CAMPAIGN | 132 repos track .gitignored files; template-sync left a silent fake gate in 29 +| #681 | ESTATE-CAMPAIGN | 342 of 415 repos cannot merge a clean PR without --admin +| #687 | BOT-DO | audit(hypatia): classify 61 SD022 + HYP-S009 findings +| #689 | CLOSE-MOOT | fix(rsr-certifier): complete or honestly gate the uncompilable satellite +| #692 | OWNER-RULING | policy: Rust = Rust + Creusot, without proof theatre +| #698 | OWNER-RULING | Banned languages in dev-environment definitions (guix.scm ×14, mise.toml) +| #702 | ESTATE-CAMPAIGN | install-tools.sh regenerated without the #678 cure (245/248 fake gates) +| #703 | CLOSE-MOOT | Duplicate checkout trees double-count every estate census +| #704 | BOT-DO | examples/web-project-deno.json ships phantom npm:affinescript, replicated across ≥12 repos +| #705 | CLOSE-DONE | proven: postulate cure not on origin/main (lived only as uncommitted local files) +| #706 | ESTATE-CAMPAIGN | mise.toml pins banned toolchains estate-wide (python 543/573; deno 59) +| #707 | ESTATE-CAMPAIGN | Phantom upload-artifact pin ea165f8d65b6db9a… (never existed) live in 11 repos +| #708 | CLOSE-DONE | Lockfile Drift Detect anonymises repos, miscounts, and only ran once +| #727 | ESTATE-CAMPAIGN | gh actions-lock fix mode prepends its banner above the SPDX header +| #732 | KEEP-OPEN-BLOCKED | AI-MANIFEST ply relay items after #731 +| #750 | MERGE-INTO(#668) | Deletion census: use git ls-files --deleted, never git status +| #751 | CLOSE-DONE | Agent handover surface is lossy: .claude/checkpoints prunes files +| #759 | ESTATE-CAMPAIGN | [decision] 72 of 111 rhodibot workflows still run the MUTATING variant weekly +| #791 | CLOSE-DONE | githooks: validate-a2ml admits 0/222, validate-spdx rejects every .adoc +| #792 | CLOSE-MOOT | Pin-consumption census TSV has two extractor defects +| #795 | BOT-DO | 1,073 Optimus-Branch.json replicas are stale and weaker; design-doc pointer broken +| #803 | KEEP-OPEN-BLOCKED | lockfile drift: 163 repos as of 2026-10-13 (bot-maintained) +| #808 | ESTATE-CAMPAIGN | RSR workflow templates use an illegal uses: ../../ ref +| #837 | KEEP-OPEN-BLOCKED | DEED conversion campaign: tracking and acceptance criteria +| #887 | MERGE-INTO(#890) | D65: EstatePushing is an active org ruleset with zero rules +| #888 | BOT-DO | secret-scanner-reusable stages the estate baseline unconditionally +| #889 | ESTATE-CAMPAIGN | 22 hyperpolymath repos have blank descriptions (5 public) +| #890 | BOT-DO | Optimus-Branch enforcement:disabled; 0 rules in force on main +| #894 | BOT-DO | Gate table + criterion 1.2.1 ignore manifest.scm +| #895 | BOT-DO | Gate format cannot express partial modules or nested layouts +| #896 | BOT-DO | changelog-reusable can never start: write perms checked against caller top level +| #897 | BOT-DO | Canonical cliff.toml should strip ZWSP at generation +| #903 | CLOSE-DONE | actions-lock cliff: ENFORCE_ACTIONS_LOCK_FROM=2026-10-01 reddens 163 callers +| #904 | BOT-DO | run_validator() is fail-open: 6 validators missing in the rsr-template pre-commit +| #905 | CLOSE-DONE | runtime-policy.yml's Deno branch emits only ::warning:: +| #906 | CLOSE-DONE | workflow-lint's lock regex blind to '- uses:' list items +| #907 | BOT-DO | check-actions-lock-gate.sh unconditionally exempts actions/github-script and hyperpolymath/standards/ +| #908 | BOT-DO | root-allow.txt registered in the exemption ratchet but absent on disk +| #909 | CLOSE-MOOT | actions.lock never covers denoland/setup-deno +| #910 | CLOSE-DONE | governance-reusable.yml has 7 'ref: main' helper checkouts +| #911 | CLOSE-MOOT | shell-e2e-reusable.yml has the repo's only 2 unpinned refs (owner's staged work: report only) +| #913 | ESTATE-CAMPAIGN | 76 'uses: ../../...' relative refs in vendored seeds are invalid syntax and cause startup death +| #914 | CLOSE-MOOT | 46 genuinely unpinned third-party refs in the vendored seed trees +| #915 | CLOSE-DONE | ~138 files cannot carry a '#' SPDX header; 58 .json need REUSE sidecars +| #916 | MERGE-INTO(#919) | setup-deno pins are inconsistent and some look fabricated: one SHA labelled four different tags +| #917 | ESTATE-CAMPAIGN | 234 .pre-commit-config.yaml files depend on Python, which LANGUAGE-POLICY bans +| #918 | MERGE-INTO(#950) | Mirror callers drifted across >=3 live SHAs (de-duplicate worktrees before counting) +| #919 | ESTATE-CAMPAIGN | Deno retirement sizing: 95 'deno task' definitions across 23 files in the 11 ledgered repos +| #921 | MERGE-INTO(#659) | 55 agent-instruction files assert 'TypeScript IS PERMITTED under Bun', contradicting the 2026-08-27 ban +| #922 | OWNER-RULING | No pinned Bun lint/format gate: staged JavaScript is a declared skip +| #923 | BOT-DO | The Deno ruling is dated two ways across the estate (2026-08-26 vs 2026-09-22) +| #924 | OWNER-RULING | rsr-template-repo has 62 unpinned workflow refs, including two @main and one feature branch +| #925 | ESTATE-CAMPAIGN | check-ts-allowlist.deno.js cannot be deleted: 11 of the last 12 governance revisions still invoke it +| #926 | BOT-DO | k9-coordination-protocol vendors a Deno test harness: 260 Deno API lines across 10 files +| #928 | CLOSE-MOOT | language-policy.scm v2.0.0 has no wired regression test (needs a decision on guile in CI) +| #929 | BOT-DO | Seed CLAUDE.md claims the estate uses GitLab and not GitHub (flag only, owner decision) +| #930 | BOT-DO | actions-lock gate's remedy text names a repo-relative path that exists in no consumer repo +| #932 | BOT-DO | validate-lint-format.sh: Rust and Nickel arms ask a different question than their tool +| #933 | BOT-DO | All 12 Rust crates fail cargo fmt --check (pre-existing formatting debt) +| #934 | CLOSE-DONE | 6 contractiles fail nickel typecheck: import path points one level off an existing file +| #935 | CLOSE-DONE | actions-lock gate is permanently red on main, and its remediation contradicts canon rule 10 +| #937 | BOT-DO | Hypatia content_patterns/http_in_docs: plain-HTTP URLs in prose (11 instances) +| #938 | BOT-DO | Hypatia content_patterns/npx_in_workflow: npx/npm in CI config (9 instances, stale rule + vendored) +| #940 | CLOSE-MOOT | Hypatia content_patterns/known_fake_action_sha in vendored satellite examples (6 instances) +| #941 | ESTATE-CAMPAIGN | Hypatia RE001: adopt step-security/harden-runner estate-wide, or record WONTFIX (23 instances) +| #943 | BOT-DO | Hypatia workflow_hardening triage: secrets-inherit convention + WH013/WH006 false positives (7 instances) +| #944 | BOT-DO | Banned-language deed tools: port a2ml_to_deed.py + deed_lint.py off Python, or exempt permanently (2 files) +| #945 | BOT-DO | Hypatia misc: scorecard DependencyPinning + SD022 k9 spec stale path (2 instances) +| #949 | CLOSE-SUPERSEDED(#950) | Estate health: 87% of default branches are red (388 of 447) — a red branch is no longer a signal +| #950 | BOT-DO | Mirror fleet: 27% of estate CI failures — destinations unprovisioned, advisory doctrine not implemented, 3 live caller refs +| #953 | BOT-DO | debt paydown: gate-scripts-without-tests re-baselined 30->40, todo-fixme 76->80 +| #955 | BOT-DO | Debt ratchet red on every PR since #820 — run-debtfile.sh --write emits a file check-debtfile-structure.sh rejects +| #957 | BOT-DO | PAT-refresh tripwire: live HYPATIA_SCAN_PAT will arm 6 unackable CSA findings in both gates +| #958 | BOT-DO | Debt-exception / Ratchet-exception trailers never survive the squash merge — 0 of 8 in the Debtfile's whole history +| #960 | KEEP-OPEN-BLOCKED | D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted launcher-standard.a2ml +| #963 | CLOSE-DONE | main is red: actions.lock omits a transitive dependency of asana/push-signed-commits (actions/setup-python@v2) +| #964 | BOT-DO | governance-reusable.yml dupkey helper pin 317101e0 is stale by 45 files — and its sparse-checkout scope is too wide for #962's freshness guard +| #967 | CLOSE-DONE | ci-pipeline detect is blind to 56 code-bearing repos (and probes Deno, not Bun) +| #968 | ESTATE-CAMPAIGN | actions.lock step-level desync: 39 repos with silently dead CI (startup_failure) +| #969 | MERGE-INTO(#993) | actions.lock omits job-level reusable refs in 159 repos (no runtime impact; tracks upstream #129) +| #972 | BOT-DO | pre-commit hands validators git-QUOTED paths, so non-ASCII filenames are silently skipped (6 validators) +| #975 | BOT-DO | 21 baseline acks lapse on 2026-10-22 and 17 point at closed issues +| #976 | BOT-DO | detect: the Nickel probe matches RSR template boilerplate, silencing the zero-denominator refusal on 9 of 24 sampled repos +| #980 | CLOSE-DONE | ci-pipeline.yml: the ledger pin's "same commit" invariant is unsatisfiable (12/12 merges are squash) +| #981 | BOT-DO | validate-actions-lock prescribes a cure that can re-legitimise a blocked action version +| #987 | ESTATE-CAMPAIGN | Phantom blob-pin: 18 refs across 7 repos pin standards reusable workflows at non-commit SHAs +| #991 | OWNER-RULING | AC4 arming policy: retired-filename blocks, stale-version warns +| #992 | BOT-DO | check-lock-sync.sh and GitHub startup disagree for job-level-reusable-only callers, and the gate's error text is inverted +| #993 | OWNER-RULING | actions.lock policy: job-level reusable refs are reported, never required — and the pin bump that disarms the latent blocker +| #994 | OWNER-RULING | Cross-cutting governance reds surfaced by the actions.lock cure — 9 classes across 17 PRs +| #998 | CLOSE-DONE | ci-pipeline.yml: standards does not call its own pipeline (AC6 of #986) +| #999 | BOT-DO | config.ncl cannot be evaluated: std.record.merge does not exist +| #1000 | CLOSE-DONE | 8 of 16 .k9.ncl files lack the K9! line-1 sentinel +| #1001 | BOT-DO | os_detect.ncl: 'Apple_Darwin falls through to the wildcard in deployment_priority +| #1002 | MERGE-INTO(#950) | Mirror to Git Forges: 3 of 7 forges failing, three different root causes +| #1003 | MERGE-INTO(#1008) | rsr-template-repo: no ruleset requires pull requests on any branch +| #1004 | OWNER-RULING | Estate census: 124 of 456 repos carry retired or unsatisfiable ruleset rules (report only) +| #1006 | KEEP-OPEN-BLOCKED | EstateTagging's workflows rule is vacuous (workflows: []), and no Integration can create a tag org-wide +| #1007 | BOT-DO | EstatePushing is scoped ~ALL but binds to 6 of 68 repos — push rulesets reach private repos only +| #1008 | ESTATE-CAMPAIGN | rsr-template-repo Base ruleset repaired; 5-8 error-severity alerts remain (threshold semantics undetermined), and copilot_code_review may be a fifth unsatisfiable rule type +| #1010 | CLOSE-DONE | ci: retire the dead A2ML validation gate (13 repos — the renamed-action population) +| #1014 | BOT-DO | governance: the Hypatia scanner pin predates the consumer fixes it scans for +| #1015 | BOT-DO | check-action-pins-resolve.sh scans prose: a documentation example SHA fails the gate +| #1018 | BOT-DO | rust-ci-reusable: explicit ref refs/pull/N/merge dies when the PR merges mid-run +| #1019 | MERGE-INTO(#1091) | CodeRabbit's unsigned pushes re-kill CI on every required_signatures repo +| #1024 | ESTATE-CAMPAIGN | KYAML step 5/6 — migrate estate-authored non-bot YAML +| #1025 | KEEP-OPEN-BLOCKED | KYAML step 6/6 — workflows, only if step 4 rules them in scope +| #1031 | ESTATE-CAMPAIGN | CodeQL default setup and a committed advanced workflow cannot coexist — 3 metadatastician repos run both +| #1032 | BOT-DO | O6 propagation: four contradictions between the ruling and the committed rulesets +| #1033 | BOT-DO | gates.json: never_required_contexts cannot catch default-setup CodeQL by name +| #1035 | ESTATE-CAMPAIGN | 27 Scorecard callers omit actions:read and will startup_failure on their next standards pin bump +| #1036 | CLOSE-DONE | Scorecard reconciler fails correct repos: gh actions-lock --verify is blind to job-level reusable refs +| #1037 | CLOSE-SUPERSEDED(#1093) | 48 open Dependabot PRs re-introduce the codeql-action v4.38.1 startup-killer, and the dependabot.yml ignore rule is being bypassed in 15 repos +| #1049 | OWNER-RULING | Estate listing: 35 repositories are below the RSR 7-topic minimum +| #1055 | ESTATE-CAMPAIGN | Orphan refs: agents leave unrelated-history branches no gate can see (8 arena/ refs; #1005 AC2 drift) +| #1056 | MERGE-INTO(#994 + #968) | slavia #100 closure: class notes for #994, startup-death mechanics + Dependabot recurrence for #968 (cross-file) +| #1058 | CLOSE-DONE | grammar artifacts: .k9 has no grammar/contract; deed.abnf says both "sole normative" and "pending owner ruling" +| #1059 | BOT-DO | decide the attestation chain canon → .deed → .k9 → Nickel → env → serialisation; "derived, never restated" +| #1065 | BOT-DO | apply-branch-gates: a path-filtered pull_request trigger is reported PR-reachable +| #1066 | BOT-DO | LANGUAGE-POLICY.adoc says Idris2-only; language-policy.scm sanctions Agda +| #1068 | BOT-DO | yq -i is not idempotent: a second run moves a comment block +| #1069 | ESTATE-CAMPAIGN | cargo-audit producer opens vulnerability trackers but never closes them (9 live trackers) +| #1070 | ESTATE-CAMPAIGN | Umbrella: 14 per-repo triages of pre-existing red checks surfaced by the actions.lock cure +| #1071 | CLOSE-SUPERSEDED(#837) | Umbrella: machine-readable currency deferred follow-ups (4 repos) +| #1079 | CLOSE-DONE | check-uuid-v7: only the LAST UUID on a line is checked +| #1080 | BOT-DO | Debtfile gate-scripts-without-tests probe cannot see actions-policy-486-test.sh +| #1081 | MERGE-INTO(#1082) | Ruleset 23787415 requires 'SonarCloud Code Analysis', which no PR receives +| #1082 | KEEP-OPEN-BLOCKED | SonarCloud never reports on standards PRs; removed from ruleset 23787415 until it does +| #1085 | ESTATE-CAMPAIGN | k9-coordination: actor grants (fence × leash), deny-by-default, compiled to bypass lists, bot configs and a PreToolUse hook (D213/D214) +| #1086 | ESTATE-CAMPAIGN | Launcher census: 20 launchers still put the PID file under ${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}} (CWE-377) +| #1089 | BOT-DO | OWASP gate gap: method policy, ASVS probe and SSRF rule are declared but not gated +| #1091 | ESTATE-CAMPAIGN | D217/D215b: convert unsigned commit producers, then enforce signatures on 61 repos (+18 in comment) +| #1093 | ESTATE-CAMPAIGN | codeql-action: ~53 repos startup-dead from 4.38.2 bumps without the lock record; 4.38.1 was never broken +| #1101 | BOT-DO | Carve-outs via subtree split strip every commit signature (lol, #680) +| #1102 | CLOSE-DONE | Fork-PR security gate never started: pull_request_target refused by Actions policy +| #1107 | BOT-DO | Provisioning canon: four gaps found by the 8-repo pilot +| #1108 | ESTATE-CAMPAIGN | Secret-Scan-Floor (D243/D244): sweep results and open items +| #1109 | OWNER-RULING | Estate: needs me +| #1122 | BOT-DO | Lock repair chain drops composite-action edges, and --verify-local accepts the result +| #1125 | BOT-DO | canon: template-capability-gates.toml still counts flake.nix as reproducible-build +| #1137 | CLOSE-DONE | Workflow security linter: duplicate-key checker false-positives on KYAML flow sequences +| #1140 | CLOSE-SUPERSEDED(#1197) | UUID v7 checker needs an explicit legacy/external identity preservation contract +| #1141 | BOT-DO | Reusable workflows reference secrets without declaring them (WH008 unsatisfiable) +| #1147 | BOT-DO | fix(ci): replace the three actions the estate policy rejects at start-up +| #1172 | CLOSE-DONE | Allowlist Preflight red on main: check-allowed-actions.sh compares owner/repo case-sensitively +| #1173 | CLOSE-DONE | Hypatia baseline and scan red on main: 12 new findings since #1143 +| #1174 | CLOSE-DONE | Self Test red on main: direct push 5b56aec0 overwrote kyaml-format.sh +| #1219 | BOT-DO | "Problem": validate-k9.sh SIGPIPE false negatives under pipefail +| #1220 | BOT-DO | "Problem": rhodium-standard-repositories/actions-allowlist is a residual outside 9-archive +| #1221 | BOT-DO | "Problem": root coordination.k9 does not parse under its grammar; no validator +| #1222 | MERGE-INTO(#975) | "Problem": .hypatia-baseline.json entries expire ~2026-10-21 +| #1223 | BOT-DO | "Problem": three references to non-existent RSR.adoc / spec/LANGUAGE-POLICY.adoc +| #1224 | OWNER-RULING | "Problem": Scorecard alerts on byte-identical archived template after the 9-archive move +| #1225 | OWNER-RULING | Ruling needed: canonical launcher metadata domains/encoding and offline fallback authority +| #1226 | OWNER-RULING | Ruling needed: per-app launcher praxis field vocabulary before the 21-descriptor migration +| #1227 | BOT-DO | check-rsr-profile.sh never evaluates [baseline]; its .well-known/ row predates the www/ migration +| #1228 | BOT-DO | [gates] src//.rs is root-anchored; cargo workspaces can never satisfy it +| #1229 | BOT-DO | TEMPLATE-APPLICABILITY-POLICY baseline still requires 0-AI-MANIFEST.a2ml while the template retired .a2ml +| #1230 | OWNER-RULING | Rule estate-chora UUIDv8 profile-C preimage/alias before launcher emission cutover +| #1234 | KEEP-OPEN-BLOCKED | Owner decision sheet D332+ (successor to #787): open rows and execution queue + +|=== + +=== What cuts across the backlog + +. *Rulings exist but were never executed, and labels still say + "needs-owner".* D8, D10, D14, D23, D24, D25, D28, D30, D31, D36, D48, + D128, D132, D133, D139, D163, D164, D165, D166, D168, D169, D170, + D172, D313 each answer an open issue. A pointer-and-label pass clears + roughly a third of the backlog without any code. +. *Fixes land without closing their issue.* #1184, #1176, #1171, #1180 + each fixed issues that remain open. Fourteen of 130 commits since + 2026-09-30 were direct pushes with no PR; two of them added + "Decision D???" documents with no register row, one overwrote a + working script (#1174), one added a bulk A2ML converter against D313. + The two close-out scripts in `scripts/` were never run. +. *Retired formats are written into the plans themselves.* #348, #346, + #401, #403, #462, #91, #100 and #479 literally ask for A2ML writes or + a registry regeneration. Every bot prompt below says "deed or k9 only; + never write `.a2ml`". +. *Migration counts cannot tell completion from deletion.* 43% of estate + `.affine` files are 200-byte stubs (#664); the ReScript and TypeScript + tallies fell partly through deletion; #93 measured the wrong + population; #288 counted nested workflows that never run. Acceptance + checks must name the population and must not be satisfiable by + deleting files. +. *The real blockers are credentials and admin actions, not code.* The + applier App credential (O11) does not exist, so + `dependabot-lock-regen`, `apply-workflow-pins` fix mode and + `signed-push-smoke` finish green having done nothing, and lock drift + grew from 15 to 163 repos in four weeks (#803). SonarCloud binding, + `admin:org` for D16 and D298, forge provisioning for the mirrors, a + security-scoped token for code-scanning dismissals and write tokens + for sweeps are all owner actions. +. *The 2026-10-09 archive move changed many issues but the gates still + treat `9-archive/` as live.* Hypatia scans it (dozens of baseline + acks point there), `ci-pipeline` lints its Nickel, and only + `validate-sha-pins` and `validate-k9` exclude it. One rule, "the + archive is frozen and excluded from every gate", with a + `.hypatia-ignore` entry and a banner, clears a whole class. +. *The 2026-10-21 deadline.* 21 baseline acknowledgements expire that + day; expired acks are dropped and their findings return, so Hypatia + can turn red from 2026-10-22. #975 is the first packet in Phase 1. + +== Wiring to the seven siblings + +The full matrix and the 40-item drift list are in the wiring appendix. +The shape: + +* Siblings pin nine distinct standards SHAs, 101 to 544 commits behind + main. None is a phantom or blob pin (#987 class is clear). Six of seven + pins predate #1120 and so build the Hypatia scanner from floating + hypatia HEAD, the class behind the September outages. +* `actions.lock` keys the standards-calling workflows as `[]` in + hypatia, proven-tests-and-benches and .git-private-farm; cicd-suite + leaves two workflows out. None of the four runs `lock-sync-gate`. +* Only rsr-template-repo has a `_chora.deed` and a `(canon …)` + pin (2.1.2, hashes match). Hypatia never reads `canon.lock` and scores + against a 2.0.0-draft criteria fixture. gitbot-fleet's copy labels the + same hashes 2.1.1; standards' own `rsr-profile.a2ml` says 2.1.0. +* Policy text is copied, not pinned, and the copies disagree with the + canon: cicd-squabbler's agent files say "use Deno" and "TypeScript → + ReScript" and deny Guix; the template's arrival pack writes "Deny … + AGPL" into every generated CLAUDE.md (#646); gitbot-fleet's manifest + says "all code PMPL". +* The validator hooks are byte-identical in hypatia and two gitbot-fleet + bots; the farm's copies carry fixes never upstreamed; + `check-lock-sync.sh` exists in three forks, the sibling ones ahead of + standards. +* Role overlap: standards, cicd-squabbler and the farm each own a + phantom-required-context detector; standards and the farm each own a + mirror system and a pin propagator; cicd-suite duplicates the secret + scanner, the licence-consistency job and the affirmation check (its + copy is the one actually consumed). +* The 2026-09-02 CI regularisation design, which the owner approved, + rules FOLD or DROP on inline `codeql.yml`, `static-analysis-gate`, + `workflow-linter`, the per-policy workflows, `instant-sync`, + `openssf-compliance`, the farm hookset and `rollout_estate.sh`. All + are still live. + +== Target state + +=== Target root and districts + +.... +standards/ +├── README.adoc EXPLAINME.adoc AGENTS.adoc CHANGELOG.adoc ROADMAP.adoc READINESS.md +├── LICENSE NOTICE LICENSES/ SECURITY.md CODE_OF_CONDUCT.md CONTRIBUTING.md CITATION.cff +├── standards_chora.deed coordination.k9 canon.lock standards-map.toml +├── Justfile launcher.sh guix.scm manifest.scm channels.scm mise.toml mise.lock +├── .github/ (workflows, hooks, templates) .machine_readable/ .claude/ docs/ www/ +├── .editorconfig .gitattributes .gitignore .gitleaks.toml .gitleaksignore .governance-allowlist .hypatia-baseline.json +├── 0-canon/ law: constitution, rsr, canonical names, governance, applicability +├── 1-formats/ deed, k9, contractiles (incl. the contractile and descriptile specs), sub-specs +├── 2-protocols/ specs, grammars, conformance vectors, reference generators; no products +├── 3-practice/ every policy and practice standard, incl. those now under docs/ +├── 4-readiness/ adoption-, foundations-, component-, toolchain-readiness-grades +├── 5-machine/ scripts, tests, config, tools, templates-as-config, hypatia-rules*, launcher* +├── 6-telemetry/ estate board, audits, affirmations, debt and residue ledgers, proof-spec data +└── 9-archive/ rhodium-standard-repositories, the A2ML family, scorecards-v1, retired plans, moved-from register +.... + +`*` `hypatia-rules/` and `launcher/` move last (Phase 8), because +hypatia's RuleLoader and launch-scaffolder's resolution ladder name +their current paths; they move in lockstep with those consumers. + +That is about 28 visible root entries, down from 62. Everything at the +root is there because GitHub, git, a scanner or the estate's own +spine (`rsr-template-repo/.machine_readable/root-allow.txt`) requires +it there. + +[[placement-rules]] +=== Placement rules (the test a bot applies to any file) + +. Does GitHub, git, a scanner or the spine's `root-allow.txt` read it at + the root? Then it stays at the root. Otherwise it leaves the root. +. Is it a *constitutional or canon-law* text, or a canon.lock artefact? + `0-canon/`. +. Does it define *what we read and write* (a grammar, a format spec, a + mapping spec, a conformance corpus, the reference tooling for that + format)? `1-formats/`. +. Does it define *how systems or agents talk* (a protocol spec, its + schemas, IETF drafts, its reference generator)? `2-protocols/`. + Implementations, websites, DNS, containers and language bindings do + not: they go to the protocol's own repository or to `9-archive/`. +. Does it tell people or agents *how to work* (a policy, a standard of + practice, a runbook, a training text, an authoring standard)? + `3-practice/`. +. Does it *grade maturity*? `4-readiness/`. +. Does it *enforce or index* (scripts, tests, gate config, rule + definitions, tooling, templates that a reusable workflow reads)? + `5-machine/`. +. Is it *measured, dated and about the estate as it is* (boards, + audits, affirmations, ledgers, per-repo requirement data)? + `6-telemetry/`. +. Is it *history*: a retired format, a superseded plan, a frozen + snapshot, a last copy? `9-archive/`. Nothing there is edited to + satisfy a gate. +. Is it an ADR, the wiki, or onboarding (quickstarts, warm-ups)? + `docs/`. Nothing else lives in `docs/`. +. A `README.adoc` sits at every district root and routes; the root + README routes to the districts and nothing deeper. + +=== Single-source matrix across the eight repositories + +[cols="2,2,4",options="header"] +|=== +| Artefact | Source of truth | Everyone else + +| Constitution, RSR criteria, gates table, applicability, lifecycle | `standards` `0-canon/` + `canon.lock` | Pins `canon.lock` version and hashes in the repo deed's `(canon …)` clause; lockstep job reads `canon.lock` at the pinned commit, never `main`. +| Language, licence, JSON, YAML, signing and every other policy | `standards` `3-practice/` | Points, never copies (D164). Agent files are generated from the repo deed plus a pointer. +| Reusable workflows and composite actions | `standards` `.github/` | Pins by SHA via `actions.lock`, one standards SHA per repo, keyed `hyperpolymath/standards@`, never `[]`; propagates only with `propagate-workflow-pins.sh`. +| Rulesets and repo settings | `standards` `config/` (future `5-machine/config/`) | The spine carries byte-identical copies verified by hash; cicd-squabbler and the farm call the standards appliers and keep no rulesets of their own. +| Hypatia rule definitions and carve-out lists | `standards` `hypatia-rules/` (rules); hypatia `@blocked_patterns` (carve-outs) | Hypatia keeps evaluators only; the CLAUDE.md carve-out tables are generated from `@blocked_patterns`. +| Repo template, arrival pack, root shape | `rsr-template-repo` (D210) | Standards does not carry a second template set; `templates/` keeps only what a reusable workflow reads. +| Mirror configuration, pin propagation, phantom-context detection | one owner, chosen on the sheet (recommended: standards reusable; farm as verifier only) | The other copies are deleted. +| Hooks (`validate-*.sh`) | `standards` `.github/hooks/` | Siblings fetch through governance at the pinned SHA; no vendored copies. +| Proof and test requirements per repo | `proven-tests-and-benches` is the candidate home (owner sheet) | Standards keeps the proof *policy* only. +|=== + +=== Target CI for this repository + +* One PR-time lock gate (`actions-lock-gate`, running the combined + checks) plus the consumer-facing governance job; `lock-sync-gate` and + `lock-selfcheck` fold into it. +* `governance`, `self-ci`, `self-test`, `deed-conformance`, + `k9-contractile`, `canon-spine-lockstep`, `codeql`, `scorecard` + (with the enforcer folded in), `secret-scanner`, `hypatia-scan`, + `dyadt-verify`, `doc-format`, `allowlist-preflight`, `debt-measure` + as the self-gates. Dead and duplicate workflows retired to + `.github-retired/` (D256), never deleted from history. +* Required on `main`: the set `gates.json` derives, in force (ruleset + enabled), with the admin bypass changed from `always` to + `pull_request` or removed. Until the owner changes the bypass, a red + gate on `main` is not a signal. +* Every reusable declares its secrets (#1141); none carries a + `concurrency` block; `ci-pipeline` calls local copies and drops the + embedded secret scan. +* The archive district is excluded from every gate by one rule. + +== Execution plan for lesser bots + +=== Guardrails for every packet + +These apply to every packet below and are copied into every bot brief +verbatim. + +* Never edit `LICENSE`, `NOTICE`, `LICENSES/`, an SPDX header, or any + licence text. Flag and stop. A new file you author carries the SPDX + the repository classification gives it (MPL-2.0 for code and config, + CC-BY-SA-4.0 for prose) from birth. +* Never create, restore, extend or bulk-convert a `.a2ml` file. A path + repair inside a load-bearing legacy `.a2ml` (Mustfile, Debtfile) is + allowed only when a move makes it necessary, and is called out in the + PR body. Deed or k9 only for anything new. +* Never touch `9-archive/` content or `3-practice/outreach/` (D278b), + third-party or forked trees, or `007`. +* No bulk sweeps across the estate from one PR; one PR per repository, + squash merge, never admin-merged. Measure before you act: enumerate + the population, then filter (#668). Re-measure any count you take from + an issue body. +* One PR per packet. Moves are `git mv` with no content change in the + same commit; path repairs follow in the same PR as separate commits. +* Before pushing, all of: `bash scripts/check-standards-map.sh`, + `bash scripts/check-canon-lockstep.sh`, `bash scripts/run-mustfile.sh + .machine_readable/contractiles/must/Mustfile.a2ml`, `bash + scripts/run-debtfile.sh .machine_readable/Debtfile.a2ml`, `bash + scripts/link-rot-guard.sh .`, `bash scripts/check-canonical-names.sh + HEAD`, `git diff --check`, and `bun 1-formats/deed/tools/deed_lint.js` + on any `.deed` touched. A packet whose acceptance cannot be run is not + done; say so in the PR. +* If a `standards-map.toml` entry's `from` path moves, update the entry + and `entry_count` in the same PR. If a `canon.lock` artefact path + moves, bump `canon.lock` in the same commit (Gate A). +* State the authority for each change in the PR body: the ruling id, the + map target, or "applied-unless-struck, D113" with the (E) arm named. +* Report faithfully. Partial is partial; blocked is blocked; a green + that did not run is not green. + +Model tiers follow `3-practice/ai-instruction/`: *haiku* for scripted +mechanical work whose output is verified by a script, never for +judgement or for file-presence sweeps (its own trial record says those +fail); *sonnet* for implementation against a decided design; *opus* +for cross-repo work, deed authoring and anything that re-reads a +ruling. + +=== Phase 0 (landed in this PR) + +* `standards-map.toml`: `READINESS.md` mapped; Gate D green. +* `.machine_readable/Debtfile.a2ml`: the resolved entry with an expired + acceptance removed, so `debt-measure` passes (Debt-exception trailer + on the commit, per `check-debt-ratchet.sh`). +* `.github/workflows/readme-derive-reusable.yml`: the self-cancelling + `concurrency` block removed. Callers own concurrency. +* `Justfile`: `v1-audit` pointed at the real script path, `build` and + `clean` no longer reference a directory that does not exist, `lint` + delegates to `validate` instead of echoing a banned tool, `llm-context` + reads the `.adoc` warm-ups. +* `.github/funding.yml` (lower-case duplicate naming another owner) + removed; `FUNDING.yml` is the one GitHub reads. +* This pack committed under `docs/reorg/2026-10-14-tidy/`. + +=== Phase 1: hygiene with deadlines (week 1) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P1.1 | sonnet | #975/#1222: for each of the 21 acks expiring 2026-10-21, re-verify the finding; re-ack with a new date and a live tracking issue, or fix the finding. Delete the 71 entries whose `file` no longer exists and the entries whose `tracking_issue` is closed. | `hypatia-scan.yml` green on the PR; `jq` shows zero entries with a missing file and zero expiring before 2026-11-15. +| P1.2 | haiku | Close-and-merge pass: for every CLOSE-DONE, CLOSE-MOOT, CLOSE-SUPERSEDED and MERGE-INTO row in <>, post the pointer comment the record specifies (fixing PR, ruling id, or canonical issue), copy orphaned evidence into the survivor, set `state_reason`, close. Retitle #1219 to #1224 from their first heading. | 63 issues closed or merged; every closing comment names its authority (Intake Rule 7). +| P1.3 | haiku | Label pass: apply `scope:` to every unlabelled issue (D111); replace `status:needs-ruling` with the ruling pointer where the record names a ruling (D8, D10, D23, D24, D25, D28, D30, D31, D36, D48, D134, D139, D163, D164, D165, D166). | Zero open issues without a `scope:` label; zero `needs-ruling` labels on an issue whose record cites a ruling. +| P1.4 | sonnet | Archive-is-frozen rule: add `9-archive/` to `.hypatia-ignore`, exclude it in `ci-pipeline`'s Nickel job and every validator that still scans it, and add a one-paragraph banner to `9-archive/README.adoc`. Then drop the baseline acks that pointed only into the archive. | Hypatia and ci-pipeline green; `grep -c 9-archive .hypatia-baseline.json` is 0. +| P1.5 | sonnet | Mirror honesty (#950, #1002): add destination probes and empty-host guards to `mirror-reusable.yml`, remove the `rad sync \|\| echo` that hides Radicle failures, and set the five unprovisioned forges' `*_MIRROR_ENABLED` to false in this repo until D261 provisions them. | `Mirror to Git Forges` green or honestly skipped on main; no `\|\| echo` in the reusable. +| P1.6 | sonnet | Pages: force-cancel the stuck run (owner or admin token), keep one Pages workflow (least-privilege `pages-archive` body renamed `pages.yml`) or none, and put the "is standards a real website" question on the sheet (D24). | At most one Pages workflow; no run queued over 24 hours. +| P1.7 | sonnet | `.github/` hygiene: delete `ISSUES/` (never filed, re-file live items through the campaign template), delete or pin `copilot/coding-agent.yml`, fix `CODEOWNERS` (drop the `Makefile` and `3-practice/SECURITY.md` lines, correct the header claim), fix the dependabot interval comment, add `PULL_REQUEST_TEMPLATE.md` with an "actions.lock regenerated" checkbox. | Files as stated; `labels.yml`/`label-triage` still green. +| P1.8 | sonnet | Community health: add root `CODE_OF_CONDUCT.md` and `CONTRIBUTING.md` as thin pointers to the `3-practice/` sources (the pattern `SECURITY.md` already uses), add `CITATION.cff`, map all three in `standards-map.toml`. | GitHub community profile shows all items present; Gate D green. +| P1.9 | haiku | Execute the two never-run close-out scripts' intent by hand through P1.2, then move `scripts/triage-2026-09-2{4,9}-apply.sh` and their tests, and `propagate-gitignore-67-68.sh`, to `9-archive/session-scripts/`. | `scripts/` has no dated one-shot files; Debtfile `gate-scripts-without-tests` does not rise. +| P1.10 | sonnet | D313 execution (#944): delete `1-formats/deed/tools/a2ml_to_deed.py`, `deed_lint.py` and `migrate_a2ml_to_deed.sh`; update `tools/README.adoc`. `deed_lint.js` is the sole validator. | `git ls-files '*.py'` is empty; `deed-conformance` green. +|=== + +=== Phase 2: root declutter, no path dependencies (week 1-2) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P2.1 | sonnet | Pointer directories: run an estate code search (enumerate-then-filter) for inbound links to the eight `POINTER.adoc` directories and to `rhodium-standard-repositories/actions-allowlist/`. Record the results in `9-archive/MOVED.adoc` (old path, new path, date, ruling). Then `git rm` the eight directories; reconcile `actions-allowlist/allowed-actions.json` into `config/settings/actions-allowlist.json` (the richer file), repoint `hypatia-rules/README.adoc`, and remove the residual directory. Update the map entries. | Gate D green; link-rot-guard green; `MOVED.adoc` lists every removed path; the hypatia HYP-S008 rule text names the surviving allowlist path. +| P2.2 | sonnet | `tasks/`: delete the stub `Justfile` and `Mustfile` (duplicates of the root; the map's `5-machine/tasks` target is departed from because the content is empty, D113). Keep `tooling-integrity-lint.sh` by moving it to `scripts/`. | `just --list` unchanged; map updated. +| P2.3 | sonnet | Root onboarding files: move `QUICKSTART-{DEV,USER,MAINTAINER}.adoc` and `llm-warmup-{dev,user}.adoc` to `docs/onboarding/` (the provisioning standard's placement rule), rewrite them for the deed era (no Deno, no A2ML templates, no evicted sub-projects, real `just` recipes), add `llm-warmup-maintainer.adoc`. Update `Justfile llm-context`, README routing, map entries. | link-rot-guard green; no occurrence of `Deno`, `A2ML-REPO-TEMPLATE` or `1-formats/templates` in `docs/onboarding/`. +| P2.4 | sonnet | Frozen snapshots to the archive: `TOPOLOGY.adoc` → `9-archive/TOPOLOGY-2026-10-09.adoc`; `docs/reorg/STREAM-PROMPTS.adoc` and `docs/STANDARDS-CRITICAL-PATH.adoc` → `9-archive/plans/` (superseded by this pack; record the supersession at the top of each); `REGISTRY.adoc` stays at the root for six months as the ruled redirect, then moves. Update README routing and the map. | Gate D and link-rot-guard green; README no longer calls TOPOLOGY the architecture map. +| P2.5 | sonnet | Front-door rewrite: `README.adoc` (file count, routing table to districts only, remove the `*-protocol/` and A2ML satellite tables into a one-line pointer to the archive), `EXPLAINME.adoc` (deed-era decisions, no A2ML template route), `ROADMAP.adoc` (current state as of this plan; phases below as the roadmap; parked items from `docs/FUTURE-WORK.adoc` folded in), `AGENTS.adoc` (add the measurement doctrine #668 asks for). | README under 250 lines; every routing link resolves; `0-AI-MANIFEST.a2ml` routing table matches README's (until the deed replaces it). +| P2.6 | haiku | Mechanical file moves with no consumers: `CICD-WORKFLOW-CATALOG.md` → `.github/workflows/README.adoc` (converted to AsciiDoc; the Debtfile `docs-md-not-adoc` ceiling must not rise); `repo-catalog-template.toml` → `templates/`; `docs/quick-reference.adoc` deleted (a generic cargo cheat-sheet is not a standard; owner may veto on the sheet). | Gate D green; `git ls-files '*.md'` at the root is `SECURITY.md`, `READINESS.md`, `CODE_OF_CONDUCT.md`, `CONTRIBUTING.md` only. +|=== + +=== Phase 3: district moves (week 2-3) + +Each packet is one PR, `git mv` first, path repairs second, map and +`canon.lock` third, all in the same PR. A dry run (`git mv -n` plus a +grep of every consumer path) is pasted into the PR body. + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P3.1 | sonnet | `4-readiness/`: move the four `*-readiness-grades/` directories under it with their names unchanged (the map's targets). Add `4-readiness/README.adoc`. Repoint README, `0-AI-MANIFEST.a2ml`, `READINESS.md`, `Justfile crg-badge`, the hypatia CRG rules' paths. | Gate D, link-rot-guard, `just crg-badge` all green. +| P3.2 | sonnet | `9-archive/a2ml/`: move `1-formats/a2ml/`, `1-formats/templates/`, `1-formats/A2ML-REPO-TEMPLATE.adoc`, `1-formats/SATELLITES.a2ml`, `standards-update/`, `.machine_readable/archive/scorecards-v1/`, `.machine_readable/migrations/`, `.machine_readable/uuid-v7-estate-standard.a2ml`, `docs/UUID-V7-ESTATE-STANDARD.adoc`, `hooks/playbook-to-recipe/`, `tools/scm-to-a2ml-bot-directives/`, `docs/archive/`. Delete the 70 nested boilerplate files (not under `outreach/`) and the three nested `.github/` trees in the same PR, listing each in `MOVED.adoc`. The deed mapping specs keep working because they cite source surfaces by family name; repair any path they cite. | Gate D and link-rot-guard green; `1-formats/` holds only deed, k9, contractiles, sub-specs; zero nested `.github/` outside the root and the archive. +| P3.3 | sonnet | `6-telemetry/`: move `docs/ESTATE-BOARD.adoc`, `.machine_readable/estate-board.{json,tsv}`, `.machine_readable/estate-residue-ledger.tsv`, `audits/`, `docs/audits/`, `.machine_readable/audits/`, `docs/reports/`, `docs/affirmations/`, `docs/AUDIT.adoc`, `docs/tech-debt-2026-05-26.adoc`, `docs/proof-debt.adoc`, `docs/tier3-gate-probe.adoc`, `docs/UX-standards/evidence/`, `.verisimdb/`, and `docs/proofs/` (as `6-telemetry/proof-specs/`, pending the owner's choice between this and proven-tests-and-benches). Repoint `scripts/spine/board.sh` and the affirmation workflow. | Gate D green; `scripts/spine/verify-board.sh` passes against the new path. +| P3.4 | sonnet | `5-machine/`: move `scripts/`, `tests/` (merged with `scripts/tests/`), `config/`, `tools/`, `templates/`, `_shared/` (to `www/_shared/`), `licenses/` (to `9-archive/licence-translations/` unless the owner routes the Palimpsest texts elsewhere; flagged on the sheet). Repoint every `bash scripts/` in `.github/workflows/`, the Justfile, `.githooks/`, the Mustfile and Debtfile probes (path repair only), `config/README.adoc`, and the sibling-facing paths that reusable workflows check out at `job.workflow_sha` (grep the seven siblings for raw fetches of `config/` and `scripts/` at `main` first; none may remain). | Full local gate set green; `self-test.yml` and `self-ci.yml` green on the PR; `lock-selfcheck.sh` SELF-CONSISTENT; the seven siblings' raw-URL fetches re-pointed in their own PRs where found. +|=== + +=== Phase 4: docs disaggregation (week 3) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P4.1 | sonnet | Policies to `3-practice/`: `JS-RUNTIME-POLICY`, `NO-JAVASCRIPT-SOURCE-POLICY`, `SIGNING-POLICY` (D218 named its current path; post the pointer on #1234), `DEPENDABOT-POLICY`, `TRUSTED-BASE-REDUCTION-POLICY`, `REPO-SETTINGS`, `CICD-SIGNAL-DISCIPLINE`, `EXEMPTION-MECHANISMS`, `GITLEAKS-ESTATE-BASELINE`, `HYPATIA-BASELINE-FORMAT`, `MIRROR-HOST-VERIFICATION`, `ISSUE-INTAKE-SPEC`, `README-EXPLAINME-STANDARD`, `AFFIRMATION-STANDARD` + `AFFIRMATION.adoc`, `BATCH-FIX-OUTCOME-CATEGORISATION`, `MULTI-REPOSITORY-SCOPE-STANDARD` + `repo-scope.example.toml`, `BADGE-CRITERIA-SPEC`, `secure-coding-training.adoc`, `compliance/`, `migrations/`. Merge the three accessibility files into `3-practice/accessibility/` (translate `STANDARD.a2ml` to `STANDARD.adoc`; delete the `.a2ml`). | Gate D and link-rot-guard green; `docs/` holds only `decisions/`, `wikis/`, `onboarding/`, `handover/`, `design/` and `reorg/`. +| P4.2 | sonnet | Specs to `1-formats/`: `CONTRACTILE-SPEC`, `DESCRIPTILE-SPEC`, `DEBTFILE-SPEC` → `1-formats/contractiles/` (their D140 destination is `hyperpolymath/contractiles`; co-locate until the split); `SEAMS-SPEC` → `1-formats/sub-specs/seams/`; `PANLL-PANELS` → merge with `1-formats/sub-specs/panll-panels/`; `ADR-001` → `docs/decisions/`; `INNERVATION.adoc` stays in `docs/design/` until ruled (owner sheet); `superpowers/specs/*` → `docs/design/`. | As above. +| P4.3 | sonnet | Launcher standard: merge `docs/UX-standards/` (prose, templates) with `launcher/` (praxis deed, reference scripts) into one home. Because launch-scaffolder resolves `standards/launcher/launcher-standard_praxis.deed`, the merge lands at `launcher/` now and moves to `3-practice/launcher/` in P8.4 together with the ladder change. | One launcher standard tree; link-rot-guard green; the deed's `(resolution …)` ladder unchanged in this PR. +| P4.4 | sonnet | `docs/wikis/` (D295, #401): fill the three track indexes from the canonical sources, add the glossary (deed, chora, descriptile, contractile, k9, kyX, kyq; mark A2ML and the old six-file name as retired), delete the `0.2-AI-MANIFEST.a2ml` mirror (A2ML) and replace it with a `wikis_praxis.deed` only if the cartridge family ruling (#732) asks for one. | No `to-do` markers in `docs/wikis/`; no `.a2ml` under `docs/`. +|=== + +=== Phase 5: self-dogfooding (week 3-4) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P5.1 | opus | Author `standards_chora.deed` by hand, field for field under `1-formats/deed/mappings/`, from `CLADE.a2ml`, the six descriptiles, `anchors/ANCHOR.a2ml`, `integrations/*.a2ml`, `rsr-profile.a2ml` and the `bot_directives` records; include the `(canon …)` clause at 2.1.2 with all five hashes, `(contractiles …)`, `(bot-directives …)`, `(maturity :level production)`, `(status :phase active)`. Delete the folded `.a2ml` sources in the same PR (the rsr-template-repo precedent). This is one repository, not a sweep: applied-unless-struck against D313's bulk-conversion mischief, named as such on the sheet. | `bun 1-formats/deed/tools/deed_lint.js standards_chora.deed` passes; `deed-conformance` green; `scripts/deed-field.sh` reads every clause; `.machine_readable/descriptiles/` is gone. +| P5.2 | sonnet | `coordination.k9`: rewrite the invariants for the deed era (drop `pmpl-license-only` and the A2ML invariants; add "one deed per repo", "no new `.a2ml`", "archive is frozen"); confirm it parses under grammar v1.2 with the k9-init generator; add the missing validator as a bun script in `2-protocols/k9-coordination/tools/` (#1221). | Generator round-trip clean; validator passes on the root file and fails on a mutated copy. +| P5.3 | sonnet | Hooks: merge `hooks/` into one tree at `.github/hooks/` (the spine's path), porting the Java/Kotlin/Swift checks and removing the Ansible exception; retarget `Justfile hooks-install`, `propagate-hooks.yml` (or retire it: it only propagates to itself), the three validator tests; delete `hooks/` and `.githooks/`. | `bash .github/hooks/install.sh` sets `core.hooksPath`; every validator test passes; the farm's two upstream fixes are included (wiring drift 38). +| P5.4 | sonnet | Provisioning set: adopt `launcher.sh`, `build/just/provision*.sh`, `mise.toml`, `mise.lock`, `manifest.scm`, `channels.scm`, `docs/SETUP.adoc`, `docs/AI_INSTALLATION_GUIDE.adoc` from the 3-practice templates; retire `setup.sh` to the archive; map the new root files. | `templates/build/just/provision-check.sh` passes on standards; Gate D green. +| P5.5 | sonnet | `.machine_readable/` residue: delete `autolinks.a2ml` (duplicate of `config/autolinks/*.json`), prune `k9-contract-debt.txt` entries for deleted files, rename the `bot_directives` directory to its canonical name if any file remains after P5.1, fold `svc/k9/` examples into `1-formats/k9/examples/` or delete as duplicates of k9-ecosystem (check first), fix `licensing-policy.toml` only by flagging (owner). | Gate D green; `check-canonical-names.sh` green; the ledgers name only existing files. +| P5.6 | sonnet | CRG honesty: redo `0-canon/CRG-SELF-ASSESSMENT.adoc` against the tree as it is (no evicted test suites), keep the grade the evidence supports, update `READINESS.md` in the same change. | Every evidence row cites a path that exists. +|=== + +=== Phase 6: CI consolidation (week 4) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P6.1 | sonnet | Retire to `.github-retired/` (D256): `check-suite-monitor`, `echidna-verify`, `changelog.yml`, `instant-sync`, `pages.yml` (if P1.6 kept another), `makefile-blocker`, `dependabot-lock-regen` (until O11 exists), `uuid-v7.yml`, `elixir-ci.yml`, `propagate-hooks` (after P5.3). Remove their `actions.lock` keys. | `lock-selfcheck.sh` SELF-CONSISTENT; no retired file referenced by `gates.json`. +| P6.2 | sonnet | Collapse the four lock gates into `actions-lock-gate` running one combined script (upstream the three-clause, gawk-guarded `check-lock-sync.sh` from the spine first; wiring drift 9); keep governance's consumer job. | One PR-time lock check; the combined script's tests pass; `uses ⊆ actions.lock` still produced as a check name. +| P6.3 | sonnet | Fold `scorecard-enforcer` into `scorecard-reusable`; delete the zero-consumer `github-backup-mirror-reusable` and `allowlist-preflight-reusable` (verbatim copy inside governance) after an estate code search for consumers; declare secrets in every reusable (#1141); drop `ci-pipeline`'s embedded secret scan and its six-week-old internal pins; delete the Deno text in governance. | Estate code search shows zero consumers of each deleted reusable; every reusable has a `secrets:` block for what it reads. +| P6.4 | opus | Make `gates.json`, the live rulesets and the workflow headers agree (#890, #1032, #1033): one check of the rules actually in force, the derived required-check set applied, the admin bypass on the Lock-Floor and Secret-Scan-Floor changed from `always` to `pull_request` (owner action; the packet prepares the PUT body and blast-radius list, D300). | `check-required-contexts.sh` reports zero unsatisfiable contexts on standards; the ruleset is enabled. +| P6.5 | haiku | Fix the stale `# v4`/`# v3` pin comments in 7 workflow files; fix the actions-lock gate remedy text (#930); fix the error text inversion (#992). | `actionlint` clean in CI; the tests named in the records pass. +|=== + +=== Phase 7: the backlog (weeks 2-6, in parallel) + +* *BOT-DO (69)*: grouped into themed PRs by a Sonnet-class model + working from the appendix records, not the issue bodies (several + bodies now prescribe the wrong fix: #888, #908, #803). Groups: lock + tooling (#907, #908, #930, #964, #972, #981, #992, #1014, #1015, + #1018, #1122), gates and probes (#894, #895, #904, #953, #955, #957, + #958, #1080, #1227, #1228), policy text (#923, #929, #937, #938, #945, + #1059, #1066, #1068, #1089, #1101, #1125, #1223), Nickel and k9 + (#926, #932, #933, #999, #1001, #1220, #1221), templates and + scaffolds (#409, #410, #463, #493, #495, #704, #976), and the rest as + the records say. Each PR lists the issues it closes and closes them + on merge. +* *ESTATE-CAMPAIGN (48)*: each gets a campaign umbrella (Intake Rule 3) + before any sweep; one PR per repository; Opus supervises, Sonnet + executes per repo; Haiku only for scripted re-pins whose result a + script verifies (#669, #707, #727, #288). Template-first: fix + `rsr-template-repo` before any leaf (#702, #706, #917, #924, #646). +* *OWNER-RULING (24)* and *KEEP-OPEN-BLOCKED (16)*: rows on the sheet + (<>) and a single status comment each; nothing else + until answered. + +=== Phase 8: wiring the siblings (weeks 4-8, one repo per packet) + +[cols="1,1,5,2",options="header"] +|=== +| Packet | Tier | Work | Acceptance + +| P8.1 | opus | Release the canon: fill `canon.lock` `commit`, tag `canon-v2.1.2` (or bump to 2.2.0 after Phase 3 moves), list every reusable in `[canon.workflows]` with the release SHA. Then rsr-template-repo adopts (its `(canon …)` clause and lockstep job read `canon.lock` at the pinned commit, not `main`). | Gate A `--strict` green with `--spine`; the spine's dogfood gate green. +| P8.2 | opus | hypatia: read `canon.lock` for criteria (drop the 2.0.0-draft fixture); read the licence register and carve-outs from standards' machine form (owner approval: licence logic); retire HYP-S006/S009 evaluators; load `hypatia-rules/` from the path the standards deed declares (then P3 moves `hypatia-rules/` to `5-machine/`); add a `hypatia_chora.deed` with a canon pin; replace the A2ML reading order in its CLAUDE.md with the deed pointer (D164). | hypatia `rsr_score` runs against canon 2.1.2; hypatia's licence tables match `LICENCE-POLICY.adoc` by test. +| P8.3 | sonnet | gitbot-fleet: deed with canon pin; remove the PMPL line from its manifest (flag, owner edits); CLAUDE.md pointer not copy; `check-lock-sync.sh` fork deleted in favour of the standards copy; the licence refusal gates kept. | Lockstep green; no policy copy in the repo. +| P8.4 | sonnet | rsr-template-repo: arrival-pack stops writing "Deny AGPL" (says "licence per LICENCE-POLICY classification"); TypeScript wording aligned to the ruling; `coordination.k9` in the `K9!`/1.2.0 shape; byte-identical ruleset copies verified by hash; `@main` action refs pinned; the lock keyed by standards SHA. Then regenerate the 37 downstream CLAUDE.md copies from it (D210). Move `launcher/` and `hypatia-rules/` in standards in lockstep with launch-scaffolder's ladder and hypatia's loader. | Template dogfood gate green; D164 holds for every generated CLAUDE.md. +| P8.5 | sonnet | cicd-squabbler: regenerate its agent files from the template (removing "use Deno", "TypeScript → ReScript", "Deny Guix"); delete its own rulesets and call the standards appliers; delete `coordination.k9` Nickel copy in favour of the generated `K9!` form. | No policy copy; lockstep green. +| P8.6 | sonnet | .git-private-farm: port the 8 Python label tools to bash or Julia; drop the `_rsr_*` hookset and `instant-sync` (spec DROP); upstream its two hook fixes to standards; keep `maintenance.sh`, `actuate.sh`, `ci-deadlock-audit.sh`; record R-F1 and R-F3 in standards `docs/decisions`. Mirror system: owner's choice from the sheet. | Zero `.py` tracked; the farm consumes standards hooks via governance. +| P8.7 | sonnet | cicd-suite: drop `rollout_estate.sh`, `secrets-check`, `spdx-license-check`; one `affirmation-check` (owner picks the copy); SPDX headers on its 26 actions (flag: the owner adds licence headers); add a deed, Justfile and SECURITY.md; fix its README. | The suite calls governance, hypatia-scan and scorecard; one affirmation-check in the estate. +| P8.8 | sonnet | proven-tests-and-benches: single-SHA standards pin via `actions.lock` (it mixes four), relock the Dependabot-bumped `smtp-notify-action`, deed with canon pin, drop the `.md` duplicates of `READINESS` and `SECURITY`. | Lockstep green; one standards SHA in its lock. +| P8.9 | sonnet | Widen `check-workflow-staleness.sh` to every reusable; retire the farm's `sha-bump-propagate`; `propagate-workflow-pins.sh` is the one propagator. | Staleness gate reports every standards pin in every sibling. +|=== + +[[owner-sheet]] +== Owner decision sheet (candidate rows D335 onward) + +Each row is one question, options named in the third person (D296 +convention), the (E) arm first. These are filed on #1234 as one +comment, not as new issues. + +[cols="1,4,3",options="header"] +|=== +| Row | Question | (E) and alternatives + +| D335 | `NOTICE` states PMPL-1.0-or-later while `LICENSE` is MPL-2.0. Does Jonathan rewrite `NOTICE` to the MPL-2.0 code / CC-BY-SA-4.0 docs statement? | (E) Yes: Jonathan edits `NOTICE` (agents flag only). +| D336 | `PALIMPSEST.adoc`, `.machine_readable/licensing-policy.toml` and `.claude/CLAUDE.md` disagree with `LICENCE-POLICY.adoc` on the PMPL register (3 vs 5) and on 007 (ARR vs Rule 4 AGPL vs D134 MPL-2.0). Which single statement wins, and does Jonathan apply it to all four files? | (E) `LICENCE-POLICY.adoc` wins; `PALIMPSEST.adoc` becomes a one-paragraph pointer to the palimpsest-license repo (#497); 007's class is Jonathan's call. +| D337 | insolvency-tycoon: PMPL register (LICENCE-POLICY Rule 2) or AGPL game (D271)? | (E) D271 stands; Jonathan removes it from the register. +| D338 | AI-manifest family 7: confirm Option A, `(manifest …)` clauses on the repo deed, so `0-AI-MANIFEST.a2ml` can leave the baseline and the Mustfile check (#1229)? And is the agent seen-set closed (CLAUDE/CHATGPT/GEMINI/VIBE) or open-with-review? | (E) Option A; open-with-review. +| D339 | Contractile layout: two files per verb (spec) or four (what standards and the spine actually ship)? This is ruling 2 of the critical-path plan and gates every layout migration and the fate of the four `*.contractile` files. | (E) Four, and amend the spec; the s-expression `.contractile` files fold into the deed's `(contractiles …)` attestation. +| D340 | Does Claude author `standards_chora.deed` by hand (one repo, the spine precedent, P5.1) ahead of kyX, with the folded `.a2ml` sources deleted? | (E) Yes: applied-unless-struck; the bulk-conversion mischief D313 guards against is not engaged by one hand-authored canon deed. +| D341 | Is standards a "real website" under D24 (keep one Pages workflow) or docs-only (delete Pages; docs are in `docs/wikis/`)? | (E) Docs-only: retire Pages; `www/.well-known/` is served from the repo without Pages. +| D342 | GitHub wiki and Discussions are enabled on standards. D295 says no wiki. Does Jonathan disable the wiki, and keep Discussions with the #411 templates? | (E) Yes to both. +| D343 | One mirror system: standards `mirror-reusable` (7 forges) or the farm's `farm-manifest.json` (10 forges, last updated 2026-02-28)? | (E) The reusable; the manifest shrinks to the forge registry it reads through `vars`. +| D344 | One `affirmation-check`: the standards action (unused) or the cicd-suite copy (consumed, adds signer verification)? | (E) Move the cicd-suite copy into standards and delete the other. +| D345 | `docs/proofs/` per-repo proof requirement specs (283 files): `6-telemetry/proof-specs/` in standards, or `proven-tests-and-benches`? | (E) proven-tests-and-benches, the proof corpus repo; standards keeps the policy. +| D346 | `licenses/` (MPL-2.0 and Palimpsest texts in EN and NL) collides with `LICENSES/` on case-insensitive filesystems. Archive under `9-archive/licence-translations/`, or send the Palimpsest texts to palimpsest-license? | (E) Archive here; Palimpsest texts to their repo in a separate owner-reviewed PR. +| D347 | `INNERVATION.adoc` (2026-04 architecture): ratify as a design record, supersede by the deed/k9/kyX chain (D129), or park? | (E) Supersede: a short note in `docs/design/` pointing at D129 and ADR-008; the text archived. +| D348 | Carve-outs by subtree split strip commit signatures (#1101). Squash-import with one signed commit, or a ruled exception? | (E) Squash-import. +| D349 | hypatia carve-outs `/adapter/`, `/panels/` and `zotpress/**`: keep, and document in standards (generated from `@blocked_patterns`)? | (E) Keep; the tables are generated, not hand-mirrored. +| D350 | Delete `docs/quick-reference.adoc` (a generic Rust command cheat-sheet)? | (E) Delete; it is not a standard. +| D351 | `.hypatia/activity.jsonl` and `last-visit.json` are committed scanner state. Ignore them, or keep them as telemetry? | (E) Ignore (`.gitignore`), like `.cache/`. +| D352 | The admin bypass on the Lock-Floor and Secret-Scan-Floor rulesets is `always`. Change to `pull_request` or remove, so a red required check cannot be merged through? | (E) `pull_request`; D300 blast-radius list attached. +| D353 | The TypeScript exemptions table (`.d.ts`, bindings, VS Code host, build configs) against the 2026-08-27 "should not exist at all" ruling: retire each with a migration path, or restate the rule as "no new TypeScript, these listed exemptions excepted"? (#663, #921) | (E) Restate with the list; `LANGUAGE-POLICY.adoc` §1 and §1.2 rewritten to match CLAUDE.md. +| D354 | The two 2026-10-04 "Decision D???" documents (actions-lock enforcement deferral, Deno residue false positives) were pushed directly with no register row. Does Jonathan accept them and assign ids, or strike them? | (E) Accept; ids D354a and D354b recorded on #1234. +|=== + +Owner actions that are not questions, carried from #1234 and the +triage: provision the applier App credential (O11); force-cancel the +stuck Pages run; provision or disable the five mirror destinations +(D261); the `admin:org` writes for D16 and D298; the SonarCloud binding +(D276); a security-scoped token for code-scanning dismissals (#1224); +rename the GitLab and Bitbucket mirrors of kyq (D333). + +[[appendices]] +== Appendices (this directory) + +* link:issue-triage-089-497.adoc[Issue records #89 to #497] (41) +* link:issue-triage-633-910.adoc[Issue records #633 to #910] (59) +* link:issue-triage-911-1037.adoc[Issue records #911 to #1037] (73) +* link:issue-triage-1049-1234.adoc[Issue records #1049 to #1234] (47) +* link:workflow-audit.adoc[Workflow audit: all 59 workflows, failures, overlaps, hygiene] +* link:wiring-audit.adoc[Wiring audit: consumption matrix, canon pins, policy copies, 40 drifts, ideal wiring] +* link:rulings-ledger-snapshot.adoc[Rulings ledger snapshot D1 to D334] (derived from #787 and #1234, which remain authoritative) + +The appendices are evidence snapshots as of 2026-10-14. They are +`historical` in the constitution's authority classes: they record what +was found and recommended, and gain no authority from being committed. +The dispositions become binding only through the issue comments and +PRs that execute them. diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc new file mode 100644 index 000000000..e085cb863 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc @@ -0,0 +1,461 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Issue triage A: #89 to #497 (41 issues) +:toc: left +:toclevels: 2 + + +Local tree: `/home/user/standards` @ `7d2041a2` (= main). Siblings inspected: rsr-template-repo, hypatia (`4be38c8`), gitbot-fleet, .git-private-farm, cicd-squabbler, cicd-suite, proven-tests-and-benches. +Rulings sources read: #787 body + all comments (D1–D331, downloaded to `scratchpad/r/787-all.md`), #709 (+ comments), #637, #1234 (D332+). + +=== Rulings that change many dispositions below (verified in #787 text) +* *D110* (2026-09-30): close stale-premise issues unilaterally (premise depends on A2ML / superseded snapshot / resolved elsewhere), pointer comment + `state_reason`, cite D110. +* *D113*: apply-unless-struck for rows with one clearly correct arm. +* *D14* (owner, re-affirmed 2026-09-30): *BoJ alive, keep `boj-build.yml`, repair red runs.* +* *D9(E)* (09-23): "guarded template at ~252; fix the generator" — labelled "#331 AGENTIC.md fleet" (label mismatch: standards#331 is boj-build.yml; D222 shows an echo-types #331 about AGENTIC/STATE — numbering collision; see #331). +* *D11*: boj-server is the single badge pilot (#446). *D22*: Claude scaffolds manifesto, owner writes voice (#403). *D23*: #408 settings shape approved, aligned to *D19a* (squash-only + linear history). *D24*: Pages kept only for real websites; docs-only Pages workflows deleted, docs go to BerryWiki (*D295*: BerryWiki lives in-repo at `docs/wikis/`, no GitHub wiki) → #1234 A3. *D25*: `standards` is canon for `.editorconfig`/`.gitattributes`/`.gitignore` (#343). *D28*: provision SonarCloud (#443). *D30*: #438 recovery session authorised. *D31(E)*: delete dead `.gitmodules` claims where a vendored survivor exists (#493). *D32*: rewrite DYADT against reference spec, *D34*: no unattended repo minting (#462). *D48*: stub debt declared per repo + status-banner READMEs (#664). *D134*: 007 audits relicensed in place to CC-BY-SA-4.0 (#497). *D135*: standards docs → BerryWiki (#401). *D163*: seed DISCUSSION_TEMPLATE estate-wide; toggle moot (#411). *D265/D270*: PMPL→MPL/CC-BY-SA rollout, one PR per repo over the PMPL-bearing set (queue in llm-coding-configs) (#404). *D271*: insolvency-tycoon is a GAME → AGPL (conflicts with the PMPL register, see #404/#497). *D313*: `a2ml_to_deed.py` is deleted (NOT executed — still in tree). +* Environment fact: `.git-private-farm/CLAUDE.md` — "GitHub runners are currently blocked by account billing". Every CI-proof acceptance check below is currently unrunnable on GitHub. + +''' + +==== #89 — Epic: -iser regeneration-cartridge pattern — wire all 28 -isers into boj-server (unified gated adapter) +. Labels: major, requirements-target, meta:umbrella, scope:estate, architecture, priority:p3, status:blocked · updated 2026-09-30 (label pass), last comment 2026-08-27 · 5 comments · sub-issues 90/91/92/93 (0/4 closed). +. LITERAL: Roll the unified gated adapter + SSE + `*-regen.yml` into the iseriser scaffold and wire all 28 -isers into boj-server; production-wire the HCG gateway; make Idris2 the FFI source of truth; stop committing `generated/*`. +. GOLDEN: No absurdity, but two facts: the count is *26* -iser generators (08-27 re-measure; `hyperpolymath/k9iser` 404s), and D14 confirms BoJ is alive, so the epic is still meaningful. `Trustfile.a2ml` references must be read as the trust contractile/k9 successor (A2ML retired). +. MISCHIEF: hand-committed `generated/*` rotting and failing gates because no -iser had a central regen trigger. Partly still exists: scaffold now emits regen + gated dispatch (iseriser#12, #101 `b898428d`), but 0 of 26 -isers carry `*-regen.yml` (08-27) and nothing is proven end-to-end (no BoJ reachable from CI). +. STATE: partly done (pilot boj-server#73 merged; scaffold side done; fan-out + gateway not done). +. DISPOSITION: *KEEP-OPEN-BLOCKED* (on #91 gateway / a CI-reachable BoJ endpoint). Recommend body edit 28→26. +. RISK: none direct; cross-repo. + +==== #90 — Roll unified-gated-adapter + SSE + regen-trigger into the iseriser scaffold +. Labels: major, requirements-target, scope:estate, architecture, priority:p2, status:ready · last comment 2026-09-03 · 4 comments. +. LITERAL: Make the iseriser scaffold emit the unified transaction-gated adapter, an SSE surface and a `*-regen.yml` trigger, then add them to all -isers. +. GOLDEN: Literal SSE requirement now contradicts the estate's no-fake-green doctrine: boj-server's router sends `200` before dispatch (`router.ex:100`), so an SSE-backed gate is green by construction (09-03 comment). Sensible reading: gated dispatch via `/cartridge/:name/invoke`; SSE only once a status-bearing SSE contract exists. +. MISCHIEF: -isers lacked a regen/dispatch path. Partly remains: scaffold emits regen + gated dispatch (iseriser#101 merged `b898428d`); fan-out to the 26 existing -isers not done. +. STATE: 2 of 3 items landed; SSE deliberately absent; fan-out not started. +. DISPOSITION: *OWNER-RULING* — "Drop SSE from #90's scope (gated dispatch uses `/cartridge/:name/invoke`; SSE returns 200 before work and cannot back a gate), and close #90 once `-regen.yml` is re-emitted across the 26 -isers — yes/no?" +. RISK: none. + +==== #91 — http-capability-gateway tier-2 production-wiring (ADR-0004) +. Labels: major, requirements-target, priority:p1, scope:estate, architecture, status:ready · last comment 2026-08-27 · 5 comments · sub-issues 96–100: 4/5 closed (only #100 open). +. LITERAL: Production-wire HCG tier-2 (mTLS primary, E2E, benchmarks) and flip boj-server `Trustfile.a2ml` tier_2_gateway `PENDING`. +. GOLDEN: "flip `Trustfile.a2ml` line 900" would write a new fact into a retired A2ML file. Sensible reading: record the deployed status in the trust contractile's k9/deed successor, not the .a2ml. +. MISCHIEF: no governed public surface for BoJ; consumer K9 gates red. Still exists (status PENDING per 08-27 comment; phases A–C closed, D closed 2026-06-01, E open). +. STATE: partly done — A/B/C/D closed (#96–#99); artefacts present but never verified green (08-27); D-4 baseline flip is a maintainer judgement on real CI numbers, and CI is billing-blocked. +. DISPOSITION: *KEEP-OPEN-BLOCKED* (owner: perf `rebaseline` run + `bench/baseline.json _status` flip, staging soak; GitHub runners billing-blocked). Absorb #100 (see below). Consider transferring to boj-server/http-capability-gateway — it is not canon work. +. RISK: none (outward-facing deploy is owner-gated). + +==== #92 — Idris2 as source-of-truth: generate/verify Zig FFI from the ABI +. Labels: major, requirements-target, scope:estate, architecture, priority:p3 · last comment 2026-08-27 · 8 comments. +. LITERAL: Make the Idris2 ABI the source of truth for cartridge Zig FFIs (generate or prove), replacing hand-mirrored dual encoding. +. GOLDEN: No contradiction. Note cartridges moved to `hyperpolymath/boj-server-cartridges` (2026-09-08, per #156), so any boj-server paths in the thread are stale. +. MISCHIEF: Idris2↔Zig drift caught only by tests. Partly fixed: Phase 1/1b/2 (iseriser#13/#14/#15, boj-server#98 `abi-drift.yml`, allowlist 16→56→62 of 80) give a structural CI diff gate. Codegen (Phase 3) and type proof (Phase 4) unstarted; boj-server core `ffi/zig/src` still hand-written (08-27). +. STATE: partly done (verification); generation not started. +. DISPOSITION: *OWNER-RULING* — "Is the `abi-verify` drift gate (Phases 1/2) sufficient, so #92 closes and Zig codegen (Phase 3) + Idris2 FFI proof (Phase 4) are dropped — yes/no?" (Per doctrine 15, the elegant long-term arm is Phase 3 generation from the single Idris2 source; label it so.) +. RISK: none. + +==== #93 — Stop committing generated/* — gitignore + regenerate-on-trigger +. Labels: major, requirements-target, scope:estate, tech-debt, priority:p3, status:blocked · last comment 2026-09-19 · 4 comments. +. LITERAL: Gitignore `generated/*` and produce it on trigger once regen triggers + gateway exist. +. GOLDEN: Not absurd. Note the 2026-09-19 comment measured the wrong population (the 27 -iser *generator* repos) and concluded "largely already true"; the defect lives in *consumer* repos. +. MISCHIEF: generated artefacts hand-committed and rotting. *Still exists*: 08-27 measured `generated/` tracked in ~15 consumer repos (conflow 8, echidna 7, panll 6, januskey 6, laniakea 4, kea 4, boj-server 3, …); only reposystem does gitignore+provenance correctly. Local siblings carry none (verified `git ls-files generated` = 0 in all 7). +. STATE: not started (blocked). +. DISPOSITION: *KEEP-OPEN-BLOCKED* (on #91 / a working regen path; gitignoring before regen breaks consumers' K9 gates). Body should drop dead provenance (`k9iser` 404, `idaptik` → `metadatastician/IDApTIK`). +. RISK: destructive if executed early (removes tracked files consumers read). + +==== #100 — Phase E — Production wiring + staging validation + rollout/rollback runbook +. Labels: major, requirements-target, scope:estate, architecture, priority:p3, status:blocked · last comment 2026-08-27 · 8 comments. +. LITERAL: Wire tier-2 into BoJ, flip Trustfile PENDING, validate in staging, write rollout/rollback runbook. +. GOLDEN: Same Trustfile.a2ml caveat as #91 (record in the successor format). +. MISCHIEF: same as #91. Partly done: runbook drafted (boj-server#128), bind hardening boj-server#130/#131/#132, NetworkPolicy follow-up boj-server#135; status flip and staging not done. +. STATE: partly done. +. DISPOSITION: *MERGE-INTO(#91)* — it is #91's only open child; one tracker suffices. +. RISK: outward-facing deployment (owner-gated). + +==== #124 — Epic: estate proof-debt remediation (2026-05-18 reconciled audit) +. Labels: major, requirements-target, meta:umbrella, proofs, scope:estate, meta:recurring, priority:p3, status:ready · last comment 2026-08-27 · 3 comments · sub-issues 12/12 closed (#125–#136). +. LITERAL: Discharge verified proof debt across ~10 repos in P0→P2 order; add a standards CI lint for seam-less Rust / zero-contract SPARK_Mode. +. GOLDEN: The cited master artefact (`~/dev/repos/PROOF-DEBT-…adoc`) never existed at that path, and the workstation was wiped 2026-10-13. The table overstated debt ~6×. +. MISCHIEF: "formally verified" headers over bodyless/postulated theorems. Mostly fixed: 08-27 measured 9 real `believe_me` in 2 repos (boj-server `src/abi/Boj/SafetyLemmas.idr` 4, absolute-zero 5). The CI lint landed (`.github/workflows/spark-theatre-gate.yml` present; #135 closed). +. STATE: done at epic level (all children closed); 9-escape residue. +. DISPOSITION: *CLOSE-DONE* — file the 9-escape residue as one issue each in boj-server and absolute-zero. +. RISK: ⚠ licence — child #133 canonicalised absolute-zero to `PMPL-1.0-or-later` (absolute-zero#22); absolute-zero is NOT on the PMPL register → flag-only drift, now covered by the D265/D270 rollout. Do not touch here. + +==== #156 — [#92 Class D] abbreviation / acronym-boundary drift across DB + cloud cartridges +. Labels: tech-debt, priority:p2, status:ready, scope:repo · last comment 2026-09-19 · 3 comments. +. LITERAL: Resolve Idris2↔Zig abbreviation drift (`Transaction`/`tx`, `SSHKey`/`ssh_key`, `*Action` suffix) in postgresql-mcp, hetzner-mcp, redis-mcp via one of paths A–D. +. GOLDEN: Paths in body are dead — cartridges moved to `boj-server-cartridges/cartridges/domains/{database,cloud}/…` (09-08). Re-measure there. +. MISCHIEF: abi-verify could not bridge acronym spellings. Partly fixed: iseriser#21 runtogether rule (`iseriser/ROADMAP.adoc:35`); whether the three cartridges are now clean is unmeasured. +. STATE: unknown pending re-measure. +. DISPOSITION: *BOT-DO*. +. Steps: (1) build iseriser main; (2) run `iseriser abi-emit-manifest` + `abi-verify` on the three cartridges at the new paths; (3) if exit 0 or `variant-extra-in-zig` only → close with output; (4) else implement path A (acronym table limited to `Transaction→tx`, `SSH→ssh`) in iseriser + path C rename for redis-mcp `SubscribeAction`/`UnsubscribeAction`. Landing: iseriser, boj-server-cartridges. Acceptance: abi-verify exit 0 on all three. Effort *S*. Tier *sonnet*. Also transfer the issue to iseriser (scope:repo, not canon). +. RISK: none. + +==== #239 — [campaign] TypeScript → AffineScript estate migration (UMBRELLA) +. Labels: documentation, meta:campaign, meta:umbrella, governance, migration, scope:estate, meta:recurring, priority:p3 · last comment 2026-08-27 · 6 comments. +. LITERAL: Port ~285 estate `.ts` files in 38 repos to AffineScript via a 4-layer, 7-step plan. +. GOLDEN: Body talks of Deno-ESM codegen and keeps `bindings/deno` carve-outs; Deno is now banned (2026-08-26/09-22) and the owner ruled 2026-08-27 "no typescript … should not exist at all" (CLAUDE.md, TIGHTENED), while CLAUDE.md leaves the TS exemption table "flagged for an explicit owner decision". Literal "carve-outs stay" now conflicts with policy. +. MISCHIEF: banned TS in estate. Mostly gone: 95 files / 9 repos (08-27), of which 72 are proven's polyglot bindings; 23 genuine files in 8 repos. Standards itself: 0 `.ts`; `scripts/check-ts-allowlist.ts` replaced by `.sh` (governance-reusable.yml:448-461), leaving a dead `scripts/check-ts-allowlist.deno.js` (Deno residue). +. STATE: mostly done; steps #240–#246, #326, #327 closed. +. DISPOSITION: *OWNER-RULING* — "Close #239 now and track only the 23 non-binding files in one narrow issue; and are proven's `bindings/typescript` + `bindings/deno` (consumer bindings) still an approved carve-out under the 'no TypeScript at all' + Deno-ban rulings — yes/no?" +. RISK: touches proven bindings (D-ruling on #705: discard the deletion, i.e. files restored — do not delete again without a ruling). + +==== #252 — [campaign] ReScript → AffineScript estate migration (UMBRELLA) +. Labels: documentation, meta:campaign, meta:umbrella, governance, scope:estate, meta:recurring, priority:p3, status:blocked · last comment 2026-08-27 · 7 comments. +. LITERAL: Port ~3,996 `.res/.resi` files in ~80 repos to AffineScript via a 9-step plan. +. GOLDEN: Body's scale is obsolete (281 files / 15 repos measured 08-27) and part of the "progress" was deletion into 200-byte Harvard Engine stubs (#664; D48). The 2026-06-04 comment proposing estate-wide `sed` batches incl. "package.json to deno.json" is now contradictory twice (Deno banned; no bulk sweeps). +. MISCHIEF: banned ReScript. Still exists at reduced scale: stapeln 117, developer-ecosystem 75 estate-authored (6,428 vendored upstream excluded), burble 34, vordr 15, polyglot-i18n 15, … ; plus stub debt (#664). +. STATE: partly done; steps 1–4 closed; 5–8 open but tiers collapsed. +. DISPOSITION: *ESTATE-CAMPAIGN* (rescope to the measured residue; absorb #272/#276/#278). +. Steps: re-census `.res/.resi` (exclude vendored `rescript-ecosystem/`, upstream `rescript` fork, linguist, deps/node_modules); one PR per repo (or per subsystem for stapeln), `.affine` must compile (`just check`) and be wired as the live entry with the `.res` removed in the same PR (CLAUDE.md "compile-verify, wire-first"); no stub files. Landing: metadatastician/stapeln, developer-ecosystem, metadatastician/burble, metadatastician/vordr, polyglot-i18n, social-media-tools, jtv-lang, boj-server, + singles. Acceptance: census = 0 non-vendored `.res` and 0 new sub-400-byte stubs. Effort *L*. Tier *sonnet* (opus review on stapeln). +. RISK: bulk if done by sed (forbidden); third-party vendored ReScript compiler in developer-ecosystem must not be touched. + +==== #272 — [campaign #252] STEP 5 — TAIL BATCH: smallest tail-end repos (≤20 files × ~50 repos) +. Labels: meta:campaign, migration, scope:estate, priority:p3, status:blocked · last comment 2026-08-27 · 1 comment. +. LITERAL: ~50 per-repo PRs porting ≤20-file ReScript repos. +. GOLDEN: Tier is 12 repos / 49 files; tiering no longer meaningful. +. MISCHIEF: same as #252; still exists at small scale. +. STATE: not started as a tier. +. DISPOSITION: *MERGE-INTO(#252)*. +. RISK: none. + +==== #276 — [campaign #252] STEP 6 — MID-TIER: 20-100 file repos (~15 repos) +. Labels: meta:campaign, migration, scope:estate, priority:p3, status:blocked · last comment 2026-08-27 · 2 comments. +. LITERAL: Port ~15 mid-tier repos per subsystem. +. GOLDEN: Band contains one repo (metadatastician/burble, 34). +. MISCHIEF: as #252. +. STATE: tier effectively empty. +. DISPOSITION: *MERGE-INTO(#252)*. +. RISK: none. + +==== #278 — [campaign #252] STEP 7 — LARGE REPOS: 100-500 file repos (~6 repos) +. Labels: meta:campaign, migration, scope:estate, priority:p3, status:blocked · last comment 2026-08-27 · 2 comments. +. LITERAL: Port ~6 large repos incl. developer-ecosystem (460) and iseriser. +. GOLDEN: One repo in band (stapeln 117); developer-ecosystem is 75 estate-authored; iseriser has 0 `.res`. +. MISCHIEF: as #252. +. STATE: tier effectively empty. +. DISPOSITION: *MERGE-INTO(#252)*. +. RISK: none. + +==== #279 — [campaign #252] STEP 8 — MEGAPORT: idaptik (516, was 1235) + panll (726) batched conversion +. Labels: meta:campaign, migration, scope:estate, priority:p3, status:blocked · last comment 2026-08-27 · 4 comments. +. LITERAL: Port idaptik + panll ReScript to AffineScript. +. GOLDEN: Both counts are 0 — panll by *deletion* into 726 stub `.affine` files; idaptik moved to `metadatastician/IDApTIK` with 0 `.res`/0 `.affine`. Closing on zero counts would launder the deletion. +. MISCHIEF: ReScript in two largest repos → replaced by stub debt (still exists). +. STATE: superseded — the real remaining work is the stub debt. +. DISPOSITION: *MERGE-INTO(#664)* (D48: declare stub debt per repo + status-banner READMEs). +. RISK: none. + +==== #281 — [campaign #239] Estate seam audit: stale .claude/CLAUDE.md language tables + carve-out candidate pattern +. Labels: meta:campaign, scope:estate, tech-debt, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Fix stale ReScript-as-primary CLAUDE.md tables (phronesis, panll, dotfiles); consider a `docs/campaigns//*.ts` carve-out; note the TS allowlist checker is itself TS. +. GOLDEN: Carve-out idea is moot (panic-attack's `triage.ts` gone; "no TypeScript at all" ruling forbids new TS carve-outs). The "self-referential" checker is resolved (now `scripts/check-ts-allowlist.sh`). +. MISCHIEF: agents reading local CLAUDE.md write banned ReScript. Still exists in *panll only* (lines 7-8/26-27 `npx rescript build`, line 48 "TEA in ReScript", line 81 ReScript Conventions; 08-27). phronesis + dotfiles fixed. Residual Deno artefact `standards/scripts/check-ts-allowlist.deno.js` (dead since `.sh` replaced it). +. STATE: 2/3 done. +. DISPOSITION: *OWNER-RULING* — "panll/.claude/CLAUDE.md was declared hands-off after the owner reverted panll#60 (2026-05-30). May Claude open one PR removing its ReScript build/convention text (repo has 0 `.res`), plus delete the dead `scripts/check-ts-allowlist.deno.js` in standards — yes/no?" +. RISK: owner previously reverted an edit to this exact file. + +==== #288 — [campaign] Estate CodeQL weekly→monthly sweep (cut 3, standards#233 Option B — ~206 repos) +. Labels: meta:campaign, cicd, scope:estate, priority:p2, status:blocked · last comment 2026-08-27 · 6 comments. +. LITERAL: Change `'0 6 * * 1'` → `'0 6 1 * *'` in ~206 repos' codeql.yml. +. GOLDEN: Scope miscounted: 642 weekly files / 168 repos, but only *146 root-level* files run (GitHub executes root workflows only); 496 nested copies cost nothing. In standards: root `codeql.yml` is monthly (line 17); 15 nested weekly copies sit in `9-archive/` etc. and are inert — do not edit the archive. +. MISCHIEF: Actions-minute burn. Still exists (146 root weekly + 63 non-canonical root files, 08-27). More pressing now: runners billing-blocked. All 6 local siblings with CodeQL are already monthly. +. STATE: partly done (canonical #286 merged; sweep interrupted twice). +. DISPOSITION: *ESTATE-CAMPAIGN* (absorb #323, #324). +. Steps: enumerate root `.github/workflows/*codeql*.yml` across hyperpolymath + metadatastician (REST, paginated, positive control); rewrite any `schedule.cron` → `'0 6 1 * *'`; one PR per repo, squash per D19a, *no admin-merge*; skip forks, archived repos, 9-archive/vendored subdirs; add a cheap drift check to `governance-reusable.yml` that fails on a non-monthly CodeQL cron at root. Acceptance: census shows 0 root non-monthly crons. Effort *M*. Tier *haiku* (sonnet for the gate). +. RISK: bulk sweep (mechanical, ruled Option B); prior sweep used admin merges (tree-navigator#40, neurophone#116) — violates doctrine 5. + +==== #306 — ci(estate): Pages enablement decision needed across 48 repos (failing 'Setup Pages' on every push) +. Labels: cicd, priority:p1, scope:estate, status:needs-owner · last comment 2026-08-26 · 2 comments. +. LITERAL: Owner decides per repo: enable Pages or remove the Pages workflow. +. GOLDEN: Decision now made: *D24* — keep Pages only for real websites; delete docs-only Pages workflows (docs → BerryWiki in-repo, D295). Executing queue item *#1234 A3*. Note standards itself carries `casket-pages.yml`, `pages.yml`, `pages-archive.yml`. +. MISCHIEF: red Pages runs. Still exists: 40 repos (08-26), some fail earlier at `Build casket-ssg`; 13 Jekyll workflows survive estate-wide (Jekyll banned). +. STATE: ruled, not executed. +. DISPOSITION: *ESTATE-CAMPAIGN* (one tracker with #1234 A3). +. Steps: classify the 40 (+ standards) as real-site vs docs-only (evidence: CNAME, site content, `casket-ssg` build); delete docs-only Pages workflows and all Jekyll workflows by PR; post real-site list for Jonathan to enable Pages (API/UI-only). Acceptance: per-repo table posted; 0 Jekyll workflows; 0 Pages workflows on Pages-disabled repos. Effort *M*. Tier *sonnet*. +. RISK: destructive (workflow deletion) — PR-only, reversible. + +==== #309 — [campaign] Python residual cleanup — ~45 estate-authored .py files remain (banned) +. Labels: migration, scope:estate, meta:recurring, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Phase 1 add Python carve-outs (Sublime/Nautilus/Ansible/examples) to CLAUDE.md; Phase 2 rewrite ~10–15 files. +. GOLDEN: Phase 1 contradicts the live policy "Fully banned, no exceptions" (`.claude/CLAUDE.md:185`, `3-practice/LANGUAGE-POLICY.adoc:205`). Sensible reading: no new carve-outs; rewrite or delete. +. MISCHIEF: banned Python. *Still exists, including in canon*: `standards` tracks `1-formats/deed/tools/a2ml_to_deed.py` and `deed_lint.py` although *D313 says `a2ml_to_deed.py` is deleted* and CLAUDE.md:74 forbids using them; `.git-private-farm` tracks 8 `.py` (`scripts/label-*.py`, `labelutil.py`, `gen-*.py`, `tests/test-classifier-parity.py`). Estate: 43 files / 23 repos (08-27). +. STATE: not started. +. DISPOSITION: *ESTATE-CAMPAIGN*. +. Steps: (1) standards: delete `a2ml_to_deed.py` (D313) and replace `deed_lint.py` with the existing Bun `deed_lint.js` path; (2) .git-private-farm: port the label tooling to Bash/Julia; (3) fresh census, one PR per repo; (4) host-required Python (Sublime/Nautilus/Ansible) → owner question (delete vs exempt), not a CLAUDE.md edit. Acceptance: census = 0 estate-authored `.py` outside vendored paths. Effort *M*. Tier *sonnet*. +. RISK: third-party (servers/, vendored) excluded; proven-servers `bindings/python` consumer carve-out stays. + +==== #323 — [standing] Estate CodeQL cron drift detection + 6-week budget review +. Labels: meta:campaign, cicd, scope:estate, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Monthly manual drift audit + 6-week Actions budget review; never closes. +. GOLDEN: The manual cadence never ran (0 monthly audits posted); a hand-run tracker is the wrong mechanism. +. MISCHIEF: CodeQL cron drift. Exists (see #288). +. STATE: not done. +. DISPOSITION: *MERGE-INTO(#288)* (drift → a governance gate in #288; budget delta becomes #288 acceptance). +. RISK: none. + +==== #324 — [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos) +. Labels: meta:campaign, cicd, scope:estate, priority:p2, status:ready · last comment 2026-08-27 · 3 comments. +. LITERAL: Convert non-canonical CodeQL crons to monthly. +. GOLDEN: Pilot "daily first" is moot (no daily crons remain); biggest cluster `0 0 * * 0` (41) unlisted. +. MISCHIEF: same as #288; exists (63 root files). +. STATE: not started. +. DISPOSITION: *MERGE-INTO(#288)* (one sweep: any root CodeQL cron → monthly). +. RISK: bulk (mechanical). + +==== #331 — [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + http://) +. Labels: meta:campaign, priority:p1, scope:estate, refactor, status:needs-ruling · last comment 2026-09-08 · 4 comments. +. LITERAL: Repair or retire `boj-build.yml` across ~30 repos (malformed JSON, `.local` host, `http://`, masked by `continue-on-error`). +. GOLDEN: Scope is ~252–255, not ~30. Decision exists: *D14 (owner): BoJ alive, keep `boj-build.yml`, repair red runs*; D9(E) "guarded template at ~252". The 09-08 recommendation to delete all 252 is overruled. ⚠ D9's text says "#331 AGENTIC.md fleet" — a label mismatch (D222 shows an echo-types #331 about AGENTIC/STATE files); confirm D9 really refers to standards#331 before citing it. +. MISCHIEF: silent-broken dispatch. *Still exists*: e.g. `gitbot-fleet/.github/workflows/boj-build.yml:20-21` — `http://boj-server.local:7700/...`, malformed `-d` JSON, `${{ github.* }}` interpolated into `run:`, `continue-on-error: true`. Generator fixed (iseriser#101 `b898428d`). Standards' own copy (`.github/workflows/boj-build.yml:62-65`) still posts to the plural route `/cartridges/ssg-mcp/invoke` (fixed generator uses singular `/cartridge/:name/invoke`) and masks failure with `|| echo "... (non-fatal)"`, with no https check. +. STATE: generator done; 0 deployed copies repaired (except standards partly, .git-private-farm deleted via #43). +. DISPOSITION: *ESTATE-CAMPAIGN*. +. Steps: take the iseriser#101 emitted template as canonical (env-sourced `BOJ_SERVER_URL`, `jq -nc --arg` payload, https-only scheme check, loud skip when unset, `curl --fail-with-body`, singular route); first align standards' own copy; then replace the file wholesale (not patch) in each hyperpolymath/metadatastician repo carrying it, one PR per repo, squash. Acceptance: census of `boj-build.yml` shows 0 `.local`, 0 `http://`, 0 `continue-on-error`, valid JSON payload builder. Effort *L*. Tier *haiku* (scripted replace + diff check), sonnet spot review. +. RISK: bulk sweep (ruled by D14); skip forks/third-party; the-nash-equilibrium guard caveat (D26). + +==== #343 — audit: dotfile drift across estate (2026-06-02 sample) — .editorconfig / .gitignore / .gitattributes +. Labels: priority:p1, scope:estate, tech-debt, status:needs-owner · last comment 2026-09-03 · 5 comments. +. LITERAL: Anoint a canonical for the three dotfiles and sweep the estate. +. GOLDEN: Two rulings disagree on *where* canon lives: 2026-08-28 comment ruled "land the canon in rsr-template-repo" (done: rsr-template-repo#67 `859c3465`), *D25 (2026-09-15) rules `standards` is canon*. Yet standards still has the old files: `.editorconfig` 19 sections vs rsr 36; `.gitattributes` 56 vs 108 lines; all three blob hashes differ (std `1e8edcb2`/`0609be34`/`23c1789b` vs rsr `808e2414`/`c85fa951`/`638db641`). Sensible reading: copy the canon into standards first, then sweep from standards. +. MISCHIEF: unbounded dotfile drift. Still exists (worsening ~1 variant/file/month). +. STATE: phase 1 done in the template; standards not aligned; phase 2 not started. +. DISPOSITION: *ESTATE-CAMPAIGN* (status:needs-owner label is stale — D25 ruled). +. Steps: (1) PR to standards copying rsr-template-repo's `.editorconfig`/`.gitattributes` (keep standards' SPDX line; `git add --renormalize` dry-run); (2) phase-2 per-repo PRs that *merge*, never overwrite: preserve each repo's SPDX-License-Identifier and SPDX-FileCopyrightText lines (AGPL son/game repos, PMPL register repos untouched), dry-run `eol=lf` renormalisation blast radius first, unlisted divergence → report not delete; leave `.gitignore` per-language. Acceptance: hash census shows canon + documented per-language additions. Effort *L*. Tier *sonnet*. +. RISK: ⚠ touches SPDX-bearing files (must preserve, never edit licence); bulk sweep (ruled D25); renormalisation churn. + +==== #346 — governance: hoist bridge-forbidden-phrases check into reusable workflow +. Labels: cicd, scope:estate, meta:recurring, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Lift valence-shell's bridge-forbidden-phrases check into `governance-reusable.yml`, discovering bridges from `.machine_readable/*_BRIDGE.a2ml`. +. GOLDEN: Discovery keyed on `*_BRIDGE.a2ml` (retired format) is absurd now; would need a deed/k9 bridge declaration. Only 2 repos declare a bridge (valence-shell, echo-types; ochrance has none), and echo-types has been treated as owner hands-off. +. MISCHIEF: overclaiming bridge prose. Contained: pilot live in valence-shell (#125 merged); `git grep bridge-forbidden` in standards = 0. +. STATE: not started. +. DISPOSITION: *OWNER-RULING* — "With n=2 bridge repos and the manifest format retired, close #346 without a reusable hoist (valence-shell keeps its pilot) — yes/no?" +. RISK: none. + +==== #348 — automation: hypatia ruleset + gitbots should be able to fan-out doc + descriptiles + contractile refreshes themselves +. Labels: enhancement, governance, scope:estate, automation, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Add hypatia rules R-DOC-STALE, R-CONTRACTILE-DRIFT, R-6A2-MINIMAL and a gitbot "docbot" that opens STATE.a2ml/EXPLAINME refresh PRs. +. GOLDEN: A bot refreshing `descriptiles/STATE.a2ml` would add facts to retired A2ML (forbidden). Sensible reading: rules target `_chora.deed` `(status)`/`(maturity)` clauses + `docs/status/ROADMAP.adoc`; R-6A2-MINIMAL → "deed version vs Cargo/CHANGELOG/tag"; contractile drift checks k9 contracts. +. MISCHIEF: mechanical doc-currency work done by hand. Still exists: hypatia `lib/rules/` has 38 files, none of the three (grep verified). +. STATE: not started; sequenced behind #633 (nothing merges bot PRs). +. DISPOSITION: *ESTATE-CAMPAIGN* (lands in hypatia + gitbot-fleet). +. Steps: three rule modules + fixtures in `hypatia/lib/rules/` modelled on the newest rule module; report-only (`:review`) first; docbot recipe in gitbot-fleet opening owner-confirmable PRs that edit deed clauses only. Acceptance: rules fire on planted fixtures, silent on clean ones; zero `.a2ml` writes. Effort *M*. Tier *sonnet*. +. RISK: must never write `.a2ml`. + +==== #401 — Docs: complete the audience-split education layer (docs/wikis/) +. Labels: documentation, priority:p1, meta:recurring, scope:repo · last comment 2026-09-30 (D135) · 3 comments. +. LITERAL: Fill to-do markers in `docs/wikis/{users,developers,maintainers}`, decide hosting, add glossary (A2ML, K9, RSR, CRG, contractile, innervation, descriptiles), worked examples, keep `docs/wikis/0.2-AI-MANIFEST.a2ml` in step. +. GOLDEN: Keeping the `.a2ml` mirror "in step" = writing A2ML (forbidden); glossary must define deed/chora/descriptiles and mark A2ML/descriptiles as retired. Hosting answered: D135 + *D295 (BerryWiki in-repo at `docs/wikis/`, no GitHub wiki)* — the scaffold is already in the right place. +. MISCHIEF: no education layer. Still exists: to-do counts users 6, developers 7, maintainers 4, README 2 (verified); no glossary file. +. STATE: scaffold only. +. DISPOSITION: *BOT-DO*. +. Steps: write prose for the three track indexes + `docs/wikis/glossary.adoc` (current vocabulary; retired terms marked), one worked example per track; delete content from (do not extend) `0.2-AI-MANIFEST.a2ml` or leave it frozen; follow BerryWiki notebook layout (as in metadatastician/marid `docs/wikis/`). Acceptance: 0 to-do markers; `scripts/check-standards-map.sh` green. Effort *M*. Tier *sonnet*. +. RISK: none. + +==== #403 — Build the Estate Manifesto & Atlas (front-door, owner-gated) +. Labels: documentation, priority:p1, scope:estate, status:needs-owner · last comment 2026-08-26 · 1 comment. +. LITERAL: Owner writes doctrine; create manifesto repo with owner-gated protection; a2ml projection of an Atlas; wire repos to it. +. GOLDEN: "a2ml projection" is impossible (A2ML retired). The Atlas (component registry, IS/IS-NOT, migration ledger) duplicates what `gv-clade-index` + per-repo `_chora.deed` `(identity)/(ecosystem)` clauses now are. +. MISCHIEF: no front door. Mostly fixed: manifesto repo exists (2026-03-24), first-person doctrine in README, ruleset active (08-26). D22: Claude scaffolds, owner writes voice. Atlas: absent; cited draft does not exist in dev-notes. +. STATE: Part I done; Part II not started. +. DISPOSITION: *OWNER-RULING* — "Is Part II (the Atlas) superseded by gv-clade-index + the chora deeds, so manifesto links to gv-clade-index and #403 closes — yes/no?" +. RISK: none. + +==== #404 — Estate licence cascade (PMPL -> MPL/CC-BY-SA axis) — per HANDOFF +. Labels: documentation, scope:estate, priority:p2, status:blocked · last comment 2026-09-21 · 3 comments. +. LITERAL: Merge palimpsest-license#110, merge a2ml-estate-normalizer PR #1, regenerate ~11k PMPL headers from fixed generators, propagate an axis-aware hook, narrow Rule 2. +. GOLDEN: "a2ml-estate-normalizer" (A2ML tool; standalone repo never existed) is dead; Rule 2 is already a 5-repo register; palimpsest-license#110 merged. The rollout itself has since been *ruled by the owner: D265 + D270* (one PR per repo over the PMPL-bearing set, all 29 queued repos in one pass, queue `llm-coding-configs/.../rollout-queue.tsv`; exclude palimpsest-license + 3 gcrypt vaults) and *D271* (insolvency-tycoon is a game → AGPL). +. MISCHIEF: PMPL drift outside the register (1,933 headers / 35 repos; polystack 1,477). Being handled under D265/D270; generators fixed (iseriser#106). +. STATE: superseded by D265/D270 execution. +. DISPOSITION: *CLOSE-SUPERSEDED(#787 D265/D270)* (D110 pointer). Flag to owner: D271 contradicts `3-practice/LICENCE-POLICY.adoc:52` (insolvency-tycoon still on the PMPL register); polystack is listed as archived in CLAUDE.md, so its 1,477 headers may be unPR-able. +. RISK: ⚠ licence/SPDX — owner-only; no agent action here beyond the pointer. + +==== #408 — policy: estate settings standard — merge opts, protection, required-checks = 🔴 Gate set (WS4) +. Labels: governance, priority:p1, scope:estate, status:needs-owner · last comment 2026-08-26 · 1 comment. +. LITERAL: Define canonical repo settings + required checks = Gate tier; realign `governance / *` contexts stale on ~190 repos. +. GOLDEN: "~190 rename mapping" premise is false (job name never changed; 27/36 non-emitters are `startup_failure`; one real defect: affinescript's lowercase `baseline`). Shape is now *approved: D23 aligned to D19a* (squash-only, linear history; D89 disables rebase-merge on signature repos). +. MISCHIEF: deadlocking stale required contexts / toothless protection. Partly exists: 233 toothless repos, 1 case defect (08-26). Estate is ruleset-driven (classic protection on 1/420). +. STATE: ruled, not written down or applied. +. DISPOSITION: *ESTATE-CAMPAIGN* (status:needs-owner stale). +. Steps: write `3-practice/ESTATE-SETTINGS.adoc` (merge buttons per D19a/D89, ruleset shape, required contexts = Gate tier from #409); fix affinescript's required context case; apply via rulesets with `?dry-run` + blast-radius list per D298 practice. Acceptance: ruleset census matches the doc. Effort *M*. Tier *opus* (ruleset writes, cross-repo). +. RISK: outward-facing settings writes (owner-approved by D23; still dry-run first). + +==== #409 — promote CI-CRITICALITY tiers (Gate/Check/Advisory/Auto) → standards + rsr-template +. Labels: cicd, scope:estate, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Promote `ci/CI-CRITICALITY.toml` tier scheme into standards + rsr-template-repo; wire Gate set to required checks. +. GOLDEN: Not contradictory; check whether the tier map belongs as a deed clause (deed.abnf) before adding a new TOML file. +. MISCHIEF: no source of truth for which checks block merges. Exists: absent from standards (`git ls-files` 0) and rsr-template-repo (`ci/` has only README for gitlab/pre-commit). +. STATE: pilot proven (trope-checker, trope-particularity-workbench); promotion not started. +. DISPOSITION: *BOT-DO*. +. Steps: write the tier spec in `3-practice/` (or a deed clause if the grammar admits one); add `ci/CI-CRITICALITY.toml` to rsr-template-repo; feed the Gate set into #408. Acceptance: spec + template file merged; `check-standards-map.sh` green. Effort *S*. Tier *sonnet*. +. RISK: none. + +==== #410 — standard: MCP settings template = boj-server cartridge config (WS6) +. Labels: governance, scope:estate, chore, scaffolding, priority:p2, status:ready · last comment 2026-08-27 · 1 comment. +. LITERAL: Define a per-repo MCP settings artefact = boj-server cartridge config, reusing the cartridge-proposal flow. +. GOLDEN: Cartridges moved to `boj-server-cartridges`; BoJ alive (D14). JSON must be I-JSON/JCS (D306). +. MISCHIEF: no MCP settings standard. Exists (only 3 repos carry MCP settings files; nothing in standards/rsr-template-repo). +. STATE: not started. +. DISPOSITION: *BOT-DO*. +. Steps: schema derived from `boj-server/schemas/cartridge-v1.json`; spec page in standards; template file in rsr-template-repo; JCS-serialised. Acceptance: schema validates the 3 existing files; template merged. Effort *M*. Tier *sonnet*. +. RISK: none. + +==== #411 — standard: discussion + wiki templates + discussions-toggle policy (WS5/WS8) +. Labels: documentation, governance, priority:p1, scope:estate · last comment 2026-09-30 (D163) · 2 comments. +. LITERAL: Canonical DISCUSSION_TEMPLATE + wiki templates; decide the discussions toggle. +. GOLDEN: Toggle moot (D163; ~415/420 on). Wiki-template half is moot by *D295* (no GitHub wiki; BerryWiki in-repo). +. MISCHIEF: no discussion templates. Exists: 9/381 repos have one; *standards itself has none* (`git ls-files` + history: never had one). +. STATE: ruled (D163), not executed. +. DISPOSITION: *ESTATE-CAMPAIGN*. +. Steps: author `ideas` + `q-and-a` forms once in rsr-template-repo (tool-demanded `.yml` name, KYAML-compatible content); seed per repo by PR; drop wiki seeding. Acceptance: census of `.github/DISCUSSION_TEMPLATE/` across discussion-enabled repos. Effort *M*. Tier *haiku*. +. RISK: bulk (additive only). + +==== #438 — Estate recovery: audit + revert unauthorized mass migrations (README .adoc→.md sweep; protected rescript/v-ecosystem repos) +. Labels: documentation, priority:p1, scope:estate, status:needs-owner · no comments (created 2026-06-27). +. LITERAL: Inventory unauthorized sweeps (README `.adoc`→`.md` on 100+ repos; migrations in do-not-migrate rescript/v-ecosystem repos; residue), owner-approved restore, reinstate guards. +. GOLDEN: Body's premise "policy is README must be `.md` … keep `README.md`" is *reversed*: README is `.adoc` by default, `.md` only for `hyperpolymath/hyperpolymath` and `boj-server` (CLAUDE.md). Sensible reading: restore `README.adoc` everywhere except those two, recovering lost content. D30 authorises the session; Claude derives the protected list from measured state and posts it for confirmation first. Also "rescript is now banned estate-wide" changes what "protected" means for rescript-ecosystem. +. MISCHIEF: content loss + guardrail overrun. Likely still exists (unmeasured); e.g. `.git-private-farm` root has `README.md` not `.adoc`. +. STATE: not started. +. DISPOSITION: *ESTATE-CAMPAIGN* (status:needs-owner stale; D30). +. Steps: inventory-only pass (commit search: Glama, adoc→md, RS→AS, V→Zig PRs); per-repo report; derive + post protected list; owner confirm; restore via `git checkout -- paths`/revert PRs; add guards. Acceptance: report posted, confirmed list, restore PRs merged. Effort *L*. Tier *opus*. +. RISK: destructive/history-heavy; touches protected repos; possible third-party vendored code. + +==== #443 — Estate campaign: roll SonarCloud across all repos (parked, resume later) +. Labels: cicd, scope:estate, status:needs-owner, priority:p3 · no comments. +. LITERAL: Resume `python3 sonar_rollout.py` once the owner provides a global SonarCloud token. +. GOLDEN: The rollout generator is *Python (banned)* — the literal resume command is forbidden; it must be rewritten (Bash/Julia/Rust). Adding a workflow to ~387 repos also adds runner minutes while runners are billing-blocked. D28 ruled: provision (global token, auto-provision, resume date, admin on 3 shared repos, canonise `sonar.exclusions=fixtures/*,deferred/*`). +. MISCHIEF: no static analysis outside boj-server. Exists. +. STATE: 2 pilots; parked. +. DISPOSITION: *KEEP-OPEN-BLOCKED* (owner: SonarCloud App install + global token per D28; plus runner billing). Pre-work a bot can do now: rewrite the generator without Python. +. RISK: secrets (token per repo); Joshua's 3 repos need his admin; 22 private repos need a paid plan. + +==== #446 — Proposal: an honest, adoptable readiness/insight badge framework +. Labels: scope:estate, design, status:needs-owner, priority:p3 · last comment 2026-09-04 · 3 comments. +. LITERAL: Write criteria/axes spec, then a self-assessment badge for one pilot repo, then generalise. +. GOLDEN: Fine. Step 1 landed (`docs/BADGE-CRITERIA-SPEC.adoc`, PR #734 merged 2026-09-04); #733 closed. Pilot ruled *D11 = boj-server*. The spec's Q1–Q3 are unanswered. +. MISCHIEF: third-party rubrics misgrading. Glama badge removed (boj-server#324). +. STATE: step 1 done; step 2 not started. +. DISPOSITION: *OWNER-RULING* — "Apply #734's draft positions as rulings (Q1 per-axis badges; Q2 `estate-audit` may issue `verified` when checks ran in CI; Q3 render only when floor ≥ D) so step 2 starts on boj-server — yes/no?" +. RISK: none. + +==== #460 — [umbrella] Estate audit & optimization — make the enforcement real (Waves 0–6) +. Labels: meta:umbrella, governance, scope:estate, meta:recurring, priority:p3 · last comment 2026-08-27 · 3 comments. +. LITERAL: Program tracker; finish remaining charters (DYADT verifier, language guides, promote advisory scanners, Mustfile PR gate, descriptiles→descriptiles, RSR v2 machine half, estate scorecards, release hygiene). +. GOLDEN: Wave 3 (scorecards/dashboard) and the "estate scorecard rollout" charter are *retired* (REGISTRY.adoc, 2026-10-09; scorecards frozen in `.machine_readable/archive/scorecards-v1/`). The Mustfile PR gate survived the retirement: `k9-contractile.yml` runs `scripts/run-mustfile.sh` on `pull_request` (lines 24, 66); critical/high Mustfile failures fail the build, warnings are non-blocking (lines 61-65) — so that charter is done. +. MISCHIEF: enforcement theatre. Partly remains: `affinescript-verify.yml` still `continue-on-error: true` (lines 97/108/119); no git tags in standards; licence flags tracked flag-only. +. STATE: mostly done or moot; residue tracked in #462, #463. +. DISPOSITION: *CLOSE-DONE* — first file two narrow issues: "promote affinescript-verify (advisory by design, continue-on-error) to blocking once the port backlog clears" and "first tagged release of standards" (0 tags). +. RISK: none. + +==== #462 — Implement the DYADT production verifier (hyperpolymath/did-you-actually-do-that) +. Labels: meta:campaign, priority:p1, scope:estate, status:needs-owner, automation · last comment 2026-08-26 · 1 comment. +. LITERAL: Build the network-capable verifier in a dedicated repo, passing the conformance suite. +. GOLDEN: Target repo 404s; *D32: rewrite against the reference spec; D34: no unattended repo minting* → owner must mint. The spec moved to `1-formats/sub-specs/did-you-actually-do-that/`, and its 10 conformance vectors are *`.a2ml` files* (`spec/conformance/*.a2ml`) — a retired format the new verifier would have to parse. Vectors need a kyX/deed or JSON successor first. +. MISCHIEF: no post-action claim verification with consequences. Exists (reference verifier only; patallm-gallery copy diverges). +. STATE: not started (decision made). +. DISPOSITION: *KEEP-OPEN-BLOCKED* (on Jonathan minting the repo per D34, and on a non-A2ML vector format). +. RISK: none. + +==== #463 — Complete the per-language testing guides (Zig, BEAM, proofs) + Julia refresh + AffineScript SSOT +. Labels: documentation, meta:campaign, scope:estate, testing, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Write Zig, Elixir+Gleam, Idris2/Agda guides; refresh Julia; move AffineScript guide SSOT to affinescript repo. +. GOLDEN: File names in body are `.md`; tree is `.adoc` under `toolchain-readiness-grades/testing/`. +. MISCHIEF: missing guides. Exists: present = LANGUAGE-TESTING-STANDARDS, affinescript, julia (v1.0.0), TEMPLATE; missing Zig/BEAM/Idris2-Agda (verified; table lines 220-241 say "charter"). +. STATE: 2 of 5 + template. +. DISPOSITION: *BOT-DO*. +. Steps: three guides from `language-testing-guide-TEMPLATE.adoc`, honest "Known gaps"; update the required-set table; run `just language-guides-check` (Justfile:113) / `scripts/check-language-guide.sh`. Julia R1–R9 refresh optional; AffineScript SSOT move is a separate affinescript-repo PR. Effort *M*. Tier *sonnet*. +. RISK: none. + +==== #479 — [campaign] standards carve-out: evict products/impls, keep the canon +. Labels: scope:estate, tech-debt, priority:p2, status:ready · last comment 2026-08-27 · 2 comments · sub-issues 9 (6 closed: #490 #491 #492 #494 #496 #498; open #493 #495 #497). +. LITERAL: Evict a2ml/, k9-svc/, protocol impls, satellites, lol/, data; each via registry `kind=external` + HYP-S006, regenerating REGISTRY.a2ml per PR. +. GOLDEN: The mechanism it prescribes (REGISTRY.a2ml, HYP-S006, HYP-S009, registry-verify) is *retired 2026-10-09*; `standards-map.toml` + GATE D is the live map. rhodium-standard-repositories was archived in place as LAST COPY ("do not delete"). `standards-map.toml:492-502` keeps `2-protocols/axel/` in canon ("consolidate, do NOT split") although it still carries CNAME, Containerfile, DNS zone, `ads.txt`, `deno.lock`, compiled `*.res.js` — that is a ruling, not drift. +. MISCHIEF: products inside the canon. Largely fixed: `a2ml/` 0, `k9-svc/` 1 (POINTER.adoc), `lol/` 0 tracked; residue only in the three open children. +. STATE: mostly done. +. DISPOSITION: *CLOSE-DONE* (D110; children stand alone). +. RISK: none. + +==== #493 — [carve-out 4/9] rhodium-standard-repositories/ cleanup: de-vendor satellites/, merge templates, delete the lying .gitmodules +. Labels: priority:p1, scope:estate, tech-debt, status:needs-owner · last comment 2026-08-26 · 1 comment. +. LITERAL: De-vendor satellites into their repos, fold templates into rsr-template-repo, delete `.gitmodules`. +. GOLDEN: De-vendoring/deleting is now absurd: the tree moved to `9-archive/rhodium-standard-repositories/` (1,135 files) as LAST COPY, "ARCHIVE, do not delete" (`standards-map.toml:99-108`; `9-archive/REORGANIZATION-PLAN.adoc` note). Template folding belongs to #634. What survives: *D31(E)* — delete dead `.gitmodules` claims where a vendored survivor exists. `.gitmodules` lists 12 entries; `satellites/` has 10 dirs (rhodium-pipeline, rsr-template-repo absent); META.scm/ECOSYSTEM.scm/state.scm are real project trees (IETF draft), not files. +. MISCHIEF: false structural metadata. Still exists, but inert (nested `.gitmodules` has no git effect; 0 gitlinks). +. STATE: superseded except D31. +. DISPOSITION: *BOT-DO* (execute D31 only, then close). +. Steps: edit `9-archive/rhodium-standard-repositories/.gitmodules` to remove the dead/aliased entries (or replace with a comment header explaining the vendored survivors); no file deletions in the archive; note supersession by the archive move + #634 in the closing comment. Acceptance: no `.gitmodules` URL that 404s. Effort *S*. Tier *haiku*. +. RISK: edits a frozen archive district (metadata only); PMPL/palimpsest vendored copies inside must not be touched. + +==== #495 — [carve-out 6/9] Data out of spec dirs: grade data → archive, PORT-REGISTRY → verisim-data, retire SATELLITES.a2ml +. Labels: scope:estate, tech-debt, priority:p2, status:ready · last comment 2026-08-27 · 2 comments. +. LITERAL: Archive grade data, move PORT-REGISTRY assignments to verisim-data, retire SATELLITES.a2ml. +. GOLDEN: `verisim-data` does not exist (live repo is `verisimdb-data`); `standards-map.toml:186-195` now classifies `0-canon/PORT-REGISTRY.adoc` as canonical *law*, so moving it out contradicts the map. `0-canon/PORT-REGISTRY.adoc:5-8` still claims "being migrated to `hyperpolymath/verisim-data`" (false). `1-formats/SATELLITES.a2ml` is an 8-line deprecation stub still mapped `canonical = true` (`standards-map.toml:454-463`). Audit reports already archived (e061af1). The 5 `SELF-ASSESSMENT.adoc` files are rubric dogfood (CRG one is mapped as law). +. MISCHIEF: data mixed into spec dirs. Mostly fixed. +. STATE: mostly done. +. DISPOSITION: *BOT-DO*. +. Steps: delete `1-formats/SATELLITES.a2ml` and its standards-map entry (deleting A2ML content is allowed); rewrite PORT-REGISTRY's NOTE to state it is law and point to `groove/registry/groove-registry.json` for groove services, dropping the verisim-data claim; leave SELF-ASSESSMENTs. Acceptance: `scripts/check-standards-map.sh` green; no `verisim-data` string in 0-canon. Effort *S*. Tier *haiku*. +. RISK: none (no licence content). + +==== #497 — [carve-out 8/9] ⚠️ OWNER-ONLY licence-flag items: 007 audits in public canon; PALIMPSEST.adoc narrative +. Labels: documentation, priority:p1, scope:estate, tech-debt · last comment 2026-09-30 (D134) · 3 comments. +. LITERAL: Owner decides on the 24 ARR 007 audits in public canon and on moving PALIMPSEST.adoc to palimpsest-license. +. GOLDEN: Item 1 ruled *D134*: relicense in place (docs CC-BY-SA-4.0). Not executed: `toolchain-readiness-grades/references/007/` has *25* files, *none* carrying any SPDX line (grep). Item 2 unruled: root `PALIMPSEST.adoc`, `LICENSES/PMPL-1.0-or-later.txt`, `licenses/{PALIMPSEST,MPL-2.0}-{EN,NL}.txt` (duplicate lowercase dir), and `coordination.k9:79-81` invariant `pmpl-license-only` ("All original code uses PMPL-1.0-or-later") which contradicts its own `license: MPL-2.0` (line 28). Plus D271 vs register conflict (insolvency-tycoon). +. MISCHIEF: licence exposure / Palimpsest talk outside the register. Exists. +. STATE: item 1 ruled not executed; item 2 open. +. DISPOSITION: *OWNER-RULING* — "(a) May Claude open one PR adding `SPDX-License-Identifier: CC-BY-SA-4.0` to the 25 007 audit files per D134? (b) Move PALIMPSEST.adoc's narrative to palimpsest-license leaving a pointer, delete `licenses/PALIMPSEST-*`, and drop the `pmpl-license-only` invariant from coordination.k9 — yes/no each?" +. RISK: ⚠ licence/SPDX — owner-only, manual, per-file; no sweep. + +''' + +=== Summary table + +[cols="1,1,1,1",options="header"] +|=== +| # | Disposition | Effort | Tier +| 89 | KEEP-OPEN-BLOCKED (#91) | – | – +| 90 | OWNER-RULING | – | – +| 91 | KEEP-OPEN-BLOCKED (owner D-4 flip; billing) | – | – +| 92 | OWNER-RULING | – | – +| 93 | KEEP-OPEN-BLOCKED (#91) | – | – +| 100 | MERGE-INTO(#91) | – | – +| 124 | CLOSE-DONE | – | – +| 156 | BOT-DO | S | sonnet +| 239 | OWNER-RULING | – | – +| 252 | ESTATE-CAMPAIGN | L | sonnet +| 272 | MERGE-INTO(#252) | – | – +| 276 | MERGE-INTO(#252) | – | – +| 278 | MERGE-INTO(#252) | – | – +| 279 | MERGE-INTO(#664) | – | – +| 281 | OWNER-RULING | – | – +| 288 | ESTATE-CAMPAIGN | M | haiku +| 306 | ESTATE-CAMPAIGN (= #1234 A3) | M | sonnet +| 309 | ESTATE-CAMPAIGN | M | sonnet +| 323 | MERGE-INTO(#288) | – | – +| 324 | MERGE-INTO(#288) | – | – +| 331 | ESTATE-CAMPAIGN | L | haiku +| 343 | ESTATE-CAMPAIGN | L | sonnet +| 346 | OWNER-RULING | – | – +| 348 | ESTATE-CAMPAIGN | M | sonnet +| 401 | BOT-DO | M | sonnet +| 403 | OWNER-RULING | – | – +| 404 | CLOSE-SUPERSEDED(#787 D265/D270) | – | – +| 408 | ESTATE-CAMPAIGN | M | opus +| 409 | BOT-DO | S | sonnet +| 410 | BOT-DO | M | sonnet +| 411 | ESTATE-CAMPAIGN | M | haiku +| 438 | ESTATE-CAMPAIGN | L | opus +| 443 | KEEP-OPEN-BLOCKED (owner token, D28) | – | – +| 446 | OWNER-RULING | – | – +| 460 | CLOSE-DONE | – | – +| 462 | KEEP-OPEN-BLOCKED (owner mint, D34) | – | – +| 463 | BOT-DO | M | sonnet +| 479 | CLOSE-DONE | – | – +| 493 | BOT-DO | S | haiku +| 495 | BOT-DO | S | haiku +| 497 | OWNER-RULING | – | – +|=== + + +Counts: ESTATE-CAMPAIGN 10 · OWNER-RULING 8 · BOT-DO 7 · MERGE-INTO 7 · KEEP-OPEN-BLOCKED 5 · CLOSE-DONE 3 · CLOSE-SUPERSEDED 1 = 41. diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc new file mode 100644 index 000000000..8ac8da789 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc @@ -0,0 +1,764 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Issue triage D: #1049 to #1234 (47 issues) +:toc: left +:toclevels: 2 + + +Triaged 2026-10-14 against local `main` at 7d2041a2 (`/home/user/standards`), with sibling checkouts and GitHub reads (issue bodies and comments, #787 comments, Actions runs). Nothing was edited or posted. + +Tools used: `git log -S`/`--grep`, `grep`, the repo's own gate scripts, Go `yq` v4.44.3 (downloaded to the scratchpad because the system `yq` is the Python jq wrapper), and the MCP issue, Actions and search reads. The search API was rate-limited partway through, so cross-repo child issues were *sampled*, not censused. + +Abbreviations: *E* = elegance arm. Tier: haiku = mechanical, sonnet = ordinary coding, opus = judgement-heavy or cross-repo. + +''' + +==== #1049 — Estate listing: 35 repositories are below the RSR 7-topic minimum +. labels scope:estate, chore, priority:p3, status:ready | last 2026-09-30 | 0 comments | filed by arena-ai-coding-agent[bot] (hypatia ABS-002) +. *LITERAL:* set ≥7 GitHub topics on each of the 35 listed repos. Close when the count is 0 or the standard changes. +. *GOLDEN:* partly absurd as written. +** The "RSR standard" that requires 7 topics is *not in the canon*. `grep` over 0-canon, 3-practice, docs and rsr-criteria-v2 finds no topic minimum. The rule lives only in `hypatia/.machine_readable/merge-orchestration/pr-automerge-policy.json` (ABS-002, `min`). +** The list includes `.github` meta repos (hyperpolymath/.github, metadatastician/.github), where topics are meaningless. +** It also includes `ArangoDB.jl`, which may be a third-party wrapper. +** The sensible reading is that the owner first decides whether the topic minimum is canon at all. +. *MISCHIEF:* repos are hard to discover. The defect (few topics) presumably still exists; it was not re-measured because that needs the API per repo. The meta-defect, a hypatia rule citing a standard that does not exist, *still exists*. +. *STATE:* not started. No canon source. +. *DISPOSITION:* *OWNER-RULING.* Question: "Is ≥7 repository topics an RSR requirement?" +** *Yes:* add a criterion to `0-canon/rsr/rsr-criteria-v2.a2ml` through the canon procedure (or its deed successor), exclude `.github` repos, then a bot proposes topics per repo. +** *No:* retire ABS-002 in hypatia and close. +. (If yes) ESTATE-CAMPAIGN: sonnet drafts topics from each README, and an owner/admin token applies them. S per repo; L total. +. *RISK:* touches third-party/fork (ArangoDB.jl?). Bulk settings sweep. + +==== #1055 — Orphan refs: agents leave unrelated-history branches no gate can see (8 arena/* refs; #1005 AC2 drift) +. labels bug, scope:estate, priority:p2, status:ready | last 2026-09-30 | 0 +. *LITERAL:* +** AC1: a failing gate that every non-default ref shares a merge base with the default branch (hypatia GS009, hypatia#868). +** AC2: an estate agent-push profile (identity, ref namespace, no orphan init commits). +** AC3: branch hygiene classified by disposition. +** AC4: no prefix-based muting. +** AC5: re-measure the #1005 codeql pin population. +. *GOLDEN:* sensible. AC5 (codeql v4.38.x pin drift) is the same population as #1093 and should move there. +. *MISCHIEF:* unmergeable orphan branches are invisible to every gate. It *still exists*: +** no GS009 or merge-base rule in `/home/user/hypatia/lib`; +** no agent ref-namespace profile in `3-practice/` or `docs/`. +The 4 MetaManifold-WebUI refs were not verified (no API access here). +. *STATE:* not started. +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (a) hypatia: GS009 rule (`git merge-base` per non-default ref; fail; positive control on an orphan fixture). Lands in hypatia. +** (b) standards: a short `3-practice/AGENT-PUSH-PROFILE.adoc` (allowed identities, `agent/` namespace, "first commit must have the default branch as an ancestor"). Lands in standards. +** (c) gitbot-fleet: branch-hygiene classifier by disposition. +** (d) Owner prunes the 4 MetaManifold refs. +** (e) Move AC5 to #1093. +** Effort M. Tier: opus for (b), sonnet for (a) and (c). +. *RISK:* destructive (ref deletion; owner-only). MetaManifold-WebUI may be the son's repo (JoshuaJewell committer per #1091, D286 points at JoshuaJewell/MetaManifold-WebUI), so confirm the owner before pruning. + +==== #1056 — slavia #100 closure: class notes for #994, startup-death mechanics + Dependabot recurrence for #968 (cross-file) +. labels scope:estate, chore, priority:p3, status:ready | last 2026-09-30 | 0 +. *LITERAL:* a cross-filed note, because the bot token could not comment. It asks maintainers to fold the content into #994 and #968. +. *GOLDEN:* as an issue it is not actionable on its own; its content belongs in those threads. +. *MISCHIEF:* +** Comment-permission workaround: the information is stranded in a separate issue. +** Sub-claims re-checked: +*** hypatia `pin_integrity.ex` compile break: the file is rewritten at hypatia HEAD; *likely fixed*. +*** `check-lock-sync.sh` gawk-only 3-arg `match()`: *still present*, lines 65/71/84. +*** Dead `gh.io/actions-lockfile` URL: not checked. +. *STATE:* #994 and #968 are both still OPEN. The note has not been folded in. +. *DISPOSITION:* *MERGE-INTO(#994 + #968).* +** Post the two halves as comments on #994 and #968, then close #1056 as duplicate. +** Carry one live action into #968: make check-lock-sync.sh POSIX-awk-safe, or declare gawk as a hard dependency with a preflight `awk --version` check. +. haiku, S (copy and close). The gawk fallback is sonnet, S. +. *RISK:* none. + +==== #1058 — grammar artifacts: .k9 has no grammar/contract; deed.abnf says both "sole normative" and "pending owner ruling" +. labels priority:p1, design, scope:repo | last 2026-09-30 | 1 (owner ruling D173) +. *LITERAL:* +** Rule whether K9 needs an envelope ABNF and/or a Nickel contract. +** Record the leash closed set. +** Resolve the `must` naming collision. +** Delete the stale "pending owner ruling" line from deed.abnf. +** Add negative controls. +. *GOLDEN:* no conflict. +. *MISCHIEF:* no normative K9 contract, and an ambiguous grammar status. *Fixed.* +** `1-formats/deed/spec/abnf/deed.abnf` no longer contains "pending owner ruling" (grep is empty). +** `1-formats/k9/spec/K9-CONTRACT-SPEC.adoc` v1.0.0 with `contract/k9_contract.ncl`. +** Leash closed enum `'Kennel|'Yard|'Hunt` (spec line 408, §7). +** The `must` collision is resolved by not naming contractile verbs (spec lines 57-61, 1043). +** The validator `tools/k9-validate.sh` has 6 positive and 21 negative fixtures. +** Landed via #1143 (b3075e04), #1149 (aa1c4dd5), #1154 and #1175. +. *STATE:* done. Archive name `deed.abnf_v0.1.0-draft` is retained, which is fine. +. *DISPOSITION:* *CLOSE-DONE.* Cite #1143/#1149/#1175 and D173. +. Follow-ups for a new issue (bot, haiku/sonnet, S): +** (a) `.machine_readable/k9-contract-debt.txt` lists *12 `PROTOCOL.k9` paths that no longer exist* (renamed to `PROTOCOL.yaml` in #1149). `.githooks/validate-k9.sh` only flags stale entries for files it scans, so dead-path ledger entries are invisible. Fix: delete the 12 lines and add a "ledger path must exist" check. The header also says "Count: 13" while there are 12 entries. +** (b) MIGRATION-1058 M5 (rsr-compliance-checklist), M6 (single-source closed lists) and M7 (L2 corpus) remain. +. *RISK:* none. + +==== #1059 — decide the attestation chain canon → .deed → .k9 → Nickel → env → serialisation; "derived, never restated" +. labels priority:p1, scope:estate, architecture | last 2026-09-30 | 1 (ruling D129) +. *LITERAL:* +** Rule the chain and the derivation invariant. +** Rule Guix vs Flox. +** Confirm the KYAML position. +** Write a decision row and an ADR. +. *GOLDEN:* two sub-questions are now moot. +** Guix vs Flox: Nix is retired and Guix is primary (CLAUDE.md, rsr-criteria 1.2.1 "Guix only"), so Flox, which is Nix-based, is out. `grep -i flox` finds nothing. +** KYAML: ruled in everywhere by D280/D307 (`3-practice/YAML-POLICY.adoc` §3.4). +. *MISCHIEF:* no recorded chain, so layers restate identity and drift. The ruling exists (D129 on #787), but *no ADR* exists. `docs/decisions/` has ADR-002…008 and none covers this. +. *STATE:* ruled, not recorded downstream. +. *DISPOSITION:* *BOT-DO.* +. Write `docs/decisions/ADR-009-attestation-chain.adoc` recording: +** D129 verbatim; +** the derivation invariant, with K9 pedigree referencing the deed identity by UUID or hash rather than restating it; +** Guix as the sole environment layer (Nix and Flox retired); +** KYAML per D280/D307. +Link the ADR from `README.adoc`, map it in `standards-map.toml`, then close. Sonnet, S. +. *RISK:* none. + +==== #1065 — apply-branch-gates: a path-filtered pull_request trigger is reported PR-reachable +. labels bug, cicd, scope:estate, priority:p2, status:ready | last 2026-09-30 | 0 +. *LITERAL:* `yaml_has_pr_trigger()` must treat `paths:`/`paths-ignore:` as not PR-reachable, report those workflows in a named bucket, and add tests plus a mutant, for block and flow styles. +. *GOLDEN:* the function is a hand-written *awk YAML parser* (`scripts/apply-branch-gates.sh:201`). YAML-POLICY Y-1 says gates read YAML with `yq`, and the AC demands flow-style support. The sensible fix replaces the awk parser with a `yq` query such as `.on.pull_request | has("paths") or has("paths-ignore")`, which handles KYAML for free. +. *MISCHIEF:* a required context that can never report deadlocks PRs. *Still exists*: no `paths` handling (grep), and the last change was #1064. +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* +. Rewrite the trigger check with `yq`. Add a `path_filtered=[…]` bucket. Extend `scripts/tests/apply-branch-gates-test.sh` with cases for `paths`, `paths-ignore`, bare `pull_request` and push-only, plus a mutant. +** Accept when the test fails on the old function and passes on the new one. +** Sonnet, S. +. *RISK:* none (the script is dry-run unless armed). + +==== #1066 — LANGUAGE-POLICY.adoc says Idris2-only; language-policy.scm sanctions Agda +. labels documentation, governance, priority:p1, proofs, scope:estate | last 2026-09-30 | 1 (ruling D130) +. *LITERAL:* rule which source is authoritative, make both files agree, and add a drift test. +. *GOLDEN:* the `.scm` is now *frozen archive* (`9-archive/rhodium-standard-repositories/spec.scm/language-policy.scm`, `lifecycle=frozen` in standards-map.toml). Editing it, or adding a parity test against it, would violate the archive rule. The sensible reading is to amend the canon to the D130 wording and leave the archive alone. +. *MISCHIEF:* contradictory proof-language policy. *Still exists, and now in three places:* +** `0-canon/rsr/LANGUAGE-POLICY.adoc:319,744-746` still says "Idris2-only". +** `.claude/CLAUDE.md` allows Agda broadly (echo-types). +** D130 says "Idris2 core; Agda/Lean4 as named secondary provers only where already load-bearing (paint-type D83)". +** D287 adds MetaManifold as a named D130 exception. +. *STATE:* ruled, not executed. +. *DISPOSITION:* *BOT-DO.* +. Edit `0-canon/rsr/LANGUAGE-POLICY.adoc` §319 and §744 to the D130 text with a named-exception list: paint-type (D83), MetaManifold (D287), echo-types (confirm with the owner; CLAUDE.md already treats it as canonical). Add a CHANGELOG row. Do not touch 9-archive. +** Sonnet, S. +. *RISK:* none. The canon doc is not in `canon.lock`. + +==== #1068 — yq -i is not idempotent: a second run moves a comment block +. labels priority:p2, scope:repo | last 2026-09-30 | 0 +. *LITERAL:* either find a yq version, flag or wrapper with 0 pass-2 drift, or keep Y-2 NOT IN FORCE with #1068 cited in YAML-POLICY §4. +. *GOLDEN:* since D280/D307 the target dialect is KYAML, and the issue itself records `yq -o kyaml` as 56/56 idempotent. Block-YAML `yq -i` writing is a dying path. The sensible action is the second arm, plus a note that the KYAML path is the supported writer. +. *MISCHIEF:* silent comment drift under `yq -i`. Still true for block YAML; not re-run here. +. *STATE:* `3-practice/YAML-POLICY.adoc` §2 still says Y-2 "NOT IN FORCE", but *#1068 is not cited* (grep). The §3 status line still reads "Scope NOT YET DECIDED", which D280 contradicts (stale header). +. *DISPOSITION:* *BOT-DO.* +. Add a sentence to YAML-POLICY §2.2/§4 citing #1068 as the reason Y-2 (block) stays deferred, and stating that KYAML output (`yq -o kyaml`, `scripts/kyaml-format.sh`) is the sanctioned writer. Fix the §3 status line to "IN FORCE (D280/D307)". Close. +** haiku, S. +. *RISK:* none. + +==== #1069 — cargo-audit producer opens vulnerability trackers but never closes them (9 live trackers) +. labels meta:umbrella, cicd, scope:estate, priority:p2, security | last 2026-09-30 | 0 +. *LITERAL:* +** Add a close-on-green sibling job. +** Keep one canonical copy (template or reusable) that replaces about 11 hand copies. +** Control: green closes, red reopens. +. *GOLDEN:* fine. D112 ("fix the producer first") applies. +. *MISCHIEF:* stale security issues. *Still exists:* +** no `cargo-audit` reusable in `standards/.github/workflows`, and none in the template; +** sampled trackers still OPEN: betlang#107, conflow#72, eclexia#80, filesoup#97, neurophone#155, zerostep#93. +. *STATE:* not started. +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (a) Create `standards/.github/workflows/cargo-audit-reusable.yml` with an `audit` job, a `create-issue` job on failure (dedupe by label) and a `close-issue` job on success (comment with the run URL). Add `actions.lock` records. +** (b) Replace the 11 hand copies with thin callers, one PR per repo, each with lock records. +** (c) Control on one repo. +** Note: `rust-ci-reusable.yml:285` already installs cargo-audit, so consider folding it in there. +** Sonnet, M. +. *RISK:* multi-repo sweep (11 PRs). + +==== #1070 — Umbrella: 14 per-repo triages of pre-existing red checks surfaced by the actions.lock cure +. labels enhancement, meta:umbrella, cicd, priority:p1, scope:estate | last 2026-09-30 | 0 +. *LITERAL:* burn down 14 child issues. A2ML-gate reds go to #1010. +. *GOLDEN:* fine. The A2ML-gate reds are moot per retirement and route to #1010 (still OPEN). +. *MISCHIEF:* reds hidden behind startup death. *Still exists*: sampled children rpa-elysium#138, gitbot-fleet#568, paint-type#83 and cadastra#52 are all OPEN. +. *STATE:* not started (sampled 4/14). +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Run #1010 first (retire the A2ML gate), which clears 3+ children. Then handle each child: read the decisive log line, fix or delete a fictional push-only red, and close. +** Sonnet per child, S each; M total. +. *RISK:* per-repo edits. paint-type is AGPL (son); check ownership per child. + +==== #1071 — Umbrella: machine-readable currency deferred follow-ups (4 repos) +. labels enhancement, meta:umbrella, governance, scope:estate, priority:p2, status:needs-ruling | last 2026-09-30 | 0 +. *LITERAL:* +** Track the estate-common list: contractile k9 tridents for must/trust/bust/dust, per-bot `bot_directives/`, workflow hygiene, wiki refresh. +** Owner decisions needed: RSR-SPEC bump, dual ANCHOR placement (`descriptiles/` vs `anchors/`), and the `bot_directives/` naming collision. +. *GOLDEN:* *largely absurd now.* +** ANCHOR and bot-directives are *deed clauses* (`(anchor)`, `(bot-directives …)` per D312), so "descriptiles/ vs anchors/" placement and the bot_directives directory naming are moot. +** RSR v2 exists (`0-canon/rsr/RSR-SPEC-v2.adoc`, canon releases 2.0.2/2.0.3, #818/#823). +** Contractile `.k9.ncl` files exist for all six verbs in `rsr-template-repo/.machine_readable/contractiles/*/`. +. *MISCHIEF:* per-repo metadata drift. It is now owned by the DEED conversion campaign (#837, open). +. *STATE:* superseded. +. *DISPOSITION:* *CLOSE-SUPERSEDED(#837).* Leave repo-specific items in the 4 children. Hypatia baseline hygiene (`missing_timeout_minutes`/`unpinned_action`) and the wiki refresh (D135, BerryWiki) go to their own trackers. +. — +. *RISK:* none. + +==== #1079 — check-uuid-v7: only the LAST UUID on a line is checked +. labels scope:estate, priority:p2 | last 2026-09-30 | 0 +. *LITERAL:* check every UUID on a line (`grep -o`), add a ` ` test, mutant pairing. +. *GOLDEN:* the gate no longer runs `check-uuid-v7.sh`. ADR-008/D320 moved the gates to `check-uuid-v8.sh --strict` (`governance-reusable.yml:110`, `uuid-v7.yml:29`). Fixing the v7 script would polish dead code. +. *MISCHIEF:* UUIDs hidden on the same line pass. *Fixed in the live checker* by #1180 (79df5305): "check every UUID on a line … with `grep -o`". +** `scripts/check-uuid-v7.sh:41` still has the greedy `sed`, but it is unwired. Only `scripts/estate-uuid-v7-audit.sh` and `hypatia-rules/uuid-v7-estate-conformance.a2ml` mention it, and it retires at ADR-008 P4. +. *STATE:* done (in v8). +. *DISPOSITION:* *CLOSE-DONE* (cite #1180). Optionally fold v7-script deletion into ADR-008 P4. +. — +. *RISK:* none. + +==== #1080 — Debtfile gate-scripts-without-tests probe cannot see actions-policy-486-test.sh +. labels governance, testing, priority:p2, scope:repo | last 2026-09-30 | 0 +. *LITERAL:* either rename the test or widen the probe; re-measure; add a positive control. +. *GOLDEN:* fine. Note that the Debtfile is `.machine_readable/Debtfile.a2ml`, a retired format that is still a live gate input. Editing its probe line is editing an A2ML file, but the estate already edits its counts (177be894, 4e13946f), so value edits are established practice. +. *MISCHIEF:* the ratchet over-counts. *Partly fixed.* +** Direct push 177be894 renamed the test to `actions-policy-test.sh` (arm a), so `check-actions-policy` is now matched. +** Measured probe today: 32. `set-allowed-actions` and `rsr-selfaudit` are still counted as untested even though `actions-policy-test.sh` exercises both (its lines 7-9). +. *STATE:* partly done (1 of 3). +. *DISPOSITION:* *BOT-DO.* +. Widen the probe (arm b): count a script as tested if any `scripts/tests/*-test.sh` assigns it to a variable (`grep -lE "=(\"?\$[A-Z_]+/\.\./)?\.sh"`). Lower count and ceiling 32 → 30. Add a positive control: removing the test raises the count. +** Sonnet, S. +. *RISK:* edits a live `.a2ml` gate input (value or probe, not a new fact). Flag for owner awareness. + +==== #1081 — Ruleset 23787415 requires 'SonarCloud Code Analysis', which no PR receives +. labels priority:p1, scope:estate | last 2026-09-30 | 0 +. *LITERAL:* either wire SonarCloud or remove the required context; control; sweep other repos for never-emitted required contexts. +. *GOLDEN:* fine. +. *MISCHIEF:* a vacuous required context forces every merge to bypass. *Removal is done* (per #1082: removed 2026-09-30, rule-suite 4296932589 `pass`). +** *Owner ruling D276 (#787):* "standards#1081: bring SonarCloud back, keeping ruleset 23787415's requirement". The first arm is therefore chosen, but it is not executed. +. *STATE:* second arm done as an interim. D276 picks the first arm, which is now #1082's AC2/AC3. +. *DISPOSITION:* *MERGE-INTO(#1082).* +** Copy D276 onto #1082. +** Move the AC4 sweep ("rulesets requiring contexts unseen in 30 days") to #1004/#681, which already track unsatisfiable required contexts. +** Close #1081. +. haiku, S. +. *RISK:* none. + +==== #1082 — SonarCloud never reports on standards PRs; removed from ruleset 23787415 until it does +. labels scope:estate, priority:p2 | last 2026-09-30 | 2 (both CodeRabbit auto-plans; no human content) +. *LITERAL:* diagnose the silence (app install, binding, trigger); a positive control check-run; only then re-add the context and merge with rule-suite `pass`; or drop SonarCloud for good. +. *GOLDEN:* D276 rules "bring SonarCloud back", so the drop arm is ruled out. +. *MISCHIEF:* SonarCloud is silent. *Still exists.* standards has no `sonar-project.properties` and no sonar workflow (grep `config/rulesets`, `.github/workflows`). +. *STATE:* blocked on owner credentials: +** D28 (provision the SonarCloud org and token); +** D211 ("Renovate/Sonar binding: owner-minted; agent wires + verifies"); +** D227 (SonarCloud org move). +. *DISPOSITION:* *KEEP-OPEN-BLOCKED* (on the owner creating the SonarCloud binding and token for hyperpolymath/standards, D211/D276). +. Once unblocked (sonnet, S): bind automatic analysis, open a probe PR, and observe the check-run. Then follow `config/rulesets` fresh-backup → dry-run → PUT re-add → merge a PR with rule-suite `pass`. +. *RISK:* ruleset edit (owner/admin token). Outward-facing. + +==== #1085 — k9-coordination: actor grants (fence × leash), deny-by-default, compiled to bypass lists, bot configs and a PreToolUse hook (D213/D214) +. labels none | last 2026-09-30 | 0 +. *LITERAL:* +** A spec revision adding actor grants to coordination.k9. +** Re-express the dead `bot_exclusion_registry.a2ml` axes in k9. +** `.deed` actor identity. +** A compiler emitting ruleset `bypass_actors`, `.coderabbit.yaml` and a Claude Code PreToolUse hook. +** Enforcement in the validate-action, plus positive and negative fixtures. +. *GOLDEN:* sound and ruled (D213/D214, plus D324 extending them). One precondition the body names, "deed-conformance runs Python deed_lint.py", *is now met*: `deed-conformance.yml:73-98` runs `bun deed_lint.js`. +. *MISCHIEF:* no actor/verb scoping, so agents can drive bots (the marid#56 incident). *Still exists.* +** `2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc` has no grant, leash or fence section. The grammar is now v1.2 (#1233), with no actor section. +** No coordination validator exists at all (see #1221). +. *STATE:* not started (prerequisite #1221 is open). +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (1) Grammar v1.3 plus a spec section for `actors:` (fence paths/repos × leash verbs), default deny for commit, push and merge. Lands in standards. +** (2) Bun compiler in standards `2-protocols/k9-coordination/tools/`, emitting bypass JSON, `.coderabbit.yaml` and the hook script. +** (3) k9-ecosystem validate-action: drop `coordination.k9` from the default skip list. +** (4) Fixture repo with a mutant. +** (5) Owner ruling on `praxis-deed :may-refuse/:emits`. +** Opus, L. +. *RISK:* emits ruleset bypass lists and agent hooks (security-critical). Cross-repo. + +==== #1086 — Launcher census: 20 launchers still put the PID file under ${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}} (CWE-377) +. labels none | last 2026-09-30 | 1 (realign blocker: 16 configs have `[repo] path = ""`) +. *LITERAL:* move 13 minted launchers via `launch-scaffolder realign` and 6 hand-written ones by one-line PR. Rule on boj-server-mk2. Close only when the origin-verified census reads 0. +. *GOLDEN:* one tension. The realign blocker fix ("set `[repo].path` in each `meta-repos/*/*.launcher.a2ml`") means editing *A2ML* files, which CLAUDE.md and D313 forbid for adding facts. The per-app descriptor migration to deed is #1226 (owner ruling pending). Sensible split: +** the 6 hand-written launchers can go now (no A2ML involved); +** the 13 minted launchers need either an explicit owner carve-out to edit the legacy `.launcher.a2ml` path value, or must wait for #1226. +. *MISCHIEF:* predictable PID path in `/tmp`. The standard was fixed by #1076 (2ee32bc6). The downstream population was *not re-measured* (no cross-repo API here). +. *STATE:* standard done; population not done (as filed). boj-server-mk2 was unarchived for realign per the comment. +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (a) 6 hand-written launchers (reposystem, trigger, valence-shell, IDApTIK ×2, project-ovine): one-line PRs with `mkdir -p -m 0700` and quoting. Haiku, S each. +** (b) 13 minted launchers: `launch-scaffolder realign` after the repo.path decision. Sonnet, M. +** (c) Re-run the census command from the body with origin verification. +. *RISK:* IDApTIK and universal-modding-studio are the *son's* repos (AGPL, D120/D246), so coordinate. Editing `.launcher.a2ml` is an A2ML edit. + +==== #1089 — OWASP gate gap: method policy, ASVS probe and SSRF rule are declared but not gated +. labels none | last 2026-09-30 | 0 +. *LITERAL:* +** A `3-practice/` HTTP/GraphQL method policy mapped to OWASP API Top 10 and ASVS IDs. +** `host.owasp.asvs_level` and the MUST OWASP line get a probe with a mutant, or are downgraded to prose. +** An RSR criterion. +** An SSRF rule specified here and implemented in hypatia. +. *GOLDEN:* fine (D223). +. *MISCHIEF:* fake gates. *Still exists:* +** `3-practice/TRUST-DEFAULTS-POLICY.adoc:455,460` keys have no probe; +** no method-policy doc (grep "SSRF|CWE-918|method policy" is empty). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO* (standards part); the hypatia rule is a follow-up there. +. Steps: +** (1) Write `3-practice/HTTP-METHOD-POLICY.adoc` from the D223 text with an OWASP/ASVS mapping table. +** (2) Downgrade the two TRUST keys and the MUST line to "declared, not gated" with a pointer. This is the cheap, honest arm; a probe comes later. +** (3) Add a criterion row (canon change; batch with the #1125 canon release). +** (4) File a hypatia SSRF rule issue. +** Sonnet, M (opus if the probe arm is chosen). +. *RISK:* canon change for the RSR criterion. + +==== #1091 — D217/D215b: convert unsigned commit producers, then enforce signatures on 61 repos (+18 in comment) +. labels none | last 2026-09-30 | 1 (18 more bypass-only repos) +. *LITERAL:* +** Convert every `git push` workflow to `signed-push`/`createCommitOnBranch`. +** Convert rhodibot.yml at source. +** Turn CodeRabbit commit-pushing off. +** Route agents through the API or an owner SSH identity. +** Configure the second machine. +** Apply a zero-bypass floor per repo after 14 clean days. +. *GOLDEN:* fine (D215/D217/D233). +** The standards side has progressed: `.github/actions/signed-push` now uses native `push-verified.sh` with `createCommitOnBranch` (#1233/#1238), and the asana dependency is gone. +** standards' own `debt-measure.yml`, `mirror-reusable.yml`, `changelog-reusable.yml` and `propagate-hooks.yml` are listed as `git push` producers. Mirror pushes to non-GitHub forges are exempt by the AC. +** Note: CLAUDE.md says unsigned *agent* commits are non-blocking. That does not override D217's producer conversion. +. *MISCHIEF:* unsigned landings. *Still exists estate-wide.* The 79-repo population was not re-measured. +. *STATE:* partly started (signed-push action ready; floors on clean repos per D215). +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (a) standards-owned producers first: convert `debt-measure.yml`, `changelog-reusable.yml` and `propagate-hooks.yml` to the signed-push action. Sonnet, M. +** (b) rhodibot.yml at source (gitbot-fleet), 22 copies. +** (c) CodeRabbit config `autofix: false` estate-wide (ties to #1085 compiler). +** (d) 14-day watch, then `apply.sh sig` per repo. Owner token. +** Opus to coordinate, sonnet for edits; L. +. *RISK:* ruleset changes (owner token). Bulk sweep. Bot-identity changes. + +==== #1093 — codeql-action: ~53 repos startup-dead from 4.38.2 bumps without the lock record; 4.38.1 was never broken +. labels bug, cicd | last 2026-09-30 | 0 +. *LITERAL:* census of codeql `uses:` vs lock vs run jobs; one-commit fixes; correct the false "4.38.1 blocked" comments; fix at the sender (Dependabot cannot bump without the lock); 0 STARTUP_FAILURE. +. *GOLDEN:* fine. It absorbs #1055 AC5 and overlaps #1037 and #670. +. *MISCHIEF:* lock drift kills CodeQL. *Partly persists.* +** standards itself still pins `b96794f0 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)` in `codeql-reusable.yml:97,103` and `hypatia-scan-reusable.yml:272`. That repeats the refuted cause. +** The `dependabot.yml` HOLD comment repeats it too. Its wildcard `github/codeql-action*` ignore does meet AC4 for standards (D118 pattern). +** Named examples have moved: rsr-template-repo `uses:` and lock now agree on b96794f0; hypatia now uses tag `@v4.38.2` with a matching tag-keyed lock. That is consistent but *tag-pinned, not SHA-pinned*. +. *STATE:* partly done. +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** (a) Owner decision to lift the HOLD (AC1-class): bump to a current release with the lock in one commit. +** (b) Correct the false comments in standards (3 sites) and the template. Haiku. +** (c) Census script: read `uses:` and the lock key per repo plus the latest codeql run's jobs. Sonnet. +** (d) Per-repo one-commit fixes verified with `gh actions-lock --no-fix` and jobs ≥1. +** (e) Re-SHA-pin hypatia. +** Opus coordinate; L. +. *RISK:* bulk sweep across about 90 repos. + +==== #1101 — Carve-outs via subtree split strip every commit signature (lol, #680) +. labels none | last 2026-09-30 | 0 +. *LITERAL:* the carve-out procedure states the signature consequence and picks (a) a single signed squash-import or (b) an owner-ruled exception. Carve-out tools warn on `required_signatures`. No rewrite of lol history. +. *GOLDEN:* fine. D254 (#787) closed the forensic only, not the arm. Arm (a) is the E arm, consistent with D19 squash and D217 API signing. +. *MISCHIEF:* carve-outs land unsigned history that a zero-bypass floor refuses. *Still exists.* `docs/SIGNING-POLICY.adoc` has no carve-out section, and no carve-out procedure doc exists (#479/#493 carve-out issues are open). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO* (apply arm (a) under D113 apply-unless-struck). +. Add a "Carve-outs and history rewrites" section to `docs/SIGNING-POLICY.adoc`: squash-import as one signed commit with a tag or link back to the standards SHA; (b) only by named owner ruling before the floor goes on. Cross-link from #479. +** Sonnet, S. +. *RISK:* none. + +==== #1102 — Fork-PR security gate never started: pull_request_target refused by Actions policy +. labels none | last 2026-09-30 | 0 +. *LITERAL:* move the gate to `pull_request` (jobs >0, planted control, no write perms, propagate), or re-enable `pull_request_target` by owner ruling. +. *GOLDEN:* — +. *MISCHIEF:* a gate that never ran. *Resolved by retirement.* #1171 (eafcfbb5, 2026-10-06): "Jonathan decided … to retire it rather than re-enable the event." +** No `pull_request_target` remains in `standards/.github/workflows` (grep is empty). +** None remains in the template, hypatia, gitbot-fleet, cicd-squabbler, cicd-suite or proven-tests-and-benches. +. *STATE:* done (retire arm; AC3 met; AC1/2 moot). +. *DISPOSITION:* *CLOSE-DONE* (cite #1171 and the owner decision of 2026-10-06). +. — +. *RISK:* none. + +==== #1107 — Provisioning canon: four gaps found by the 8-repo pilot +. labels none | last 2026-10-01 | 0 +. *LITERAL:* +** (1) Doctor PASS must name the mise-managed binary; a Nix-profile binary should WARN. +** (2) Mint pins a declared toolchain floor instead of `latest`, and doctor checks floor vs lock. +** (3) Elixir doctor detects a stale Hex/Rebar archive; `heal` runs the fix. +** (4) Offline mint verifies carried tools or refuses them. +. *GOLDEN:* fine. (2) changes canon wording (`latest` + `mise.lock`, PROVISIONING-STANDARD.adoc:33,116). +. *MISCHIEF:* false PASS and breakage on old toolchain APIs. *Still exists:* +** `3-practice/provisioning/templates/build/just/provision-lib.sh:534` passes any `command -v` hit; +** the canon still says `latest`; +** no Hex archive check (only `mix local.hex --force --if-missing` in setup at line 264). +. *STATE:* not started. The last provisioning change was #1112. +. *DISPOSITION:* *BOT-DO* (standards templates); item (4) lands in launch-scaffolder. +. Steps: +** (1) Compare `command -v` with `mise which`, and WARN PV-W3x on `/nix/` or `.nix-profile`. +** (2) Add a floor reader (`build.zig.zon`, `rust-toolchain.toml`, `mix.exs`, `.tool-versions`) and a PROVISIONING-STANDARD amendment. +** (3) Add a `mix archive` load probe. +** (4) launch-scaffolder: offline `mise registry` check. +** Sonnet, M. +. *RISK:* none (templates). Cross-repo for (4). + +==== #1108 — Secret-Scan-Floor (D243/D244): sweep results and open items +. labels none | last 2026-10-01 | 2 (77 caller PRs landed; 19/21 lock-set landed) +. *LITERAL:* a multi-section close-out with these items: +** §1: 31 repos red at gitleaks on the default branch. +** §2: callee-aware `gh actions-lock`. +** §3: 6 private repos. +** §4: phantom reusable pins. +** §5: old-context rulesets. +** §6: invalid callers and actionlint. +** §6a: startup failures. +** §6b: false `secrets: inherit` header. +** §6c/6d: red and blocked PRs. +** §7: default ≠ trigger branch. +** §8: apps-ack-gate fails open; secondary-limit pacing; content-keyed census; automerge re-fire. +. *GOLDEN:* §5 is partly ruled. D291 moves epistemic-types, deed-ecosystem and firmboot to the `scan` key. §6b overlaps #1141. +. *MISCHIEF:* repos without a secret-scan floor, and secrets in history. *Largely still exists.* +** §6b checked in standards: `.github/workflows/secret-scanner-reusable.yml:32-35` still says callers "MUST use `secrets: inherit`". +** The reusable declares no `workflow_call.secrets`, and standards' own `secret-scanner.yml:49` passes `secrets: inherit`. +. *STATE:* partly done (floors on 336+33+19 repos). +. *DISPOSITION:* *ESTATE-CAMPAIGN.* +. Steps: +** Split into child issues: +*** (A) §1/§6c secret triage. Owner only: rotate or purge. +*** (B) §4/§6 validator: pin-resolves check plus actionlint on callers. Sonnet, M. +*** (C) §6b: fold into #1141. +*** (D) §8 apps-ack-gate fail-closed. This lives in the owner's hook config, not this repo. Sonnet, S. +*** (E) §5/§7 per-repo ruleset swaps (D291). Owner token. +*** (F) §3 private repos (billing). +** Then close #1108 as the record. +** Opus to split; L overall. +. *RISK:* secrets (owner-only rotation). Ruleset edits. Bulk sweep. + +==== #1109 — Estate: needs me +. labels scope:estate, chore | last 2026-10-05 (body rewrite) | 0 +. *LITERAL:* a dashboard body generated by `squabble board --publish`. It lists 8 repos (10 PRs) with no required check on the default branch. +. *GOLDEN:* it is not a task. It is a manually refreshed dashboard; no schedule exists in cicd-squabbler (`board.rs` writes it only with `--publish`). The snapshot is 9 days stale. +. *MISCHIEF:* repos without a required context, so `--auto` merges instantly. That is D237's concern. Not re-measured. +. *STATE:* stale snapshot. +. *DISPOSITION:* *OWNER-RULING.* Question: "Is #1109 a live dashboard Jonathan still uses?" +** *Yes:* keep it open, label `meta:dashboard`, exclude it from triage, and schedule `squabble board --publish hyperpolymath/standards#1109` in cicd-squabbler. +** *No:* close it and run the board on demand. +. If yes: haiku, S (cron workflow in cicd-squabbler). +. *RISK:* none. + +==== #1122 — Lock repair chain drops composite-action edges, and --verify-local accepts the result +. labels none | last 2026-10-01 | 0 +. *LITERAL:* +** prune-stale follows local `uses: ./…` composites. +** `--verify-local` fails on missing composite deps. +** relock-sha-keys merges rather than duplicates. +** Then drop the `composite-unsupported` refusal. +. *GOLDEN:* fine. Severity fell after #1233/#1238: the signed-push composite now has one dependency (`actions/create-github-app-token`), which other workflows also use, so today's blast radius is small. The defect remains for any repo with composites. +. *MISCHIEF:* silent lock damage. *Still exists:* +** `scripts/regen-dependabot-locks.sh:69` still refuses composite repos; +** `prune-stale.sh` reads only workflow files (its own comment at line 43); +** #1238 had to hand-edit with gawk because "the repo's lock tooling cannot do this". +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* +. Add composite resolution (read `.github/actions/*/action.yml` `uses:`) to prune-stale's oracle set and to `update-actions-lock.sh --verify-local`. Fix the relock duplicate merge. Add tests with a composite fixture and mutant, plus the planted two-line deletion. Remove the refusal. +** Sonnet, M. +. *RISK:* edits lock tooling used estate-wide. Mutation tests are required. + +==== #1125 — canon: template-capability-gates.toml still counts flake.nix as reproducible-build +. labels refactor, packaging, scaffolding | last 2026-10-01 | 0 +. *LITERAL:* set the row to `guix.scm|build/guix.scm`, state Nix retired in the comment, re-pin `canon.lock` via the canon procedure, update criterion 1.2.1. +. *GOLDEN:* fine. Criterion 1.2.1 in `0-canon/rsr/rsr-criteria-v2.a2ml:103` already says "Guix only", so only the gates file is stale. +. *MISCHIEF:* a Nix fallback in canon. *Still exists*: `.machine_readable/template-capability-gates.toml:58-60`. +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* Batch it with #1227, #1228 and #1229 as *one canon release* (gates sha256 in `canon.lock:248` and the applicability sha256 at `:252` change together, with Gate A lockstep). +. Edit the row and comment, run `scripts/check-canon-lockstep.sh`, re-pin, add a CHANGELOG/VERSION bump in `0-canon/rsr/`. +** Sonnet, S. The owner merges the release. +. *RISK:* canon release (Gate A). Owner merge. + +==== #1137 — Workflow security linter: duplicate-key checker false-positives on KYAML flow sequences +. labels none | last 2026-10-02 | 0 +. *LITERAL:* scope the duplicate-key check per mapping node (or parser-backed); known-answer controls; green on main. +. *GOLDEN:* — +. *MISCHIEF:* a false red on main. *Gone.* +** Governance is green on main (per brief). +** `scripts/check-workflow-duplicate-keys.sh` is yq-normalised (#1115). With Go yq 4.44.3 it reports the *original KYAML* `provisioning-check-reusable.yml` (from c5503147) "clean", and its test suite passes 17/17, including "duplicate inside a one-line flow mapping is rejected". +** *But* the KYAML pilot file itself was reverted to block YAML by #1153 ("Pr 1148", an empty-template PR body). The red cleared partly because the KYAML vanished, and the D280 pilot conversion was silently lost. +. *STATE:* done (checker correct). The pilot regressed. +. *DISPOSITION:* *CLOSE-DONE.* Note in the close comment that #1153 reverted the KYAML pilot; re-landing it belongs to #1025 (workflows step). +. — +. *RISK:* none. + +==== #1140 — UUID v7 checker needs an explicit legacy/external identity preservation contract +. labels none | last 2026-10-03 | 0 +. *LITERAL:* define a typed legacy/external-ID mechanism or reviewed migration mapping. The trigger was `check-uuid-v7.sh` rejecting a v5 clade UUID in `.machine_readable/descriptiles/CLADE.a2ml` (stateful-artefacts#69). +. *GOLDEN:* superseded by ADR-008 amendment D320 (#1197, 85aa1934): +** `check-uuid-v8.sh` skips `*.a2ml`, which fixes the triggering case; +** clade IDs become profile C derived in `gv-clade-index` from `github.com//`; +** external boundaries "preserve and type explicitly" (ADR-008 lines 108-109); +** the DEED `#u5` → `#u8` aliasing is the separate #1230. +. *MISCHIEF:* downstream agents re-minting identities to go green. Resolved for the reported case. The general aliasing question lives in #1230. +. *STATE:* superseded. +. *DISPOSITION:* *CLOSE-SUPERSEDED(#1197).* Point to ADR-008 D320 and #1230. +. — +. *RISK:* none. + +==== #1141 — Reusable workflows reference secrets without declaring them (WH008 unsatisfiable) +. labels none | last 2026-10-03 | 0 +. *LITERAL:* declare `on.workflow_call.secrets` (`required: false`) in each reusable that reads secrets, so callers can forward by name instead of `secrets: inherit`. +. *GOLDEN:* `GITHUB_TOKEN` cannot and need not be declared (it is always available), so the rows naming it need nothing. +. *MISCHIEF:* `inherit` over-grants (CWE-250). *Partly fixed.* Measured with `yq '.on.workflow_call.secrets'`: +** *Done:* `mirror-reusable.yml` (7 keys), `governance-reusable.yml` and `allowlist-preflight-reusable.yml` (HYPATIA_SCAN_PAT). +** *Missing:* `hypatia-scan-reusable.yml` (HYPATIA_SCAN_PAT), `tailscale-connect-reusable.yml` (TS_OAUTH_*), `elixir-ci-reusable.yml` (GITHUB_TOKEN only, nothing needed). +** `secret-scanner-reusable.yml` reads no secret, but its header still demands `inherit` (#1108 §6b). +** standards' own callers `mirror.yml`, `governance.yml`, `hypatia-scan.yml` and `secret-scanner.yml` still pass `secrets: inherit`. +. *STATE:* partly done. +. *DISPOSITION:* *BOT-DO.* +. Steps: +** Declare the secrets in hypatia-scan and tailscale-connect. +** Rewrite the secret-scanner header (absorbs #1108 §6b). +** Switch standards' 4 callers to named `secrets:` (or none for secret-scanner). +** Propagate to the rsr-template-repo callers. +** Acceptance: hypatia WH008 has no findings in standards, and the callers run green. +** Sonnet, S. +. *RISK:* callers on SHAs are unaffected until they bump (`required: false`). + +==== #1147 — fix(ci): replace the three actions the estate policy rejects at start-up +. labels bug, governance | last 2026-10-04 | 0 +. *LITERAL:* apply the attached patch: editorconfig-checker becomes `go install` plus the binary; webfactory/ssh-agent becomes manual `ssh-agent`; dtolnay in mirror becomes `rustup default stable`. Drop the lock records. +. *GOLDEN:* three corrections. +** *Diagnosis scope.* In standards' *own* runs these actions are accepted. Mirror run 38484072398 on 7d2041a2 shows `Run webfactory/ssh-agent` and `Setup Rust` = success. The rejection is per-repo `allowed_actions` (game-server-admin), which D39 addresses (apply the canon payload). +** *Mirror red on standards main is a different cause.* Host-key verification fails for disroot, gitea and sourcehut, and the push fails for bitbucket and codeberg. That is forge provisioning (D261, #1002, #950), not this issue. +** *The patch uses `go install`.* Go is a banned language. Running the Go toolchain on a runner is not authoring Go, but a checksum-verified release-binary download (the gitleaks pattern, D223 "checksum downloads") is cleaner. The patch base `a41f3692` is also stale: the dtolnay pin moved in #1157/#1231. +. *MISCHIEF:* reusables startup-die in repos with strict allowed-actions. *Still exists:* `governance-reusable.yml:1069`, `mirror-reusable.yml:85…346,411`. +. *STATE:* not applied. +. *DISPOSITION:* *BOT-DO.* +. Re-derive the patch on main: +** editorconfig-checker: sha256-verified release tarball, no `go install`. +** ssh-agent: the manual `ssh-agent` blocks as in the patch. +** mirror Rust: `rustup default stable`. +** Lock: remove the records via `prune-stale.sh`, then `check-lock-sync.sh`. +** Verify on game-server-admin: Governance and Mirror runs have jobs ≥1. +** Sonnet, S. +. *RISK:* reusables reach about 360 SHA-pinned callers on their next bump. Behaviour change to the advisory step. + +==== #1172 — Allowlist Preflight red on main: check-allowed-actions.sh compares owner/repo case-sensitively +. labels none | last 2026-10-06 | 0 +. *LITERAL:* case-fold owner/repo on both sides; a fixture test with a positive control; green on main. +. *GOLDEN:* — +. *MISCHIEF:* *Fixed.* +** #1176 (223a9da3) made `scripts/check-allowed-actions.sh` lowercase both sides (`owner_repo()`, `base.lower()`). +** `scripts/tests/check-allowed-actions-test.sh:31-38` covers mixed case and a rejected unlisted repo. +** #1184 (89d778d9) also added the `swatinem/rust-cache@*` data row. +** Governance is green on main. +. *STATE:* done. +. *DISPOSITION:* *CLOSE-DONE* (cite #1176 and #1184). Optional tidy: drop the now-redundant lowercase duplicate row at `allowed-actions.json:91` (haiku). +. — +. *RISK:* none. Note the checker embeds *Python* (`python3 - <<'PY'`, ledgered in `.machine_readable/inline-python-allow.txt`); separate debt, #309. + +==== #1173 — Hypatia baseline and scan red on main: 12 new findings since #1143 +. labels none | last 2026-10-06 | 0 +. *LITERAL:* mktemp in the kyaml scripts; baseline acks for RE001 (#941) and the K9 negative fixture; both jobs green; better gate count message. +. *GOLDEN:* — +. *MISCHIEF:* *Fixed* by #1184 (89d778d9). Its body lists every item: +** mktemp in kyaml-format, kyaml-migrate and test_kyaml_comment_preservation (grep `/tmp` finds only a comment, kyaml-migrate.sh:73); +** RE001 ack under #941; +** K9 fixture ACK; +** `apply-baseline.sh` counts at-or-above threshold. +Hypatia scan is green on main (per brief). +. *STATE:* done. +. *DISPOSITION:* *CLOSE-DONE* (cite #1184). +. — +. *RISK:* none. + +==== #1174 — Self Test red on main: direct push 5b56aec0 overwrote kyaml-format.sh +. labels testing | last 2026-10-06 | 0 +. *LITERAL:* restore kyaml-format.sh from df20618b, or adopt the new contract; the test passes; mktemp. +. *GOLDEN:* — +. *MISCHIEF:* *Fixed* by #1184: "`scripts/kyaml-format.sh` is restored to the tested implementation (`df20618b`)". #1238's PR body reports `kyaml-format-test` 17/17. Self Test is green on main. +. *STATE:* done. +. *DISPOSITION:* *CLOSE-DONE* (cite #1184). +. — +. *RISK:* none. The *root* cause (direct pushes to main bypassing review) is cross-cutting; see the summary. + +==== #1219 — "Problem": validate-k9.sh SIGPIPE false negatives under pipefail +. labels none | last 2026-10-09 | 0 | *real issue with a broken title* (see the note under #1224) +. *LITERAL:* replace `printf … | grep -qxF` with a here-string (`grep -qxF -- "$file" <<< "$CHANGED"`); a regression test under `scripts/tests/`. +. *GOLDEN:* fine. +. *MISCHIEF:* a touched nonconforming K9 file is treated as advisory. *Still exists*: `.githooks/validate-k9.sh:155`, with `set -euo pipefail` at line 42. *Sibling with the same defect* at line 94: `in_ledger() { ledger_entries | grep -qxF "$1"; }`. +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* First retitle it "validate-k9.sh: SIGPIPE under pipefail gives false negatives on large change lists". +. Fix both pipe sites (lines 94 and 155) with here-strings. Add `scripts/tests/validate-k9-sigpipe-test.sh`: a 50k-line `$CHANGED` with the file present, looped 200× and asserted always detected, red against the old form. +** Haiku, S. +. *RISK:* none. + +==== #1220 — "Problem": rhodium-standard-repositories/actions-allowlist is a residual outside 9-archive +. labels none | last 2026-10-09 | 0 | broken title +. *LITERAL:* a five-step deprecation plan: publish at a new path, serve both, instrument, retire, update the map. +. *GOLDEN:* *over-engineered given how consumers actually read it.* +** Both consumers (`allowlist-preflight-reusable.yml:26-49`, `governance-reusable.yml:134-200`) *sparse-checkout standards at `${{ job.workflow_sha }}`*, not a raw URL. +** Every caller therefore reads the path *as it existed at its pinned SHA*, so a single commit that moves the file and updates both reusables breaks no reusable caller. +** The sibling repos have no raw-URL consumer (grep finds only a comment in cicd-squabbler `dependabot-automerge.yml:63`). +** Instrumenting raw fetches is not possible on GitHub anyway. +** The sensible reading is an atomic move plus a short-lived README stub at the old path. +. *MISCHIEF:* a live interface stranded in an archived tree. *Still exists* (root `rhodium-standard-repositories/actions-allowlist/`, `standards-map.toml:111-122` residual entry). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* Retitle first. +. `git mv` to e.g. `config/actions-allowlist/`. Update both reusables' sparse-checkout and cp paths. Leave a README stub at the old path for one release. Update standards-map.toml (and also map `READINESS.md`, which currently fails GATE D). Run `scripts/tests/check-allowed-actions-test.sh` and the GATE D script. +** Sonnet, S. +. *RISK:* low. External raw-URL consumers are unknown; owner glance before merge. + +==== #1221 — "Problem": root coordination.k9 does not parse under its grammar; no validator +. labels none | last 2026-10-09 | 0 | broken title +. *LITERAL:* a validator for coordination.k9 in CI; root file parses under v1.1; a planted defect is rejected. +. *GOLDEN:* the grammar is now *v1.2.0* (#1233, 0b1898e2). The root file declares `schema_version: 1.2.0` and, per #1233, parses under v1.2 (checked by hand with apg-js; it correctly fails v1.1). So "parse under v1.1" is obsolete and the target is v1.2. +. *MISCHIEF:* a reference implementation with no validator. *Partly fixed*: the file conforms. *Still no validator or CI*: no script in `2-protocols/k9-coordination/tools/` (only `k9-init`), and nothing in workflows references the grammar. CLAUDE.md still says "No validator script exists yet". +. *STATE:* partly done. +. *DISPOSITION:* *BOT-DO.* Retitle first. +. Add `2-protocols/k9-coordination/tools/coordination-validate.js` (bun + apg-js, pinned in package.json/bun.lock) compiling `coordination-k9-grammar_v1.2.abnf`. Add fixtures valid/ and invalid/ with a mutant. Wire a CI job (with actions.lock records). Update CLAUDE.md and README to name the validator. +** Sonnet, M. +. *RISK:* touches `.claude/CLAUDE.md` (owner review). + +==== #1222 — "Problem": .hypatia-baseline.json entries expire ~2026-10-21 +. labels none | last 2026-10-09 | 0 | broken title +. *LITERAL:* count entries expiring by 10-31, document what expiry does, renew or let lapse with stated consequences. +. *GOLDEN:* fine, but it *duplicates #975* ("21 baseline acks lapse on 2026-10-22 and 17 point at closed issues"), which is open. +. *MISCHIEF:* a scheduled behaviour change nobody owns. *Still exists and is 7 days out.* +** Measured: 189 entries, *21 expire 2026-10-21*, 9 on 11-29, 75 on 12-22, 84 with no expiry. +** Expiry semantics: `scripts/apply-baseline.sh` drops entries with `expires_at < today`, so the findings resurface and the Hypatia gates can go red on 2026-10-22. +** Several of the 21 point at files that no longer exist (`scripts/check-ts-allowlist.ts`, `lol/…` ×3, `scorecard.yml`, `2-protocols/avow/public/demo.js`), so those are inert. Others are live (`setup.sh`, `2-protocols/axel/src/Tea.res.js`, `2-protocols/0-ai-gatekeeper/…/session_manager.rs`, 9-archive templates). +. *STATE:* not started. +. *DISPOSITION:* *MERGE-INTO(#975).* Post the measurement there, retitle #1222 and close it as duplicate. +. For #975 (sonnet, S, *urgent before 2026-10-21*): +** delete entries whose file is gone (shrink-only allowed); +** re-point entries tied to closed issues; +** renew live ones with a reason, or fix them. +. *RISK:* gate red on 10-22 if ignored. + +==== #1223 — "Problem": three references to non-existent RSR.adoc / spec/LANGUAGE-POLICY.adoc +. labels none | last 2026-10-09 | 0 | broken title +. *LITERAL:* check whether anything reads `reference:`; repoint or delete the three references. +. *GOLDEN:* fine. A2ML rule: `hypatia-rules/rsr-self-compliance.a2ml` may have content *deleted* but no fact added. Repointing a reference in an A2ML file is borderline; deleting the stale line is clean. +. *MISCHIEF:* dangling references. *Still exists*: `hypatia-rules/README.adoc:72`, `hypatia-rules/rsr-self-compliance.a2ml:18`, `.claude/CLAUDE.md:100`. +** Nothing reads `reference:`: hypatia `lib/rules/rule_loader.ex` parses hypatia-rules but never uses a `reference` field (grep). +** Real targets: `0-canon/rsr/RSR-SPEC-v2.adoc` and `0-canon/rsr/LANGUAGE-POLICY.adoc` (§Terminology at line 25). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO.* Retitle first. +. Repoint README.adoc:72 to `0-canon/rsr/RSR-SPEC-v2.adoc`. Repoint CLAUDE.md:100 to `0-canon/rsr/LANGUAGE-POLICY.adoc §Terminology`. Delete the `reference:` line in the `.a2ml` and record why in the commit. +** Haiku, S. +. *RISK:* touches `.claude/CLAUDE.md` (owner review) and an `.a2ml` (delete-only). + +==== #1224 — "Problem": Scorecard alerts on byte-identical archived template after the 9-archive move +. labels none | last 2026-10-09 | 0 | broken title +. *LITERAL:* choose deliberately among dismissing the 2 alerts, excluding 9-archive from scanners, or routing via the baseline; record the policy. +. *GOLDEN:* fine. Scorecard is now green on main, because PR-level "new alerts" was transient. The underlying code-scanning alerts likely remain open, but that could not be read here (no security scope). +. *MISCHIEF:* no policy for frozen content versus scanners. *Still exists*: no 9-archive handling in workflows, `.hypatia-ignore` or the SARIF filter. 31 `.hypatia-baseline.json` entries already point into 9-archive, which is the de facto arm (3). +. *STATE:* not started. +. *DISPOSITION:* *OWNER-RULING* (an apply-unless-struck candidate). Question: "Frozen `9-archive/` findings: route through the baseline (one directory-scoped ack per rule) and dismiss the 2 Scorecard alerts as 'won't fix: frozen archive', recorded in `docs/CICD-SIGNAL-DISCIPLINE.adoc`?" Yes or no. Retitle first. +. If yes: the owner (security-scope token) dismisses the alerts; a bot writes the policy paragraph (haiku, S). +. *RISK:* needs a security_events token. + +*Note on #1219–#1224 (the six "Problem" issues):* +* *Not spam, not accidental duplicates.* All six were filed by the owner account (`hyperpolymath`) within six seconds, as follow-ups explicitly deferred from the 9-archive move #1218. Each has a distinct, accurate, actionable body. +* The title "Problem" is an artefact of the filing script taking the first `##` heading as the title. +* Value: #1219 (real latent gate bug), #1220, #1221, #1223 and #1224 are all valid. #1222 is a duplicate of #975 but carries fresh measurements. +* Action: retitle all six (haiku), then dispose per record. + +==== #1225 — Ruling needed: canonical launcher metadata domains/encoding and offline fallback authority +. labels decision | last 2026-10-10 | 0 +. *LITERAL:* the owner decides: +** whether the canonical `launcher/launcher-standard_praxis.deed` gains `(platforms)`, `(lifecycle-phases)` and `(metadata-block (encoding …))` clauses that launch-scaffolder already uses; +** whether a byte-identical offline fallback copy is allowed (bounded, pinned) or banned (no-vendor MUST). +. *GOLDEN:* fine. A genuine owner decision. +. *MISCHIEF:* two authorities differ (sha256 29c12fbd… local vs b9d72768… canon). *Still exists*: the canonical deed has `:required-fields` naming `platforms` and the lifecycle phases (lines 348-351) but no `(platforms)` or `(lifecycle-phases)` domain clauses; `:standard-version "0.6.0"`. +. *STATE:* awaiting ruling. +. *DISPOSITION:* *OWNER-RULING.* Two yes/no questions: +** (A) "Adopt platforms, lifecycle-phases and metadata-block encoding clauses into the canonical launcher deed (with matching adoc in the same commit)?" +** (B) "Allow launch-scaffolder a bounded offline fallback copy pinned to an exact canonical commit and hash, with a currency check? (No = the no-vendor MUST applies and the copy is removed.)" +E arm: A=yes. For B=no, a fetch-at-build plus pinned hash avoids drift entirely. +. After the ruling: sonnet, M (deed + adoc lockstep + fixtures). Then launch-scaffolder re-bakes. +. *RISK:* canon change. + +==== #1226 — Ruling needed: per-app launcher praxis field vocabulary before the 21-descriptor migration +. labels decision | last 2026-10-10 | 0 +. *LITERAL:* the owner rules on the per-app `.launcher_praxis.deed` vocabulary: field set, opaque/typed encoding of `[integration]` and `[exceptions]`, unknown-field behaviour, ordering and ownership. Plus fixtures, a rename manifest and a dual-accept overlap. +. *GOLDEN:* fine. It also unblocks #1086's 13 minted launchers (avoiding A2ML edits) and #960 (open: "21 launcher descriptors … still name the deleted launcher-standard.a2ml"). +. *MISCHIEF:* lossy conversion risk. *Still exists.* No per-app vocabulary in `launcher/` or `1-formats/deed/vocabulary/`. A mapping `1-formats/deed/mappings/launcher-standard-to-praxis-deed.adoc` exists for the *standard*, not per-app descriptors. +. *STATE:* awaiting ruling. +. *DISPOSITION:* *OWNER-RULING.* Question: "Adopt launch-scaffolder's local design (`docs/per-app-launcher-descriptor-deed.adoc`) as the normative per-app vocabulary, with `[integration]` as an opaque quoted carry, `[exceptions]` as ordered `(override …)`, and unknown TOML keys blocking conversion?" Yes or no. E arm: yes, with the vocabulary doc owned by standards `1-formats/deed/vocabulary/launcher-app.adoc`. +. After the ruling: sonnet, M (vocabulary doc + fixtures). Conversion is kyX's job (D313), not hand work. +. *RISK:* bulk conversion must not be hand-done (D313). + +==== #1227 — check-rsr-profile.sh never evaluates [baseline]; its .well-known/ row predates the www/ migration +. labels none | last 2026-10-11 | 0 +. *LITERAL:* wire `[baseline]` into `check-rsr-profile.sh` (MISSING rows); change the row to `.well-known/|www/.well-known/`. +. *GOLDEN:* *worse than filed.* +** Wiring `[baseline]` as written would make every deed-era repo fail. The baseline still demands `0-AI-MANIFEST.a2ml`, `.machine_readable/rsr-profile.a2ml` and A2ML descriptiles (see #1229). +** `check-rsr-profile.sh` itself reads *only* `.machine_readable/rsr-profile.a2ml` (lines 38-39), but the spine rsr-template-repo now carries its profile as a `(rsr-profile …)` clause in `rsr-template-repo_chora.deed` (line ~1035) and ships *no `.a2ml` files at all*. The checker cannot read the repo it exists to check. +** Sensible reading: the baseline wiring must land *together* with the #1229 baseline rewrite and a deed-reading profile loader. +. *MISCHIEF:* the baseline is prose with no reader. *Still exists* (`grep -c baseline scripts/check-rsr-profile.sh` = 0; the row is `".well-known/"` at gates toml line 34). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO* (in the #1125/#1227/#1228/#1229 canon bundle). +. Steps: +** (1) Profile loader: read the `(rsr-profile …)` clause from `_chora.deed` (via `bun 1-formats/deed/tools/deed_lint.js` parse output), falling back to `rsr-profile.a2ml` for legacy repos. +** (2) Evaluate `[baseline].paths` as MISSING rows. +** (3) Change the row to `.well-known/|www/.well-known/`. +** (4) Tests: oikos-shaped fixture passes, and a missing LICENSE fails. +** Sonnet, M. +. *RISK:* canon release (gates sha256). Every consumer's verdict changes, so announce it. + +==== #1228 — [gates] src/**/*.rs is root-anchored; cargo workspaces can never satisfy it +. labels none | last 2026-10-11 | 0 +. *LITERAL:* change to `"src/**/*.rs|*/src/**/*.rs" = "rust"`, and alternate `.github/workflows/rust-ci.yml` with `ci.yml`. +. *GOLDEN:* fine. Overlaps open #895 ("Gate format cannot express partial modules or nested layouts"), which is the general form. +. *MISCHIEF:* a permanent false MISSING for workspaces. *Still exists* (gates toml lines 40-41). +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO* (canon bundle). Cross-link #895. +. Edit both rows. Add a cargo-workspace fixture to the check-rsr-profile tests. Re-pin canon.lock in the same release as #1125. +** Haiku/sonnet, S. +. *RISK:* canon release. + +==== #1229 — TEMPLATE-APPLICABILITY-POLICY baseline still requires 0-AI-MANIFEST.a2ml while the template retired .a2ml +. labels governance, refactor, scaffolding | last 2026-10-11 | 0 +. *LITERAL:* make the baseline rows and policy agree with the retirement (deed alternatives, or retire the rows), and name the authority of record. +. *GOLDEN:* the authority is already ruled. D312 says one `_chora.deed` per repo replaces the descriptiles and manifest, and CLAUDE.md says no `.a2ml` may be created. Keeping `0-AI-MANIFEST.a2ml` mandatory makes the canon *require* a forbidden file. The sensible reading is to replace the rows with deed equivalents: +** `_chora.deed`; +** an `(rsr-profile)` clause instead of `rsr-profile.a2ml`; +** descriptile clauses. +Keep a legacy `|…a2ml` alternative only during the kyX overlap. (`1-formats/deed/mappings/ai-manifest-decision.adoc` still says "DECISION REQUIRED (owner)" for the content mapping; D312 settles the *location*.) +. *MISCHIEF:* contradictory authorities. *Still exists*: +** `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc:104-106`; +** `template-capability-gates.toml:34`; +** rsr-template-repo has `rsr-template-repo_chora.deed` and zero `.a2ml` (find). +** *standards itself has no `standards_chora.deed`* (`git ls-files '*.deed'` shows only fixtures, launcher and provisioning), so the canon repo also fails its own D312 rule. +. *STATE:* not started. +. *DISPOSITION:* *BOT-DO* (canon bundle; the owner merges the release). +. Rewrite the baseline rows (`_chora.deed|0-AI-MANIFEST.a2ml`, etc.) in the toml and the policy adoc (both canon-locked: applicability sha256 at canon.lock:252). Update `check-rsr-profile.sh` (#1227). Separately, a follow-up BOT-DO (opus): author `standards_chora.deed` from `rsr-template-repo_chora.deed` as the worked model, without hand-converting the A2ML (D313). Write fresh facts only. +** Sonnet, M. +. *RISK:* canon release. Do not bulk-convert A2ML (D313). + +==== #1230 — Rule estate-chora UUIDv8 profile-C preimage/alias before launcher emission cutover +. labels none | last 2026-10-11 | 0 +. *LITERAL:* the owner registers the exact profile-C `domain:name` preimage for the canonical estate chora and states how it aliases or supersedes `#u5"estate/chora"`; deed and prose move in lockstep with fixtures; launch-scaffolder then changes new emission only. +. *GOLDEN:* fine. D333 (#1234 comment) explicitly says "aliasing remains #1230's question". +. *MISCHIEF:* generators must not invent IDs. *Still exists*: `launcher/launcher-standard_praxis.deed:20` `:beholding-chora #u5"estate/chora"`; deed.abnf v1.1.0 admits `#u8`. +. *STATE:* awaiting ruling. +. *DISPOSITION:* *OWNER-RULING.* Question: "Register `#u8"gv-clade-index:estate/chora"` (or a named alternative) as the canonical estate-chora preimage, with `#u5"estate/chora"` readable as an alias until a stated retirement date?" Yes or no, and the preimage string. E arm: a single registration in gv-clade-index (D320 says clade IDs derive there). +. After the ruling: sonnet, S (deed lines, fixtures, ADR-008 note). Then launch-scaffolder. +. *RISK:* identity change. Never invent the preimage. + +==== #1234 — Owner decision sheet D332+ (successor to #787): open rows and execution queue +. labels meta:umbrella, governance, priority:p1, scope:estate, status:needs-owner, decision | last 2026-10-13 | 1 (D333–D334) +. *LITERAL:* the sole rulings register after the workstation wipe. Next free ID *D335*. D297 and D315 are lost. D321/D322 are recovered from julia-professional-registry ADR 0003. +. *GOLDEN:* not for disposal; summary below. +. *Open decisions (section B):* +** *D304:* which host takes the encrypted off-GitHub mirror-bundle store (open since 10-06; the wipe is a live instance of the risk). +** *D332:* Probot Settings app (id 1561, installation 145157322) IS installed, so D13's precondition is false. Keep the app and its `.github/settings.yml` files, or uninstall and then delete the files? (E) = uninstall, then delete; rulesets are the single owner. +. *Execution queue (section A; ruled, not executed):* +** *A1, D16:* remove the bypass for apps 1561 and 946600 from every ruleset. Needs admin:org; census with `bypass_actors`. +** *A2, D14:* ClusterFuzzLite `cflite_*` census with a has-real-targets verdict; delete stubs. Bot-able: read-only census plus deletion PRs, sonnet. +** *A3, D24:* classify Pages across 48 repos; delete docs-only Pages workflows (docs go to BerryWiki, D295); hand the real-site list to Jonathan. Bot-able, sonnet. Enablement is UI-only. +** *A4, D97:* transfer-candidate census with per-repo cost. Bot-able, read-only. +** *A5, D298:* revert metadatastician Branch-Floor 23868655 and Tag-Floor 23868851 to canon. Needs admin:org, a blast-radius list and a dry-run PUT. Branch-Floor still has 4 rules (10-13). +** *A6, D67 (rev.):* the 9 Marid Tier-1 packages also go to General with the same UUIDs (UUIDv8 profile T, D322), after a local RegistryCI AutoMerge guideline run. Note that D224's proposed General date was *2026-10-14* (today), gated on the bunx launcher PR, which landed as #1100. +** *A7, D330:* Jonathan checks GitLab for a private canonical-ums copy. +** *Comment (D333/D334):* kcq → kyq and kcX → kyX, executed (standards #1237, template #234, 7 derived CLAUDE.md copies, boj-server #364, QuantumCircuit.jl #42). Owner follow-up: rename the GitLab and Bitbucket mirror repos `metadatastician/kcq` → `kyq`. +. *DISPOSITION:* *KEEP-OPEN-BLOCKED* (it is the register). Blocked on the owner for D304 and D332, and on admin:org for A1/A5. +. Bot-able now: A2, A3 and A4 censuses (sonnet, M each) and the A6 guideline dry-run (sonnet, S). New rulings from this triage, if any, book from D335. +. *RISK:* A1/A5 are org ruleset writes. A2/A3 delete workflows across repos. diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-633-910.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-633-910.adoc new file mode 100644 index 000000000..789fbd2a6 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/issue-triage-633-910.adoc @@ -0,0 +1,915 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Issue triage B: #633 to #910 (59 issues) +:toc: left +:toclevels: 2 + + +Triaged 2026-10-14 against `standards@7d2041a` (local checkout), `rsr-template-repo@64787ae`, +`hypatia@4be38c8`, `.git-private-farm@dd45a63`. Every issue body and every comment was read via +`issue_read get` and `get_comments`. The #787 rulings ledger (body plus all 70 comments) and the +#1234 successor were also read, so that rulings already made are applied, not re-asked. + +Conventions: "last activity" = issue `updated_at` (most of the backlog shows a 2026-09-30 label +sweep, so the last substantive comment date is also given). Tier = cheapest model that can do it +safely: haiku (mechanical), sonnet (ordinary coding), opus (judgement or cross-repo). + +=== Facts that change many dispositions (verified this session) + +* *The applier App credential does not exist.* `config/README.adoc:349-352` says standards holds no +`vars.APP_ID` and no `secrets.APP_PRIVATE_KEY` (decision O11). PR #1208 (10-08) says neither slot +is set. So `dependabot-lock-regen.yml`, `apply-workflow-pins.yml` in fix mode and +`signed-push-smoke.yml` are inert. Their runs finish in about 20 s, green, having done nothing. +The weekly drift tracker #803 shows the result: 15 → 124 → 149 → 163 drifted repos. +* *The owner workstation was wiped on 2026-10-13.* Every issue whose evidence or defect lived only +on local disk is now moot: `hyper-repos/`, `_SET` trees, `developer/.claude/checkpoints/`, +`MEMORY-RULINGS.md`, local hooks. #903–#910 cite `developer/.claude/checkpoints/2026-09-22-*.md` +as their source, and those files are gone. +* *#787 rulings that apply to this set:* D8(a) #662 retire. D10(a) #658 publish, with (b) +git-path as stopgap. D31(E), D32, D34(E), D35, D36, D48(a). D139 #895. D164 #659. D165 #732. +D166 #759. D65 #887. D246/D262/D263/D271 (licence classes). D256 (CodeQL default setup). D260, +D261, D269. D278c (delete the rhodibot sed step). D300. D313 (kyX, no agent a2ml sweep). + +''' + +==== #633 — [umbrella] Estate control plane: close the automation loop +. Labels: meta:umbrella, cicd, priority:p1, scope:estate, status:needs-ruling. Last activity 2026-09-30 (label sweep; body 08-25). 0 comments. +. *LITERAL:* Wire the merge actuator (`actuate.sh`). Unify the census. Re-pin 1,152 references to standards HEAD. Arm hypatia baselines. Turn findings into issues. Propagate rulesets. Mirror the estate beyond 23 repos. +. *GOLDEN:* Not absurd. But the child "after a week of reviewed manifests, wire actuate" was ruled on 09-23: *D36*, wire it behind the D34 dispatch-only guard. So the `status:needs-ruling` label is stale. +. *MISCHIEF:* Policy fixes made in standards never reach callers, and no merge path exists. *Partly still present.* +** `.git-private-farm/.github/workflows/merge-observe.yml:184` still prints "actuate.sh remains deliberately unwired". +** The scheduled pin applier `standards/.github/workflows/apply-workflow-pins.yml` (#809, STD-R-3) exists for child 3. Its fix mode needs the applier App, which does not exist (`config/README.adoc:349`). +** Ruleset floors were applied estate-wide by D215/D216/D233 (252–366 repos, per #787 comment of 2026-09-30). That covers child 6 in large part. +** Child 7 (mirroring) was ruled as D261: the owner provisions the forges. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) Owner creates the applier App and sets `vars.APP_ID` and `secrets.APP_PRIVATE_KEY` on standards (O11). This is the precondition for children 3 and 5. +** (b) In `.git-private-farm`, add a separate `merge-actuate.yml`. It is `workflow_dispatch` only, carries a per-run cap, uses a repository-variable kill switch, and defaults to dry-run (D36 + D34). +** (c) Child 2: nominate one census, `reposystem/repos.toml` or a generated file, and add a scheduled regeneration. +** (d) Re-scope this umbrella into children that are still open: 1, 2, 4, 5 and 7. +** Landing repos: .git-private-farm, reposystem, hypatia, standards. Effort L. Tier: opus. +. *RISK:* Outward-facing, unattended mutation. Gate it behind the D34 guard. + +==== #634 — [umbrella] Template family rationalisation: variant packs, not variant repos +. Labels: meta:umbrella, scope:estate, tech-debt, design, priority:p3. Last activity 09-30 (body 08-25). 0 comments. +. *LITERAL:* Collapse the variant repos into packs and define five base forms. Retire `rhodium-standard-repositories/templates/`. Decide between building scaffoldia's composer and reviving the Haskell engine. Fix the dead `.gitmodules` entries. +. *GOLDEN:* Two children now read absurdly. +** Child 3 says delete the rsr templates, and child 5 says fix rsr `.gitmodules`. Both now live under `9-archive/rhodium-standard-repositories/`, which is the LAST COPY ("ARCHIVE, do not delete"). +** The `.gitmodules` file there is nested, so git never reads it and it is inert. +** Sensible reading: leave the archive alone. Only children 1, 2 and 4 remain. +. *MISCHIEF:* A whole repo is maintained for a six-file delta, and two half-tools exist. *Still present.* +** D35 (09-23) ruled: build scaffoldia's composer, and the Haskell engine stays down. +** `hyperpolymath/scaffoldia` is live (pushed 2026-10-12). Composer status was not verified here. +. *STATE:* Not started for the substance. Children 3 and 5 are moot. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** In scaffoldia: write the composer ADR. Encode the Julia six-file delta as a "language-library" pack. Add a `gh repo create` path, `workflow_dispatch` only (D34). +** Delete the variant repo only after the pack mints an equivalent repo. +** Landing: scaffoldia, rsr-julia-library-template-repo. Effort L. Tier: opus. +. *RISK:* Licence. Six scaffoldia harvested-registry templates carry PMPL metadata, and `julia/package.ncl` is one of them. That is flag-only; the owner reviews per file. + +==== #635 — [umbrella] Surface the buried projects (DYADT; detector) +. Labels: meta:umbrella, scope:estate, tech-debt, priority:p3. Last activity 09-30 (body 08-25). 0 comments. +. *LITERAL:* Extract DYADT from `patallm-gallery` into a new repo and reconcile it with the spec. Decide on `idris2-dyadt`. Add a hypatia rule for "RSR project nested inside an unrelated repo". Record the corrections for estate-audits, verisimdb-data and the a2ml destination. +. *GOLDEN:* Child 6 (move the a2ml *product* to `a2ml-ecosystem`) is now moot, because A2ML is retired (D99/D313). The spec moved to `1-formats/sub-specs/did-you-actually-do-that/` (the `standards/did-you-actually-do-that/` path in the body no longer exists). +. *MISCHIEF:* Projects are invisible inside unrelated repos, and registries name phantom repos. *Still present.* +** `list_repos` finds no `did-you-actually-do-that` repo. +** hypatia has no nested-project rule. The sibling `implementation-inside-canon` / HYP-S009 was retired on 10-09. +** D32 (09-23) ruled: rewrite DYADT against the reference-verifier spec, with no unattended mint. +. *STATE:* Not started. Children 4 and 5 were record corrections and are done. Child 6 is moot. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) Owner mints `hyperpolymath/did-you-actually-do-that` by hand (D34). +** (b) Rewrite against `1-formats/sub-specs/did-you-actually-do-that/spec/*` and pass `run-conformance.sh`. Retarget #462. +** (c) Add a hypatia rule: a subdirectory carrying `Justfile` + `.machine_readable/` + `ROADMAP.adoc` + `Containerfile` under a parent with a different identity. +** (d) Script a phantom check that compares `reposystem/repos.toml` with the live repo list. +** Landing: new repo, hypatia, reposystem. Effort L. Tier: opus. +. *RISK:* Repo creation is an owner action. + +==== #636 — [charter] git-logistics-office: estate control plane (repo lifecycle) +. Labels: meta:umbrella, scope:estate, design, priority:p3. Last activity 09-30 (body 08-25). 0 comments. +. *LITERAL:* Charter a new orchestrator for repo birth, enrollment, life and death. Phase 1 is enrollment through `workflow_dispatch`. +. *GOLDEN:* Not absurd. Its "owner decision" prerequisite was ruled as *D34(E)*: no unattended repo creation, and a dispatch-only phase 1. +. *MISCHIEF:* Nothing owns the repo lifecycle, so new repos join no census, mirror, ruleset or baseline. *Still present.* `list_repos "logistics"` returns nothing. +. *STATE:* Not started. +. *DISPOSITION: KEEP-OPEN-BLOCKED.* Blocked on: the owner minting the repo; #633's census child; and the applier App credential (O11). +. Not applicable until unblocked. Phase 1 would then be sonnet, size M. +. *RISK:* Outward-facing and mutating. Dispatch-only per D34. + +==== #645 — Fix the scaffold that propagates "License: PMPL-1.0-or-later" (runbook §7a) +. Labels: scope:estate, tech-debt, priority:p2, status:ready. Last activity 09-30 (last comment 09-21). 6 comments. +. *LITERAL:* Find the generator of body-text `License: PMPL` lines, fix it, re-propagate, then clean the residue. +. *GOLDEN:* Not absurd. But "re-propagate and clean the residue" is a licence-text edit, which agents may only flag. +. *MISCHIEF:* The generator kept re-seeding a retired licence line. *Source cured; residue remains.* +** rsr-template has been clean since 05-22. +** PR #835 (`482c1feb`) fixed the template arm. developer-ecosystem#215 (the emitter) was merged 09-21. +** The scaffoldia harvested-registry files were left untouched by design. +** standards still has *18 files* containing `License: PMPL`, for example `1-formats/a2ml/*/README.adoc` ×6 and `2-protocols/axel/**/trust.txt` ×3. Five downstream repos carry it too. +. *STATE:* Partly done (source fixed). +. *DISPOSITION: KEEP-OPEN-BLOCKED.* The owner's licence rollout (D265/D270, with rewrite rules D278a–d) was *paused by owner re-selection* ("Stop — stay paused", D278 superseded, 10-01). The residue clean belongs inside that rollout. +. Not applicable. +. *RISK: LICENCE. Owner-only.* No sweep. + +==== #646 — AGENTIC.a2ml instructs agents "Never use AGPL", contradicting the licence rules +. Labels: governance, scope:estate, tech-debt, priority:p2. Last activity 09-30 (last comment 08-31). 2 comments. +. *LITERAL:* Find the emitter of `# - Never use AGPL license`, fix it, and re-sweep the AGENTIC.a2ml copies. +. *GOLDEN:* Yes, the literal reading is now partly absurd. +** `.a2ml` is retired, and D313/D43 say there is no agent a2ml sweep (kyX converts). +** The issue's premise "007 is AGPL" is overturned: D246/D262 flipped 007, 007-lang and echidna to MPL-2.0. +** Sensible reading: stop agents being told AGPL is banned, in whatever surface now carries the instruction. +. *MISCHIEF:* Agents are instructed to "correct" licences that should legitimately be AGPL (son-shared repos, games). *Still present, in a new carrier.* +** The standards sources are clean, and `rsr-template-repo_chora.deed:150` correctly says Rules 3/4/5 are AGPL. +** But `rsr-template-repo/.machine_readable/arrival-pack/arrival-pack.ncl:72,84` emits *"Deny: … AGPL"* and *"Never: … AGPL"* into every generated `CLAUDE.md`. The template's own CLAUDE.md, lines 54 and 66, shows it. +** About 170–185 repos still carry the a2ml line. +** Also: `3-practice/LICENCE-POLICY.adoc:144,266` still lists 007 under Rule 4 (AGPL), against D262 and the A1 out-of-scope section. +. *STATE:* Partly done. +. *DISPOSITION: OWNER-RULING.* Question: *"(1) May Claude change the rsr-template arrival-pack so generated CLAUDE.md files drop 'AGPL' from the Deny/Never lists and instead say 'never relicense; read LICENCE-POLICY Rules 1–5'? (2) For the ~170 legacy AGENTIC.a2ml copies: (a) a deletion-only removal of the one line now, or (b) leave it to kyX conversion with a mapping rule that drops it?"* +. If (1) is yes: a one-file change in `arrival-pack.ncl`, regenerated with `just claude-md`. Size S, sonnet. +. *RISK:* Licence-adjacent agent instructions. A bulk sweep only if (2a). + +==== #653 — 40 referenced-but-absent files across 19 repos +. Labels: scope:estate, tech-debt, priority:p2, status:ready. Last activity 09-30 (last comment 08-31). 4 comments. +. *LITERAL:* Fix scripts that read files which do not exist: repoint them, delete them, or author the docs. +. *GOLDEN:* The thread re-triaged several classes. +** Group 3 ("author 14 docs") was wrong: the `.adoc` twins exist. +** Group 4 ("delete Deno checks") was partly wrong. +** Sensible reading: about 31 refs across 15 repos, by repointing or decoupling. +. *MISCHIEF:* Gates that are permanently red or silently skipped because they name files that don't exist. *Partly still present.* +** asdf-tool-plugins#71 (merged 09-15) and developer-ecosystem#194 (merged 09-02) fixed group 3. +** standards' own entries are false positives. `apply-common-files.sh` is created by `scripts/tests/fill-placeholders-test.sh:16`. +** Remaining: group 2 (LICENSE.txt and LICENSE-PALIMPSEST.txt names), the `preference-injector` scorer, the `quandledb` hook gated on Deno, `continuation-mesh/guix-install.sh`, and the singles. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** Re-enumerate the remaining refs from remote default branches. +** One PR per repo. Repoint checks to `LICENSE`/`LICENSES/` and accept `.adoc|.md`. Decouple quandledb's AffineScript check from Deno. Fix excel-economic-numbers-tool's TPCF path. +** preference-injector's scorer needs new criteria, which is a policy call (flag it). +** Acceptance: each script's referenced paths resolve. +** Landing: about 15 repos. Effort M. Tier: sonnet. +. *RISK:* None. Licence files are only re-pointed, not edited. + +==== #657 — MEASURED: a lockfile policy kills 77% of dead workflows +. Labels: governance, cicd, priority:p1, scope:estate, research. Last activity 09-30 (last comment 08-27). 4 comments. +. *LITERAL:* Identify and settle the "lockfile policy" causing startup failures, then restore allowlists. +. *GOLDEN:* The research is concluded. The cause is GitHub Workflow Dependency Locking (preview), and a partial `actions.lock` is worse than none. The actionable work moved elsewhere: D38(a) (regenerate the lock, then pin), D39(a) (canon allowlist), #803, #669, #670, and `docs/decisions/2026-10-04-actions-lock-enforcement.adoc`. +. *MISCHIEF:* The CI startup-death cause was unknown. *Diagnosed.* The remediation lives in other issues. +. *STATE:* Done as research. +. *DISPOSITION: CLOSE-SUPERSEDED(#803).* #803 is the live lock-drift tracker. +. Not applicable. +. *RISK:* None. + +==== #658 — Deno→Bun: 30 deno.json; 18 blocked on npm packages that don't exist +. Labels: priority:p1, migration, scope:estate, chore, packaging, status:blocked. Last activity 09-30 (last comment 09-14). 4 comments. +. *LITERAL:* Resolve the phantom `affinescript` npm packages (publish, git-path, or restore rescript), then migrate the deno.json locations to Bun. +. *GOLDEN:* Arm (c), "restore rescript", is now absurd: ReScript is banned (#787 sheet repair). The sensible reading is the ruled one: *D10(a)* publish a real affinescript CLI; *(b)* git-path as stopgap. +. *MISCHIEF:* Builds are red under every runtime, and Deno is still in use. *Still present.* +** 2 live phantom manifests remain: `ambientops/broad-spectrum`, `civic-connect/indieweb2-bastion`. +** 13 repos lost `deno.json` with no Bun manifest (deletion-as-migration). +** The propagation vector is tracked in #704. +. *STATE:* Ruled (D10). Execution not started. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) Owner or affinescript maintainer publishes the CLI (D10a), via `bun publish` plus provenance as in D302. +** (b) Meanwhile, repoint the two live manifests to `git+https://github.com/hyperpolymath/affinescript` specifiers. +** (c) Per repo: add `package.json` + `bun.lock`, port HTTP imports and `Deno.*` calls, and delete `deno.json`. +** Keep the `proven/bindings/deno` carve-out. +** Acceptance: `bun install && bun test` is green, with no `deno.json` outside the carve-out and `.machine_readable/deno-allow.txt`. +** Landing: about 15 repos. Effort L. Tier: sonnet. +. *RISK:* None. + +==== #659 — Language policy duplicated into ~372 per-repo CLAUDE.md files +. Labels: governance, priority:p1, scope:estate, tech-debt. Last activity 09-30. 1 comment (D164). +. *LITERAL:* Choose pointer, generated copy, or status quo. +. *GOLDEN:* Ruled as *D164*: per-repo CLAUDE.md carries a *pointer*, never a duplicated copy. +. *MISCHIEF:* Policy duplicated into hundreds of copies drifts. *Still present.* +** The template generator `rsr-template-repo/.machine_readable/arrival-pack/arrival-pack.ncl` still embeds a condensed copy ("Estate language policy … Deny: Nix, Python, Go, TypeScript, Deno, ReScript, AGPL"). +** That copy has already drifted. It mixes licence (AGPL) into the language list, and see #646. +** `cicd-squabbler/CLAUDE.md` carries a garbled copy ("Deny: Guix, Node/npm… (Guix, not Guix)"). +. *STATE:* Ruled, not implemented. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) In rsr-template-repo, change `arrival-pack.ncl` so the policy section is a 2-line pointer to `standards/.claude/CLAUDE.md` and `3-practice/LANGUAGE-POLICY.adoc`, plus repo-local overrides from the deed. Keep `validate-claude-md` green. +** (b) Regenerate per repo through the arrival-pack (`just claude-md`), never by sed. +** Acceptance: no repo CLAUDE.md contains a BANNED table. +** Landing: rsr-template-repo, then about 131 repos. Effort L. Tier: sonnet. +. *RISK:* A bulk edit of agent instructions. Do it only through the generator. + +==== #662 — wordpress-tools PR #57 deleted 108 source files and added nothing +. Labels: bug, governance, priority:p1, status:needs-owner, scope:repo. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Owner decides whether the purge was a retirement. Explain `git_corrupted/`. +. *GOLDEN:* Ruled as *D8(a)* (09-23): retire/archive. +. *MISCHIEF:* A deletion was scored as a migration. *Still present.* `hyperpolymath/wordpress-tools` is unarchived, pushed 2026-10-13, and still carries `.git_corrupted/` (wordpress-tools#66) and 15 orphan `.res.js` files (#67). +. *STATE:* Ruled, not executed. +. *DISPOSITION: ESTATE-CAMPAIGN* (small) +. Steps: +** One PR in wordpress-tools: remove `.git_corrupted/` and the 15 orphan `.res.js`. Add a RETIRED status banner and a decision note citing D8 and `2966736^` as the recovery point. Mark `[mass-delete-ok]` if more than 50 files. +** Then the owner archives the repo (admin action). +** Effort S. Tier: haiku. +. *RISK:* Destructive. 246 files, but recoverable from history. + +==== #663 — TypeScript retirement measured: 308 of 613 .ts were never exempt +. Labels: governance, migration, scope:estate, research, priority:p2, status:ready. Last activity 09-30 (last comment 08-27). 2 comments. +. *LITERAL:* Retire every TS exemption (owner, 08-27: "literally none"). The plan: an ABI→`.d.ts` generator, porting the 308 files, and retiring the rescript fork after the port. +. *GOLDEN:* Not absurd. But canon still contradicts the ruling. +** `.claude/CLAUDE.md` keeps the "TypeScript Exemptions (Approved)" table, flagged "Not resolved unilaterally". +** `3-practice/LANGUAGE-POLICY.adoc` §1 says Bun has "Native TypeScript execution". §1.2 says TS is permitted "only where AffineScript cannot reach", which CLAUDE.md calls too permissive. +. *MISCHIEF:* TypeScript persists, and the exemption table is the wrong lever. *Still present.* +. *STATE:* Not started. AffineScript self-hosting (#446) is partly done: affinescript-deno-test reached 100% `.affine` (CLAUDE.md 08-31). +. *DISPOSITION: OWNER-RULING.* Question: *"Does the 08-27 'retire every exemption' ruling mean restating the CLAUDE.md table as 'no new TypeScript; listed carve-outs are debt with unblock conditions' (and deleting 'Native TypeScript execution' and the §1.2 permission from LANGUAGE-POLICY), and should the Idris2-ABI→declaration/binding generator (110 files) be the first build?"* +. Afterwards: the docs edit is S (sonnet); the generator is L (opus); the 308-file port is L (sonnet, per repo). +. *RISK:* The upstream-fork classes (`rescript/`, `linguist/`) are third-party. Do not edit. + +==== #664 — 43% of estate .affine files are 200-byte Harvard Engine stubs +. Labels: priority:p1, scope:estate, tech-debt, status:needs-owner, conformance. Last activity 09-30 (last comment 08-31). 2 comments. +. *LITERAL:* A completion metric that deletion cannot satisfy; a decision on the 3,138 stubs; a Debtfile entry or hypatia rule. +. *GOLDEN:* Ruled as *D48(a)*: declare stub debt per repo, with status-banner READMEs. Caveat: "Debtfile" is `.a2ml` (`.machine_readable/Debtfile.a2ml`). Under A2ML retirement, new debt must go in the deed `(bot-directives (debt))` clause, not a new a2ml fact. +. *MISCHIEF:* Absence of source is scored as completion. *Still present.* hypatia has no stub rule; `grep Harvard lib` hits only an unrelated comment in `blackboard.ex`. +. *STATE:* Ruled, not executed. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) hypatia rule: `.affine` with fewer than 10 non-comment lines, or containing `Ported via Harvard Engine bulk-processor` → finding, with comment-aware tests. +** (b) Per affected repo (panll, rescript, developer-ecosystem, affinescript, ssg-collection, proof-burrower, …): a deed `(debt …)` entry plus a README status banner. +** (c) Campaign metrics must count non-stub `.affine` files. +** Landing: hypatia plus about 158 repos. Effort L. Tier: sonnet. +. *RISK:* None. It is a bulk README edit, but banners only. + +==== #668 — gh search/code silently undercounts; adopt enumerate-then-filter as doctrine +. Labels: scope:estate, research, automation, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Write the measurement doctrine, a count-without-denominator check, and `scripts/estate-census.sh`. +. *GOLDEN:* Not absurd. It is more urgent now: the doctrine cited elsewhere as "AGENTS.md §5" lived in the workspace AGENTS.md on the wiped workstation. `standards/AGENTS.adoc` (32 lines) has none of it. +. *MISCHIEF:* Wrong estate counts in issues. *Partly still present.* `scripts/sweep-classifiers/README.adoc:45-88` documents the 3-layer undercount and `list-workflow-paths.sh`, but only for workflow files. There is no general doctrine and no general census script. +. *STATE:* Partly done. +. *DISPOSITION: BOT-DO* +. Steps: +** Add a "Measurement" section, either `3-practice/MEASUREMENT.adoc` or an AGENTS.adoc section, covering: +*** enumerate, then filter; +*** state the denominator; +*** the `truncated` flag; +*** exclude vendored paths; +*** the `gh api` 404-on-stdout trap; +*** `--paginate` on check-runs; +*** from #750: `git ls-files --deleted`, never `git status`; +*** print empty-index and unreadable counts. +** Generalise `scripts/sweep-classifiers/list-workflow-paths.sh` into `scripts/estate-census.sh `, with a test. +** Land in standards. Effort S–M. Tier: sonnet. +. *RISK:* None. + +==== #669 — Orphaned/phantom action pins still live: dtolnay ×35, trufflehog ≥20, codeql ≥14 +. Labels: bug, cicd, priority:p1, scope:estate, status:ready. Last activity 2026-10-01. 3 comments. +. *LITERAL:* Repin the orphan and phantom SHAs estate-wide, sweep for others, and add a "SHA reachable from a ref" gate. +. *GOLDEN:* Not absurd. D256 (CodeQL moves to default setup and `codeql*.yml` is retired) makes the codeql-action repins moot wherever `codeql.yml` is retired instead. +. *MISCHIEF:* Unresolvable pins break lockfile generation and kill workflows. *Partly still present.* +** The gate is *done*: `scripts/check-action-pins-resolve.sh` is wired at `governance-reusable.yml:1399`, including ancestry probes (#832, `72983342`). +** standards' own tree is clean (none of the four SHAs appear). +** Stragglers remain: about 28+14 repos (rust-toolchain), about 20 (trufflehog), and ai-cli-lab, info and cut-calculus (codeql, 10-01). +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** Per repo, replace the pin and regenerate the lock (D326 shape): +*** `4be9e76f`/`6d981790` → rust-toolchain v1 `6c977a6ca407…` +*** `8a8ef852` → trufflehog v3.97.1 `20652fbbdeff…` +*** `29b1f65c` → codeql v4.37.9 `cdf488f595d8…`, or retire `codeql.yml` per D256. +** The D4c precondition (bumpers assert ancestry, #1159) is met. +** Acceptance: `check-action-pins-resolve.sh` is clean on each repo. +** Effort M. Tier: haiku. +. *RISK:* None. + +==== #670 — Dependabot bumps uses: without regenerating actions.lock +. Labels: bug, cicd, scope:estate, priority:p3. Last activity 09-30. 0 comments. +. *LITERAL:* Close the gap: regenerate after Dependabot (A), stop bumping actions (B), add a CI gate (C), or monitor (D). +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Every lock-bearing repo can be bricked by a routine bump. *Still present in effect.* +** (A) was built: `.github/workflows/dependabot-lock-regen.yml` + `scripts/regen-dependabot-locks.sh` (#1123 `56b767ff`, #1199 `2f9d0be5`). +** (C) exists: governance "Actions lockfile verify" (`governance-reusable.yml:1410`). +** But (A) is *inert*. Its App credential is absent (`config/README.adoc:349`), runs finish green in about 20 s, and the last run was 10-08. #803 shows drift growing from 15 to 163 repos. +. *STATE:* Built but inert. +. *DISPOSITION: KEEP-OPEN-BLOCKED.* Blocked on the owner creating the applier App and setting `vars.APP_ID` + `secrets.APP_PRIVATE_KEY` (O11). +. After unblock: a dispatch run with `dry-run`, then live. Size S, haiku. +. *RISK:* None. + +==== #674 — Scorecard PinnedDependencies is wrong for lockfile-enforced repos +. Labels: bug, cicd, scope:estate, priority:p3. Last activity 09-30 (last comment 08-29). 1 comment. +. *LITERAL:* Owner ruling: raise it upstream, do not work around it. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* False "unpinned" alerts on lockfile repos. *Still present upstream.* The upstream reports were filed 08-29: ossf/scorecard#5207, github/codeql#22464, codacy/codacy-analysis-cli#558. +. *STATE:* Done. The deliverable, the escalation, is complete. +. *DISPOSITION: CLOSE-DONE.* Note the upstream links in the closing comment, and reopen if upstream asks for data. +. Not applicable. +. *RISK:* Posting to third-party repos is owner-approved per item (D269d). Already done. + +==== #675 — Idris2 `postulate` misconception in civic-connect and ideas-to-alphas +. Labels: scope:estate, research, priority:p2, status:ready. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Cure 11 decl-position `postulate` sites (4 + 7) and add a hypatia lint. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Files are unparseable in Idris2 because of an Agda keyword assumption. *Still present* (re-verified 08-31; not re-checked here). hypatia has only a generic `agda_postulate` (`lib/rules/code_safety.ex:317`) and a postulate count (`proof_obligation.ex`). There is no Idris2 decl-position rule. +. *STATE:* Not started. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) `civic-connect/src/Abi/Layout.idr` (4 sites) and `ideas-to-alphas/research/tropical/TropicalKleene.idr` (7 sites). Replace each with an explicit OWED/trusted-base marker or a real body, and confirm with `idris2 --check`. Mirror the fix in the `bulk_update_oikos` vendored copy. +** (b) hypatia rule, regex `^\s*(public\s+)?(export|private)\s+postulate\b` plus bare decl-position. It must be comment- and string-aware, with a fixture. +** Landing: civic-connect, ideas-to-alphas, hypatia. Effort S–M. Tier: opus, because these are proof and trusted-base edits (Doctrine 4). +. *RISK:* None. Trusted-base edits need supervision. + +==== #677 — 13 repos have a damaged git object database +. Labels: priority:p1, scope:estate, chore, status:ready. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Recover reasonably-good-token-vault's 9 unpushed commits, re-clone the others, and add an fsck to the health sweep. +. *GOLDEN:* The literal reading is now absurd. All 13 were *local checkouts on the workstation wiped 2026-10-13*, so there is nothing left to repair. +. *MISCHIEF:* Local pack corruption. *Moot.* Anything unpushed is gone; the token-vault's 9 commits are recoverable only if they were pushed earlier. +. *STATE:* Moot. +. *DISPOSITION: CLOSE-MOOT.* In the closing note, record two rules for any rebuilt workstation: run an fsck/`ls-tree` health probe, and stop treating `[ -d .git ]` as a repo test. +. Not applicable. +. *RISK:* None. + +==== #678 — 132 repos track .gitignored files; template-sync left a silent fake gate in 29 +. Labels: priority:p1, scope:estate, chore, scaffolding. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Run a shadow-tracking detector, and fix `install-tools.sh` at the template. +. *GOLDEN:* The installer half was escalated to #702. The census numbers are from local trees that no longer exist. +. *MISCHIEF:* +** (a) Tracked files are hidden by `.gitignore`. This is a remote-observable class, still present: 61 repos as of 08-31. +** (b) `install-tools.sh` installs nothing and exits 0. Still present (see #702). +** `rsr-template-repo` itself has 0 shadowed tracked files (verified). +. *STATE:* Partly done. 143 → 45 tool-versions shadows. +. *DISPOSITION: ESTATE-CAMPAIGN* for the shadow-tracking half. The installer half goes to #702. +. Steps: +** Add a governance or hypatia check, `git ls-files -ci --exclude-standard` non-empty → finding, with a fixture. +** Then fix per repo: untrack the file, or narrow the `.gitignore`. Decide case by case and never mass-delete. +** Landing: standards (gate) plus about 61 repos. Effort M. Tier: sonnet. +. *RISK:* Untracking is mildly destructive. Review each file. + +==== #681 — 342 of 415 repos cannot merge a clean PR without --admin +. Labels: enhancement, governance, cicd, priority:p1, scope:estate, status:ready. Last activity 09-30 (last comment 08-29). 1 comment. +. *LITERAL:* Per repo, reconcile ruleset-required contexts against the contexts actually emitted. +. *GOLDEN:* Not absurd. It has since been ruled: +** D259: required contexts nothing emits are repaired, or else dropped. +** D109: fix the 43 permanently blocking rulesets. +** D237/D243: every default-branch ruleset gets one required context, `scan / gitleaks`. +** D257: strip owner bypass where contexts are green. +. *MISCHIEF:* Unsatisfiable required contexts force `--admin`. *Partly present.* +** standards' own ruleset was repaired 08-29 (positive control #688). +** The tooling exists: `scripts/cicd-census.sh` (GraphQL, phantom-required finder) and `scripts/check-required-contexts.sh`. +** There has been no estate re-measure since 08-28. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** Run `scripts/cicd-census.sh` (read-only) and post the denominator. +** Apply D259/D109 per repo with before/after GET. +** Acceptance: the census shows 0 required contexts that nothing emits, and an unaided-merge rate is re-measured. +** Effort L. Tier: opus (rulesets are outward-facing). +. *RISK:* Admin API changes. Post the blast radius first (D300 add-before-remove). + +==== #687 — audit(hypatia): classify 61 SD022 + HYP-S009 findings +. Labels: scope:estate, research, automation, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Classify 45 SD022 and 16 HYP-S009 findings, with expiring baseline entries. +. *GOLDEN:* Half is now absurd. *HYP-S009 was retired with the registry on 2026-10-09* (`9d629d11`, #1213), so that half is moot. +. *MISCHIEF:* Unclassified medium findings sit in the baseline. *Partly present.* +** `.hypatia-baseline.json` holds 9 SD022 entries tracked to #687, expiring *2026-11-29*, plus 23 untracked SD022 "FALSE POSITIVE" entries. +** *17 of those SD022 entries point at `.md` files that no longer exist*, because they were migrated to `.adoc`. +** Baseline-wide, *43 of 189 entries point at missing files*, and *21 entries expire 2026-10-21*, one week out. +. *STATE:* Partly done. +. *DISPOSITION: BOT-DO* +. Steps: +** (a) Classify the 9 #687 entries (target-relative template vs stale path). Fix the stale paths and convert true false-positives to a narrow rule exemption for `docs/proofs/spec-templates/**`. +** (b) Prune baseline entries whose `file` no longer exists. That is debt reduction, which the ratchet allows. +** (c) Triage the 21 entries expiring 10-21 before they turn the gate red. +** Effort S–M. Tier: sonnet. +. *RISK:* None. Do not broad-exclude. + +==== #689 — fix(rsr-certifier): complete or honestly gate the uncompilable satellite +. Labels: bug, scaffolding, priority:p2, status:ready, scope:repo. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Make the rsr-certifier Rust workspace compile, or gate the unfinished adapters honestly. +. *GOLDEN:* The literal reading is now absurd. The satellite is in `9-archive/rhodium-standard-repositories/satellites/rsr-certifier`, the LAST COPY archive ("do not delete"). No workflow builds it, and editing it would violate the archive's frozen status. +. *MISCHIEF:* Scaffolding presented as an implementation. *Moot*, because it is archived and not presented as live. +. *STATE:* Moot. +. *DISPOSITION: CLOSE-MOOT.* If the owner wants a certifier, it is a new repo built on scaffoldia (#634), not an archive edit. +. Not applicable. +. *RISK:* Do not edit the archive. + +==== #692 — policy: Rust = Rust + Creusot, without proof theatre +. Labels: governance, scope:estate, chore, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Central policy plus a reusable gate requiring Creusot verification for all first-party Rust. +. *GOLDEN:* It contradicts current canon. `.claude/CLAUDE.md` says "Rust always means Rust/SPARK" (2026-04-10). `grep -ri creusot` across the whole tree returns 0, and `3-practice/LANGUAGE-POLICY.adoc` has no Rust-verification row. The 09-29 ultraplan (`f428562b`) filed #692 under DECIDE (estate scope). +. *MISCHIEF:* Rust correctness claims have no verifier. *Still present.* +. *STATE:* Not started. +. *DISPOSITION: OWNER-RULING.* Question: *"Is the estate Rust verification stance SPARK (per CLAUDE.md 'Rust/SPARK'), Creusot (per #692), or both with defined scopes — and should standards ship a reusable verifier gate with a planted failing contract now?"* +. Not applicable until ruled. +. *RISK:* None. + +==== #698 — Banned languages in dev-environment definitions (guix.scm ×14, mise.toml) +. Labels: governance, priority:p1, scope:estate, status:needs-owner. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Owner decides whether dev-env definitions are exempt from the language ban. +. *GOLDEN:* Not absurd. Canon leans one way already: +** `.claude/CLAUDE.md` says Python is "Fully banned, no exceptions". +** `rsr-template-repo/mise.toml` now ships `just/shellcheck/trivy/zig` only, commented "no python, deno, node/npm/yarn, make or nix here". +** D292 and D293 removed Python tooling elsewhere. +. *MISCHIEF:* Banned toolchains come in through dev shells. *Still present.* The scale is in #706: 42 guix.scm files, python in 543/573 mise files, 59 deno pins. +. *STATE:* No ruling found in #787 or #1234. +. *DISPOSITION: OWNER-RULING.* Question: *"Are guix.scm dev-shells and mise toml files bound by the language ban? Recommended: yes, no exemption (matches the template's own mise.toml); remediate by re-templating, deno pins first."* If yes, #706 executes. +. Not applicable. +. *RISK:* Touches upstream forks' dev shells. Exclude forks. + +==== #702 — install-tools.sh regenerated without the #678 cure (245/248 fake gates) +. Labels: bug, cicd, priority:p1, scope:estate, scaffolding, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Cure the template's `install-tools.sh` (mise branch, non-zero exit on no match), then re-sweep the copies. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The installer installs nothing and exits 0. *Still present at the source.* `rsr-template-repo/.machine_readable/scripts/lifecycle/install-tools.sh` @`64787ae` has Guix and asdf branches only, no mise branch, and the else-branch echoes and exits 0. Yet the template ships `mise.toml`. +. *STATE:* Not started. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) In rsr-template-repo: add a branch for `mise.toml`/`.mise.toml` (`mise install`). Make no-match `exit 1` with a loud message. Fix the docstring. Add `tests/` with an empty-dir case (must be non-zero) and a `mise.toml` case. +** (b) Re-template consumers through `launch-scaffolder provision-set realign`, not hand edits. +** Effort S (template) + M (estate). Tier: sonnet. +. *RISK:* None. + +==== #703 — Duplicate checkout trees double-count every estate census +. Labels: audit, scope:estate, tech-debt, priority:p2, status:ready. Last activity 09-30 (last comment 08-31). 1 comment. +. *LITERAL:* Declare one canonical local tree per repo, and dispose of the duplicates. +. *GOLDEN:* The literal reading is now absurd. The trees (`repos/`, `hyper-repos/`, `_SET`, `bulk_update_oikos`) were on the workstation wiped 10-13. +. *MISCHIEF:* Local-disk censuses double-count. *Moot.* The durable lesson, census from remotes by enumerate-then-filter, belongs in #668. +. *STATE:* Moot. +. *DISPOSITION: CLOSE-MOOT.* Cross-reference #668. +. Not applicable. +. *RISK:* None. + +==== #704 — examples/web-project-deno.json ships phantom npm:affinescript, replicated across ≥12 repos +. Labels: bug, scope:estate, scaffolding, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Fix or delete the `web-project-deno.json` template, then sweep the copies. +. *GOLDEN:* Not absurd. Deno is banned, so a "Deno example" has no place in canon at all. +. *MISCHIEF:* The scaffold re-seeds dead specifiers and banned tech. *Still present, and standards itself is a source.* +** standards carries *5 byte-identical copies* (md5 `4053351e…`) of a ReScript-plus-Deno example (`deno run -A npm:rescript`, `"rescript": "^12.0.0"`): +*** `2-protocols/axel/examples/web-project-deno.json` +*** `2-protocols/0-ai-gatekeeper/examples/web-project-deno.json` +*** `1-formats/a2ml/{anchor,agentic,ecosystem}/examples/web-project-deno.json` +** gitbot-fleet carries two more: `bots/{the-hotchocolabot,finishingbot}/examples/`. +. *STATE:* Not started. +. *DISPOSITION: BOT-DO*, at the standards source. The estate tail follows as part of #658. +. Steps: +** Delete the 5 standards copies. They are inside retired-format example directories, and deletion is allowed. Remove any README references. +** Then delete the gitbot-fleet copies and the ≥12 estate copies, one PR per repo. +** Acceptance: `find . -name web-project-deno.json` is empty in standards and the template. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #705 — proven: postulate cure not on origin/main (lived only as uncommitted local files) +. Labels: bug, priority:p1, status:ready, scope:repo. Last activity 09-30 (last comment 08-31). 2 comments. +. *LITERAL:* Commit and push the cure branch, and PR it onto main. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The cure was at risk of loss and main was unparseable. *Fixed.* +** Cure committed as `d2d57a0d`, then *proven PR #217 "Fix/idris2 totality and elaboration cures" merged 2026-09-17*. +** Follow-ups proven#228 and #229 merged 10-06. +** The leftover local working-tree audit is moot (workstation wiped). +. *STATE:* Done. +. *DISPOSITION: CLOSE-DONE.* +. Not applicable. +. *RISK:* None. + +==== #706 — mise.toml pins banned toolchains estate-wide (python 543/573; deno 59) +. Labels: priority:p1, audit, scope:estate, tech-debt, status:blocked. Last activity 09-30 (last comment 09-22). 1 comment. +. *LITERAL:* The inventory feeding #698. The deno pins are actionable now; the python pins wait on the ruling. +. *GOLDEN:* Not absurd. The template source is already cured: `rsr-template-repo/mise.toml` has no python/deno and a policy comment. +. *MISCHIEF:* Banned runtimes are pinned in dev toolchains. *Still present downstream.* For example, the -types family blob `6dd983f` pins `python` and `denojs`. +. *STATE:* Source done. Consumers not started. +. *DISPOSITION: ESTATE-CAMPAIGN.* The deno part now; the python, go, java and node part after #698. +. Steps: +** Per repo, re-mint `mise.toml` with `launch-scaffolder provision-set realign`, deno-pinning repos first. +** Acceptance: `git hash-object mise.toml` matches the template profile, and there is no `python`/`deno`/`denojs` key. +** Exclude forks. +** Landing: about 249 repos. Effort L. Tier: haiku (scripted re-mint). +. *RISK:* Bulk sweep. Must go through the generator. + +==== #707 — Phantom upload-artifact pin ea165f8d65b6db9a… (never existed) live in 11 repos +. Labels: bug, cicd, priority:p1, scope:estate, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Replace the mutant SHA with the healthy v4 pin in 11 repos, and look for sibling mutants. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* A phantom pin kills workflows at startup. *Partly present.* +** In standards it now appears only in `9-archive/rhodium-standard-repositories/examples/enterprise-service/.github/workflows/security.yml`. That copy is inert and baselined as `known_fake_action_sha` (#940). +** About 10 other repos are unverified. +** The resolve gate (`check-action-pins-resolve.sh`) now catches the class in governance callers. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** Per repo (asdf-tool-plugins, BowtieRisk.jl, Causals.jl, developer-ecosystem, Exnovation.jl, HackenbushGames.jl, maa-framework, patallm-gallery, PolyglotFormalisms.jl, wordpress-tools), repin to the current upload-artifact v4 SHA and regenerate the lock. +** Leave the archive copy alone. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #708 — Lockfile Drift Detect anonymises repos, miscounts, and only ran once +. Labels: bug, cicd, priority:p2, status:ready, scope:repo. Last activity 09-30 (comment 09-17). 1 comment. +. *LITERAL:* Fix the TSV writer and the counts, and schedule the workflow. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The detector was unactionable. *Fixed* by #826 (merged 09-17). +** `lockfile-drift-detect.yml` has cron `'20 7 * * 2'`. +** Scheduled runs on 09-22, 09-29, 10-06 and 10-13 all succeeded (latest run 38364814715). +** #803 is auto-updated with per-repo counts. +. *STATE:* Done. The only open item was "verify the re-run artifact". +. *DISPOSITION: CLOSE-DONE.* Optional one-minute check that the artifact shows real slugs: haiku. +. Not applicable. +. *RISK:* None. + +==== #727 — gh actions-lock fix mode prepends its banner above the SPDX header +. Labels: bug, cicd, priority:p1, scope:estate. Last activity 2026-10-01. 3 comments. +. *LITERAL:* Either relax the `head -1` SPDX gate, post-process fix runs, or fix upstream. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The tool and the gate fight over line 1. *Fixed at source, stale downstream.* +** The governance linter has read the leading comment block since `13cb62ac` (#597). +** The rsr-template `workflow-linter.yml` uses an awk block scan. +** standards' own workflows start banner-first (e.g. `changelog.yml` lines 1–3) and pass. +** Stale copies remain in callers (trope-checker, trope-particularity-workbench, phantom-metal-taste), along with pins older than `13cb62ac`. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) Census callers with a pre-fix local `workflow-linter.yml` or a governance pin older than `13cb62ac`, using enumerate-then-filter. +** (b) Propagate the template `workflow-linter.yml` (or delete it per the §5.2 fold into governance), and repin through `apply-workflow-pins.yml` (needs App credential O11). +** (c) Optionally file the upstream gh-actions-lock issue (option 3). That needs owner approval (D269d). +** Effort M. Tier: haiku/sonnet. +. *RISK:* None. + +==== #732 — AI-MANIFEST ply relay items after #731 +. Labels: priority:p1, scope:estate. Last activity 09-30. 2 comments (incl. D165). +. *LITERAL:* Five items: rename `cartridges/0.2-AI-MANIFEST.a2ml`; rename paint-type's manifest; wire `check-manifest-ply.sh`; the `0-plyN-` migration; the unit-relative ruling. +. *GOLDEN:* Partly absurd now. Items 1–4 rename or extend `.a2ml` files, which are retired. *D165*: items 1, 3 and 4 wait for the deed conversion, and item 5 is ruled (b) unit-relative. +. *MISCHIEF:* Wrong ply numbers, and an unwired gate. *Partly present.* +** Item 1 was resolved incidentally: the file moved to `1-formats/sub-specs/cartridges/0.2-AI-MANIFEST.a2ml` (#827, `cfbb6629`). `bash scripts/check-manifest-ply.sh .` now exits *0* (2 EQUAL, 3 UNIT-RELATIVE, 1 DRIFT-SHALLOW, 0 DRIFT-DEEP). +** Item 2 is in metadatastician/paint-type, a *son's repo* (D329: the merge is his). +** The family-7 mapping `1-formats/deed/mappings/ai-manifest-decision.adoc` is still "DECISION REQUIRED (owner)", although the 09-19 pilot applied option A. +. *STATE:* Partly done. +. *DISPOSITION: KEEP-OPEN-BLOCKED.* Blocked on the kyX deed conversion (D313/#837), per D165. +. Not applicable. Note in the issue that item 1 is resolved and the gate passes. +. *RISK:* paint-type is the son's repo. AGPL, his merge. + +==== #750 — Deletion census: use `git ls-files --deleted`, never `git status` +. Labels: scope:estate, research, priority:p3. Last activity 09-30. 0 comments. +. *LITERAL:* Adopt the rule, and dispose of the 45 empty-index clones. +. *GOLDEN:* The clone half is absurd now: those were workstation clones, wiped. The rule half is valid doctrine. +. *MISCHIEF:* False mass-deletion alarms. *Moot locally.* The rule is still unwritten in canon. +. *STATE:* Not started (doctrine). +. *DISPOSITION: MERGE-INTO(#668).* Fold it into the measurement doctrine. +. Covered by #668. +. *RISK:* None. + +==== #751 — Agent handover surface is lossy: .claude/checkpoints prunes files +. Labels: bug, priority:p1, scope:estate. Last activity 09-30 (comment 09-08). 1 comment. +. *LITERAL:* Stop the loss, and stop treating checkpoints as durable. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The root cause was the glob in `precompact-checkpoint.sh`, *fixed 09-08*. `developer/` is gone with the wipe, and #1234 now declares GitHub issues the only durable register. +. *STATE:* Done / moot. +. *DISPOSITION: CLOSE-DONE.* +. Not applicable. +. *RISK:* None. + +==== #759 — [decision] 72 of 111 rhodibot workflows still run the MUTATING variant weekly +. Labels: cicd, priority:p1, scope:estate. Last activity 09-30. 4 comments (incl. D166). +. *LITERAL:* Choose between finishing the canary migration, disabling, deleting, or leaving it running. +. *GOLDEN:* Ruled as *D166*: pause the 72 mutating crons now and remake them as the report-only canary. *D278c*: delete the AGPL→PMPL sed step. +. *MISCHIEF:* Unattended mutation, including an SPDX rewrite, on a cron. *Presumed still present.* Execution of D166 is not evidenced on any surface. The canary template is `rsr-template-repo/.github/workflows/rhodibot.yml`. +. *STATE:* Ruled, not evidenced as executed. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) Census the live `rhodibot.yml` variants (mutating = contains `gh pr create` or `sed -i`). +** (b) Per repo, replace with the template canary, byte-identical, and regenerate the lock. +** (c) The owner disables any not yet replaced; disabling is on the trust-deny list, but D166 authorises it. +** (d) The owner deletes the corrupt branches `rhodibot/rsr-compliance-20260831` and `-20260907` on the-nash-equilibrium. +** Landing: about 72 repos. Effort M. Tier: sonnet. +. *RISK:* Licence-adjacent. Removing a sed that rewrites SPDX is fine, but never re-run it. the-nash-equilibrium is a game (D263, AGPL). + +==== #791 — githooks: validate-a2ml admits 0/222, validate-spdx rejects every .adoc +. Labels: documentation, priority:p1, licensing, scope:repo. Last activity 09-30 (comment 09-19). 1 comment. +. *LITERAL:* Repair both validators against their corpora. +. *GOLDEN:* Not absurd. Its subject `validate-a2ml.sh` is gone (A2ML retired). +. *MISCHIEF:* Validators reject everything. *Fixed.* +** `.githooks/validate-a2ml.sh` is absent. +** `bash .githooks/validate-spdx.sh` in scan mode reports "118 of 714 source files are missing an SPDX header" (rs 36, yml 32, sh 18, toml 14, ncl 7, ex 6, js 4). `.adoc` is no longer rejected and `.json` is out of scope. +. *STATE:* Done. The residual 118 missing headers are a separate, flag-only matter. +. *DISPOSITION: CLOSE-DONE.* +. Not applicable. +. *RISK:* Adding SPDX headers to existing files is owner-only. No sweep. + +==== #792 — Pin-consumption census TSV has two extractor defects +. Labels: bug, scope:estate, priority:p2. Last activity 09-30. 0 comments. +. *LITERAL:* Regenerate `developer/.claude/checkpoints/22-pin-consumption.tsv` with fixed extraction. +. *GOLDEN:* The literal reading is now absurd. The TSV and script lived on the wiped workstation. +. *MISCHIEF:* Contaminated denominators. *Moot.* The live successor is the audit mode of `apply-workflow-pins.yml` (BEHIND/DEAD-REF/ILLEGAL census) plus `scripts/lib/pin-ancestry.sh` (#1159). +. *STATE:* Moot. +. *DISPOSITION: CLOSE-MOOT.* Carry the two extractor lessons into #668: split on `#`, and select the `uses:` that matches the reusable. +. Not applicable. +. *RISK:* None. + +==== #795 — 1,073 Optimus-Branch.json replicas are stale and weaker; design-doc pointer broken +. Labels: bug, governance, scope:estate, priority:p2. Last activity 09-30 (comment 09-14/15). 1 comment. +. *LITERAL:* +** Single-source the canonical ruleset and fix the §7.4 path. +** Stamp or remove the replicas. +** Make appliers refuse unstamped files. +** Resolve the case-duplicate pair. +. *GOLDEN:* Not absurd. The "1,073" count came from local disk (now wiped). Remote replicas exist but are uncounted. +. *MISCHIEF:* A stale weaker policy could be applied. *Partly present.* +** standards `config/rulesets/` is single-source: no Optimus-Branch.json (#789), no `Immutable-Tags.json` duplicate (#794). D300 adopted the layered scheme. +** Still broken: `docs/superpowers/specs/2026-09-02-cicd-regularisation-design.adoc:367` says `standards/rulesets/base.json`, which does not resolve. +** `rsr-template-repo/.github/rulesets/` copies are byte-identical to canon (base, branch-floor, linear, signed) and carry a "GitHub does not read this" README. But its `Immutable-Tags.json` *differs* from canon `immutable-tags.json`: different name, and bypass actors `[]` vs canon's two `always` actors. +. *STATE:* Partly done. +. *DISPOSITION: BOT-DO* +. Steps: +** (a) Fix the doc pointer to `config/rulesets/base.json`. +** (b) In rsr-template-repo, replace `Immutable-Tags.json` with the canon `immutable-tags.json`, or drop it. +** (c) Leave estate replica stamping to the D300 applier work. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #803 — lockfile drift: 163 repos as of 2026-10-13 (bot-maintained) +. Labels: cicd, scope:estate, priority:p2, status:ready, lockfile-drift. Last activity 2026-10-13. 5 comments (1 CodeRabbit, 4 bot re-sweeps). +. *LITERAL:* Fix listed repos: run `gh actions-lock`, then restore SPDX to line 1. +. *GOLDEN:* The fix advice in the body is stale. The SPDX gates now read the leading comment block (#727). The ruled method is *D326*: lock-only regeneration, workflow YAML byte-identical, one PR per repo. +. *MISCHIEF:* Dependabot drifts locks and workflows start-up-fail. *Still present and growing*: 15 (09-22) → 124 (09-29) → 149 (10-06) → 163 (10-13). The automated cure (`dependabot-lock-regen.yml`) is inert because it has no App credential. +. *STATE:* Not progressing. +. *DISPOSITION: KEEP-OPEN-BLOCKED.* Blocked on the owner applier App (O11). The issue is a live tracker and should remain. +. Bridge step that needs no App: an agent session can open D326 lock-only PRs from the artifact TSV. Effort L. Tier: haiku. Update the body template's fix text (S, haiku). +. *RISK:* None. + +==== #808 — RSR workflow templates use an illegal `uses: ../../` ref +. Labels: bug, cicd, priority:p1, scope:estate. Last activity 09-30. 0 comments. +. *LITERAL:* Replace the `../../` refs in templates; repair lol, deed-core, a2ml and k9-ecosystem; add a guard plus a mutant. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Dead workflows with 0 jobs. *Partly present.* +** The standards tree has *0* `uses: ../../` (fixed by #864, `000b9f6b`). +** `scripts/apply-workflow-pins-remote.sh` classifies ILLEGAL and repairs it under `--repair-illegal` (#809), but fix mode needs the App credential. +** *No guard* rejects `../` or `$/` in `uses:`. `.githooks/validate-actions-lock.sh` and governance have none. +** Sibling #913 covers the same class. `scripts/triage-2026-09-29-apply.sh` planned to close #808 into #913, which never executed. +. *STATE:* Partly done. +. *DISPOSITION: ESTATE-CAMPAIGN* +. Steps: +** (a) standards: add a `uses:` guard rejecting `^\.\./` and `\$/` to `scripts/check-actions-lock-gate.sh` (yq path) with a mutant fixture. +** (b) Repair lol, deed-core and k9-ecosystem `dispatch-templates/from-k9-svc/`, and a2ml once the owner lifts its hold. +** (c) Close #913 as duplicate (its in-repo half is done, 0 refs). +** Effort S–M. Tier: sonnet. +. *RISK:* None. + +==== #837 — DEED conversion campaign: tracking and acceptance criteria +. Labels: priority:p1, migration, scope:estate, status:needs-ruling. Last activity 2026-10-09. 15 comments. +. *LITERAL:* Run the `.a2ml`→`.deed` campaign: grammar hygiene, mapping specs, translator plus conformance lane, per-district conversion, acceptance greps. +. *GOLDEN:* The "canonical translator" step is now governed by D313: conversion is *kyX's first front end*, and `a2ml_to_deed.py` is to be deleted. Python is banned, and CLAUDE.md says not to use the Python converters. The sensible reading is to wait for kyX. +. *MISCHIEF:* A retired format is still the substrate. *Still present.* +** The tree holds 222 `.a2ml` and 26 `.deed`. *There is no `standards_chora.deed`*, so standards does not dogfood D312, and R5 increment 2 is blocked on it. +** `1-formats/deed/tools/` still ships `a2ml_to_deed.py`, `deed_lint.py` and `migrate_a2ml_to_deed.sh`. D323 keeps `deed_lint.py` frozen while `a2ml_to_deed.py` imports it, and D313 says delete. The two rulings are in tension. +** Ruled so far: §2 Option A (09-19); R1 is effectively done (single `deed.abnf`, D308); R5 (10-09, #1216). +** Still open: R2–R4 and R6–R11, including R10 (`ai-manifest-decision.adoc` still says DECISION REQUIRED). +. *STATE:* Partly done. +. *DISPOSITION: KEEP-OPEN-BLOCKED.* Blocked on the kyX first front end (D313) and on rulings R2–R4 and R6–R11. +. Bot sub-step available now (sonnet, S–M): author `standards_chora.deed` by hand from the rsr worked model, validated with `bun 1-formats/deed/tools/deed_lint.js`. This is authoring, not bulk conversion. +. *RISK:* No bulk hand-conversion (D313). + +==== #887 — D65: EstatePushing is an active org ruleset with zero rules +. Labels: scope:estate, priority:p2, status:ready, security. Last activity 2026-10-08. 3 comments. +. *LITERAL:* Give EstatePushing rules or delete it, and add a control that flags active rulesets with empty rules. +. *GOLDEN:* Not absurd. D65 ruled "give it real push rules". +. *MISCHIEF:* A vacuous ruleset. *AC1 met* (10-08 re-measure): EstatePushing has 3 rules, the EstateTagging condition was fixed, and 0 of 7 org rulesets are empty. *AC2 not met*: no control exists. +. *STATE:* Partly done. +. *DISPOSITION: MERGE-INTO(#890).* #890's enforced-rules control subsumes AC2, and that issue says so. +. Covered by #890. +. *RISK:* None. + +==== #888 — secret-scanner-reusable stages the estate baseline unconditionally +. Labels: bug, cicd, priority:p1, scope:estate, status:ready. Last activity 2026-10-02. 1 comment. +. *LITERAL:* Delete "path 1" (the unconditional fetch and stage). +. *GOLDEN:* *The literal fix is wrong.* `secret-scanner-reusable.yml:169-176` now explains that path 1 is "UNGATED ON PURPOSE… Do not delete". It is the only thing that creates `.gitleaks-estate.toml` for consumers with no `.gitleaks.toml`, whose `CONFIG` resolves to that file (L308). The sensible reading: stop the file existing in the workspace when a consumer has its own config that does not reference it. +. *MISCHIEF:* The scan flags its own staged baseline and reddens consumers. *Still present.* +** Steps at L190–218 remain ungated. +** `config/gitleaks/estate-baseline.toml` lines 136 and 147 duplicate the self-exclusion, which is `(^|/)`-anchored rather than root-anchored. +** boj-server-cartridges' required context is blocked (10-02). +. *STATE:* Not started. +. *DISPOSITION: BOT-DO* +. Steps: +** Stage the baseline to `$RUNNER_TEMP/estate.toml`. For no-local-config consumers, set `CONFIG="$RUNNER_TEMP/estate.toml"`. Copy into the workspace only when path 2 says the baseline is referenced. +** Dedupe and root-anchor the self-exclusion. +** Add `test ! -e .gitleaks-estate.toml` before the gating scan in the unreferenced case. +** Tests: three consumer shapes, each with planted AWS/ghp_/OpenSSH secrets that must fail, on gitleaks 8.18.4. +** Effort M. Tier: sonnet. +. *RISK:* None. This is a security gate: keep non-vacuity. + +==== #889 — 22 hyperpolymath repos have blank descriptions (5 public) +. Labels: scope:estate, tech-debt, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Write accurate descriptions and topics, public ones first, without inventing. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Undiscoverable repos. *Presumed present*; not re-measured, because the gh CLI is unauthenticated here. +. *STATE:* Not started. +. *DISPOSITION: ESTATE-CAMPAIGN* (GitHub settings via API, not files) +. Steps: +** Re-run the detector in the issue. +** For JuliaForChildren.jl, first-post, gsbot, hotchocolabot and stateful-artefacts: read the README, then `gh repo edit --description --add-topic`. +** Check provenance before touching `linguist`, `rescript` and `servers`. They are upstream forks, so credit upstream. +** Decide on the 17 private repos as a batch, and record the decision. +** Effort S–M. Tier: sonnet. +. *RISK:* Third-party forks (linguist, rescript, servers): do not imply estate authorship. + +==== #890 — Optimus-Branch enforcement:disabled; 0 rules in force on main +. Labels: governance, priority:p1, audit, scope:estate, status:needs-ruling. Last activity 09-30. 1 comment. +. *LITERAL:* Build a control that asserts *enforced* rules (via `GET /rules/branches/`), subsuming #887, with positive and 403 handling. Record the owner decision for the three repos. +. *GOLDEN:* Not absurd. AC5's owner decision has probably been overtaken by D215/D215b/D216/D233/D300. #787 says standards "reads bypassable-only (correct — it is D215b)". That needs a live re-measure. +. *MISCHIEF:* "Ruleset exists" is read as "governed". *Detector still absent.* `scripts/apply-branch-gates.sh` filters `enforcement=="active"` for its own use. `settings-drift-detect.yml` covers settings, not ruleset enforcement. +. *STATE:* Not started (control). +. *DISPOSITION: BOT-DO* +. Steps: +** `scripts/check-enforced-branch-rules.sh` reads `/repos/$R/rules/branches/$DB`. It fails loudly on 403/404, and reports no-object, empty-rules and disabled cases. +** Fixtures prove it tells stapeln (governed) apart from marid (ungoverned). +** Wire it report-only into `settings-drift-detect.yml` (the D300 drift check). +** Post a re-measure of standards, hypatia and cicd-squabbler for AC5. +** Effort M. Tier: sonnet. +. *RISK:* Read-only. + +==== #894 — Gate table + criterion 1.2.1 ignore manifest.scm +. Labels: scope:estate, conformance, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Accept `manifest.scm` and `build/manifest.scm` in the reproducible-build row and in criterion 1.2.1. Drop `flake.nix`. +. *GOLDEN:* Partly constrained. Criterion 1.2.1 lives in `0-canon/rsr/rsr-criteria-v2.a2ml:103`, an `.a2ml` file. Changing its text there would extend a retired file. +. *MISCHIEF:* A correct Guix manifest is invisible to conformance. *Still present.* +** `.machine_readable/template-capability-gates.toml:60` reads `"guix.scm|build/guix.scm|flake.nix" = "reproducible-build"`. +** 1.2.1's `detect = "build_system_rules/guix_primary"` is a *phantom detector*: there is no such rule in hypatia `lib/`. +** In the same criteria file, 1.2.4 requires `.tool-versions` (superseded by `mise.toml`) and 1.2.2 requires `.pre-commit-config.yaml` (the Python pre-commit tool). +. *STATE:* Not started. +. *DISPOSITION: BOT-DO* +. Steps: +** (a) Edit the toml row to `"guix.scm|build/guix.scm|manifest.scm|build/manifest.scm"` and remove `flake.nix`. Run `scripts/check-rsr-profile.sh` tests. +** (b) Implement the hypatia `build_system_rules/guix_primary` detector accepting either name. +** (c) Flag the stale criteria text (1.2.1, 1.2.2, 1.2.4) for the deed-era criteria file. Do not edit the a2ml. +** Landing: standards + hypatia. Effort S. Tier: sonnet. +. *RISK:* None. + +==== #895 — Gate format cannot express partial modules or nested layouts +. Labels: priority:p1, scope:estate, conformance. Last activity 09-30. 1 comment (D139). +. *LITERAL:* Represent partial modules and nested crate roots in the gate format. +. *GOLDEN:* Ruled as *D139*: per-file capability granularity (partial tiers explicit), plus a path-root field for nested modules. Caveat: consumer profiles are `rsr-profile.a2ml`, so new per-repo fields must not extend `.a2ml`. They belong in a deed clause or the toml. +. *MISCHIEF:* Checker and oracle disagree, and there are forced dishonest profiles. *Still present* (gates still v0.3-shaped; not changed since the ruling). +. *STATE:* Ruled, not implemented. +. *DISPOSITION: BOT-DO* +. Steps: +** Extend the `.machine_readable/template-capability-gates.toml` schema with a per-file `partial` tier and a `root` field. Teach `scripts/check-rsr-profile.sh` and the oracle to score the same shape. Add fixtures for maa-framework cases A (governance 2/4) and B (crate at `aletheia/`). +** Define where the per-repo declarations live in deed era (a `(profile …)` clause). +** Effort M. Tier: sonnet; opus for the schema decision. +. *RISK:* None. + +==== #896 — changelog-reusable can never start: write perms checked against caller top level +. Labels: bug, priority:p1, scope:estate, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Fix standards' own caller, correct the reusable's header example, and document the rule. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* The changelog never runs. *Still present.* +** `.github/workflows/changelog.yml:12-19` has top level `contents: read` and no job-level block. +** The reusable job asks for `contents: write` + `pull-requests: write` (`changelog-reusable.yml:110-112`). +** The header example (L13-18) still shows job-level-only perms. +** Same family: `changelog-reusable.yml:126` checks out standards at `ref: main`, a moving ref (see #910). +. *STATE:* Not started. +. *DISPOSITION: BOT-DO* +. Steps: +** Caller top-level becomes `contents: write`, `pull-requests: write`, `actions: read`. +** Fix the header example and add a "top-level rule" note. +** Change `ref: main` to `${{ job.workflow_sha }}`. +** Verify one run has jobs>0. Add a contract-test assertion. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #897 — Canonical cliff.toml should strip ZWSP at generation +. Labels: enhancement, scope:estate, priority:p2, status:ready. Last activity 09-30. 1 comment. +. *LITERAL:* Add invisible-character stripping, and skip the bot's own commits. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Defused-mention ZWSPs keep being re-imported, and the bot fed on its own commits. *Partly present.* +** The self-feed skip landed (#988, `d1bd7f42`; `templates/cliff.toml:64`). +** There is no `commit_preprocessors` invisible-character strip. +. *STATE:* Partly done. +. *DISPOSITION: BOT-DO* +. Steps: +** Add a `commit_preprocessors` entry removing U+00A0, U+00AD, U+2060, U+FEFF, U+200B–U+200F, U+202A–U+202F and U+2066–U+2069 from `templates/cliff.toml`. +** Add a fixture commit and check its git-cliff output. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #903 — actions-lock cliff: ENFORCE_ACTIONS_LOCK_FROM=2026-10-01 reddens 163 callers +. Labels: cicd, priority:p0, scope:estate, status:ready. Last activity 09-30. 2 comments. +. *LITERAL:* Ledger the lockless callers, move the date out of the pinned artefact, and set the cutover after a plateau. +. *GOLDEN:* Decided. `docs/decisions/2026-10-04-actions-lock-enforcement.adoc` (status ACCEPTED, but headed "Decision D???") accepts the 163 as debt through the shrink-only `.machine_readable/lock-allow.txt` (163 entries, ratchet-registered). The date stays at `scripts/check-actions-lock-gate.sh` default `2026-10-01`, and AC3 is explicitly not actioned. +. *MISCHIEF:* Date-triggered estate reddening. *Cured by ledger.* 27 lock PRs merged 09-30, and the lock gates are green on main. +. *STATE:* Done. +. *DISPOSITION: CLOSE-DONE.* Also: book a D-number for the decision on #1234 (the doc says "D???"). +. Not applicable. +. *RISK:* None. + +==== #904 — run_validator() is fail-open: 6 validators missing in the rsr-template pre-commit +. Labels: bug, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Vendor the six validators or make them required; add a test that every name resolves; check mode 100755. +. *GOLDEN:* Partly moot. The cited file `_RSR _SET/rsr-template-repo/.githooks/pre-commit` was a local stale copy. Current `rsr-template-repo` has *no `.githooks/`* (its hooks are `.github/hooks/{pre-push,validate-deed.sh,validate-k9.sh,scan-secrets.sh}`). +. *MISCHIEF:* Silent fail-open gates. *Partly present.* +** In `standards/.githooks/pre-commit` all 9 `run_validator*` names resolve and all hooks are mode 100755 (verified). +** `run_validator` remains fail-open by design (L56 comment). +** `propagate-hooks.yml` pushes `.githooks/` to repos that already have one, so drift in consumers is possible. +** There is no regression test. +. *STATE:* Partly done. +. *DISPOSITION: BOT-DO* +. Steps: +** Add `scripts/tests/githooks-validator-names-test.sh`. Parse every `run_validator*` call in `.githooks/pre-commit` and `.githooks/pre-push`, assert each `.githooks/` exists and is 100755 via `git ls-files -s`, and include a planted missing name that must fail. +** Effort S. Tier: haiku. +. *RISK:* None. + +==== #905 — runtime-policy.yml's Deno branch emits only ::warning:: +. Labels: bug, governance, migration, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Make the Deno branch fail, or ledger it; print a denominator; add a planted positive. +. *GOLDEN:* Not absurd. `runtime-policy.yml` is not in standards; there are about 47 estate copies, slated for fold-and-delete by the 2026-09-02 design §5. +. *MISCHIEF:* A policy asserted but not enforced. *Cured in canon.* `standards/.github/workflows/ci-pipeline.yml` has a `deno` job that REFUSES (L35–42, 148–150) unless the slug is in shrink-only `.machine_readable/deno-allow.txt`, and it prints the denominator (#899, `4f7f02ca`). +. *STATE:* Done in standards. The estate copies await the policy-family fold. +. *DISPOSITION: CLOSE-DONE.* Note: deleting the estate `runtime-policy.yml` copies belongs to the governance fold campaign. +. Not applicable. +. *RISK:* None. + +==== #906 — workflow-lint's lock regex blind to '- uses:' list items +. Labels: bug, cicd, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Add `-?` to the regex, prove it with a mutant, and print the count examined. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* A partly vacuous green. *Fixed.* +** `governance-reusable.yml:1474-1482` documents that the inline copy was removed. +** There is now one implementation, `scripts/check-actions-lock-gate.sh`. It reads `uses:` with yq per YAML-POLICY Y-1 (#1115), which catches list items and KYAML, and is tested in `scripts/tests/check-actions-lock-gate-test.sh`. +** Fixed by `7b05a323` (#947) and `71bb615e` (#1121). +. *STATE:* Done. +. *DISPOSITION: CLOSE-DONE.* +. Not applicable. +. *RISK:* None. + +==== #907 — check-actions-lock-gate.sh unconditionally exempts actions/github-script and hyperpolymath/standards/ +. Labels: bug, cicd, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Remove the github-script exemption, and narrow or ledger the standards exemption, with a mutant. +. *GOLDEN:* Not absurd. D327 (kcq's `standards@main` callers never started) shows unpinned standards refs are a real failure class. +. *MISCHIEF:* `@main` passes the gate. *Still present.* `scripts/check-actions-lock-gate.sh:93-96` reads `exempt_ref(){ case "$1" in ./* | docker://* | actions/github-script* | hyperpolymath/standards/*) return 0 ;;`. +. *STATE:* Not started. +. *DISPOSITION: BOT-DO* +. Steps: +** Drop `actions/github-script*`. +** Change the standards arm so `hyperpolymath/standards/*@<40-hex>` passes and anything else fails, optionally via a ledger. +** Add mutants `actions/github-script@main` and `hyperpolymath/standards/.github/workflows/x.yml@main` (must fail), keeping the existing tests green. +** Effort S. Tier: sonnet. +. *RISK:* It may redden callers using github-script by tag. Check the `lock-allow.txt` interplay first. + +==== #908 — root-allow.txt registered in the exemption ratchet but absent on disk +. Labels: bug, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Restore the ledger or unregister it. Make the ratchet fail loudly on a missing ledger, with a planted positive. +. *GOLDEN:* "Fail on any absent ledger" would wrongly redden consumers that never adopted a given ledger: the ratchet is shared, and `root-allow.txt` exists in rsr-template-repo. Sensible reading: fail when a ledger present at BASE disappears at HEAD, and report "not adopted" for absent-both. +. *MISCHIEF:* An inert ledger, and ledger deletion that reads as "debt paid". *Still present.* +** `scripts/check-exemption-ratchet.sh:145-153` lists `.machine_readable/root-allow.txt`, and standards lacks it. +** The loop silently `continue`s when both counts are 0. +** Deleting a populated ledger prints "SHRANK … debt paid down". +** `scripts/check-root-shape.sh`, cited by `0-canon/TEMPLATE-APPLICABILITY-POLICY.adoc:18`, does not exist. +. *STATE:* Not started. +. *DISPOSITION: BOT-DO* +. Steps: +** Make before>0 with after file-absent a FAIL, unless a `Ratchet-exception:` trailer is present. +** Print "not adopted" for absent-both. +** Add a test that deletes a ledger and expects red. +** Fix the TEMPLATE-APPLICABILITY-POLICY reference, or create the script. +** Effort S. Tier: sonnet. +. *RISK:* None. + +==== #909 — actions.lock never covers denoland/setup-deno +. Labels: bug, cicd, scope:estate, priority:p2, status:ready. Last activity 09-30. 0 comments. +. *LITERAL:* Cover setup-deno in the lock, or ledger its absence. Add a check that every third-party uses-entry is in the lock. +. *GOLDEN:* Absurd now in standards. Deno is banned and standards has *0* `setup-deno` uses (only a comment at `governance-reusable.yml:451`). The general "uses ⊆ actions.lock" check exists: `.githooks/validate-actions-lock.sh`, the lock-sync gate and "Actions lockfile verify". +. *MISCHIEF:* *Moot in standards.* The estate setup-deno refs disappear with the Deno→Bun campaign (#658/#706). +. *STATE:* Moot. +. *DISPOSITION: CLOSE-MOOT.* +. Not applicable. +. *RISK:* None. + +==== #910 — governance-reusable.yml has 7 'ref: main' helper checkouts +. Labels: bug, priority:p1, scope:estate, status:ready, security. Last activity 09-30. 0 comments. +. *LITERAL:* Pin all 7 helper checkouts immutably, and extend the contract test. +. *GOLDEN:* Not absurd. +. *MISCHIEF:* Pinned callers execute moving code. *Fixed* by #1120 (`10e0b6ff`, "pin what reusables fetch"). +** `governance-reusable.yml` now uses `${{ job.workflow_sha }}` (15 sites) and has no `ref: main`. +** `scripts/tests/governance-reusable-contract-test.sh:51-55` asserts 40-hex or `job.workflow_sha`. +** Residual of the same class: `changelog-reusable.yml:126` `ref: main`, folded into #896. +. *STATE:* Done. +. *DISPOSITION: CLOSE-DONE.* +. Not applicable. +. *RISK:* None. + +''' + +=== Summary counts + +[cols="1,1,1",options="header"] +|=== +| Disposition | Count | Issues +| CLOSE-DONE | 9 | 674, 705, 708, 751, 791, 903, 905, 906, 910 +| CLOSE-SUPERSEDED | 1 | 657 (#803) +| CLOSE-MOOT | 5 | 677, 689, 703, 792, 909 +| MERGE-INTO | 2 | 750 (#668), 887 (#890) +| OWNER-RULING | 4 | 646, 663, 692, 698 +| BOT-DO | 13 | 668, 687, 704, 795, 888, 890, 894, 895, 896, 897, 904, 907, 908 +| ESTATE-CAMPAIGN | 19 | 633, 634, 635, 653, 658, 659, 662, 664, 669, 675, 678, 681, 702, 706, 707, 727, 759, 808, 889 +| KEEP-OPEN-BLOCKED | 6 | 636, 645, 670, 732, 803, 837 +|=== + + +=== Side findings, outside any single issue (verified this session) +* `.hypatia-baseline.json`: 43 of 189 entries name files that no longer exist, and 21 entries expire *2026-10-21*. The Hypatia gate may go red next week. +* PR #1218's body (10-13) reports three problems: +** `scripts/link-rot-guard.sh` fails on main with 441 BROKEN links (`docs/proofs/spec-templates/** → ../archetypes/*.md`); +** root `coordination.k9` does not parse under its own ABNF; +** `standards-map.toml` is stale after the A2ML retirement. +* `scripts/triage-2026-09-29-apply.sh` planned closures (e.g. #808→#913) that never executed. +* `docs/decisions/2026-10-04-actions-lock-enforcement.adoc` is headed "Decision D???". It has no ledger number. diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc new file mode 100644 index 000000000..0a0d39599 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc @@ -0,0 +1,1148 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Issue triage C: #911 to #1037 (73 issues) +:toc: left +:toclevels: 2 + + +Measured 2026-10-14 against `origin/main` @ `7d2041a` (clone unshallowed for history). Issue bodies and comments were fetched through the REST API (`gh api repos/.../issues/N` and `/comments`). Every "last activity" date is 2026-09-30, the bulk relabel, except #1025 (2026-10-01). Read-only: nothing was posted, committed or edited. + +Context sources used throughout: +* the rulings ledger #787 (D1–D331), whose comments were pulled to `scratchpad/787.txt`, and #1234 (D332+); +* the deleted triage plans, recovered from git: `ULTRAPLAN-2026-09-24.adoc` @ `bd9313a6` and `ULTRAPLAN-2026-09-29.adoc` @ `3a845452`. Both were deleted in `3238461b`; +* the owner-run close-out scripts `scripts/triage-2026-09-24-apply.sh` and `scripts/triage-2026-09-29-apply.sh`. They were *never executed*: the agent token lacked `issues:write`, and #808 is still open. + +What this session could not reach: +* cross-repo REST, because the session is bound to standards and rsr-template-repo; +* Actions logs and artefacts, because the blob host is denied by the proxy; +* metadatastician org rulesets. + +Any estate-wide count below that is not re-measured is therefore quoted from the issue. + +Legend: Disposition ∈ {CLOSE-DONE, CLOSE-SUPERSEDED(#N), CLOSE-MOOT, MERGE-INTO(#N), OWNER-RULING, BOT-DO, ESTATE-CAMPAIGN, KEEP-OPEN-BLOCKED}. + +''' + +==== #911 — shell-e2e-reusable.yml has the repo's only 2 unpinned refs (owner's staged work: report only) +. labels priority:p2,status:ready,scope:repo,security · last 2026-09-30 · 0 comments +. LITERAL: When landing the staged work, the owner pins `actions/checkout@v7.0.1` and `mlugg/setup-zig@v2.2.1` in `.github/workflows/shell-e2e-reusable.yml` to SHAs. +. GOLDEN: Yes, the literal reading is now absurd. The file was never committed: `git log --all -- .github/workflows/shell-e2e-reusable.yml` is empty and the file is absent at HEAD. It existed only as staged work on the owner's workstation, which was wiped on 2026-10-13. +. MISCHIEF: The defect was unpinned refs in staged, uncommitted work. It no longer exists anywhere: `git grep` finds 0 unpinned `uses:` in live `.github/workflows/`. +. STATE: Moot. The staged work is lost. +. *CLOSE-MOOT*. The close note should say the staged file was never committed and was lost in the 2026-10-13 wipe; if it is ever re-authored, `validate-sha-pins.sh` will refuse unpinned refs. +. RISK: none. + +==== #913 — 76 'uses: ../../...' relative refs in vendored seeds are invalid syntax and cause startup death +. bug,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Rewrite 76 `uses: ../../` refs to `./` form, add a check that rejects `../` and `$/`, and prove the fix by a real dispatch. +. GOLDEN: Partly. The issue is labelled scope:repo, but standards carried *0* such refs even at filing time: `git grep` at `4f7f02ca` finds none, and #864 (`000b9f6b`, 2026-09-19) had already repaired standards' own copies. The 76 sit in estate repos seeded from RSR templates (#808), so this is estate work. +. MISCHIEF: Startup-dead workflows. Still partly live: +** `.githooks/validate-sha-pins.sh:45-47` still *accepts* `../` as "this repo's own composite actions" and only rejects `$/` (lines 115-121), so AC3 is unmet; +** the estate population is unverified from this session. +. STATE: Partly done. Standards' copies were fixed by #864; the `$/` check landed in #931; `scripts/apply-workflow-pins-remote.sh --repair-illegal` exists and runs weekly in audit mode. #808 is still open, though the 09-24 triage script closes it into this issue. +. *ESTATE-CAMPAIGN* +. Steps: +** (a) In standards, make `UNPINNED_FILTER` and `validate_file` in `.githooks/validate-sha-pins.sh` reject any `uses:` starting `../`, with a planted-positive test in `scripts/tests/validate-sha-pins-test.sh`. +** (b) Dispatch `apply-workflow-pins.yml` with `mode: fix` and `repair-illegal: true`, then confirm the ILLEGAL class is 0 in the census. +** (c) Verify one repaired repo has jobs > 0. +** (d) Close #808 into this issue. + +Landing: standards plus the affected estate repos. Effort M. Tier: sonnet. +. RISK: bulk sweep across repos; must use the applier, never `gh actions-lock` rewrite mode. + +==== #914 — 46 genuinely unpinned third-party refs in the vendored seed trees +. priority:p2,status:ready,scope:repo,security · 2026-09-30 · 0 +. LITERAL: Pin 46 third-party refs (dtolnay ×9, setup-deno ×5, …) inside the vendored seed trees, and hand-edit actions.lock. +. GOLDEN: Yes. The "vendored seed trees" are `rhodium-standard-repositories/`, which moved on 2026-10-09 to `9-archive/rhodium-standard-repositories/`. That tree is the LAST COPY and frozen. Its `.github/workflows` are nested, so GitHub never executes them. Editing them would mutate a frozen archive for no runtime effect. +. MISCHIEF: Unpinned executable refs. Not live: +** 72 unpinned `uses:` lines exist, all under `9-archive/` (dtolnay@stable ×9, setup-deno ×5 match the issue); +** live `.github/workflows/` has 0; +** `validate-sha-pins.sh` skips the tree via `VENDORED_MARK="rhodium-standard-repositories/"`; +** Debtfile entry `vendored-mirror-unpinned-actions` already tracks the count (40). +. STATE: Moot, archived and inert. +. *CLOSE-MOOT* +. RISK: touches frozen archive / vendored content if executed literally. + +==== #915 — ~138 files cannot carry a '#' SPDX header; 58 .json need REUSE sidecars +. licensing,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Drop `*.json` from the `#`-header requirement; give JSON REUSE sidecars; triage the other ~80 files; keep a headerless `.sh` failing. +. GOLDEN: The premise was already stale when filed. `*.json` had been removed from `is_source_file()` in #810 (`b1987eba`, 2026-09-15), and `.githooks/validate-spdx.sh:30-34` now says "*.json is NOT here and must never be re-added". Adding sidecars to 58 files is bulk licence labelling, which is owner-only. +. MISCHIEF: A checker no file could satisfy. Fixed: +** `bash scripts/tests/validate-spdx-test.sh` gives 17/17, including `bad.sh` failing as the denominator control; +** 0 `*.license` sidecars exist. +. STATE: Done for the checker, which is the issue's stated scope. The sidecars were never the agent's to add. +. *CLOSE-DONE*. Cite `b1987eba` and the test. If the owner wants REUSE sidecars, that is a separate owner-run licence act. +. RISK: licence/SPDX. Sidecar creation is owner-only; never sweep. + +==== #916 — setup-deno pins are inconsistent and some look fabricated: one SHA labelled four different tags +. priority:p1,migration,scope:estate,tech-debt,status:ready · 2026-09-30 · 0 +. LITERAL: Resolve every `setup-deno` SHA upstream, report fabricated pins, fix the tag comments, and pin 167 floating lines. +. GOLDEN: Yes. Deno has been banned since 2026-09-22, so repairing pins for a banned action is wasted work, and the issue's own last AC concedes this. The sensible reading is to *remove* setup-deno as part of Deno retirement while still recording any SHA that resolves to nothing. +. MISCHIEF: Misleading pin comments and possibly fabricated SHAs, estate-wide. Standards itself has 0 live setup-deno uses; it appears only in 9-archive and in the allowlists `config/settings/actions-allowlist.json:11` and `rhodium-standard-repositories/actions-allowlist/allowed-actions.json:27`, which still permit `denoland/setup-deno@*`. The estate population is unverified. +. STATE: Not started, but superseded in purpose by Deno retirement. +. *MERGE-INTO(#919)*. Carry two things across: +** the "report SHAs that don't resolve" check; +** removal of `denoland/setup-deno@*` from both allowlists, done only after the last ledgered repo migrates, otherwise remaining users startup-fail. +. RISK: none in standards. The estate removal is a bulk change. + +==== #917 — 234 .pre-commit-config.yaml files depend on Python, which LANGUAGE-POLICY bans +. migration,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Re-measure, then replace each `.pre-commit-config.yaml` with native `.githooks/` or ledger it shrink-only; register the ledger in the exemption ratchet; print the denominator. +. GOLDEN: No contradiction; Python is fully banned. +. MISCHIEF: The banned Python tool sits in the commit path. Still exists, and *the template seeds it*: `rsr-template-repo/ci/.pre-commit-config.yaml` says "Install: pip install pre-commit". Local siblings carrying a config: rsr-template-repo, hypatia, gitbot-fleet, proven-tests-and-benches, cicd-squabbler. #1010 found 42–44 of the configs reference a2ml hooks. +. STATE: Not started. +. *ESTATE-CAMPAIGN* +. Steps: +** (1) Fix the template first: delete `ci/.pre-commit-config.yaml` from rsr-template-repo and point at `.githooks/install.sh`. +** (2) Add a shrink-only ledger `.machine_readable/pre-commit-allow.txt` in standards and register it in `scripts/check-exemption-ratchet.sh`. +** (3) Re-census via default branches. +** (4) Remove each config repo by repo, one PR each. + +Acceptance: the census prints `pre-commit debt: N`, the template is clean, and N falls. Effort L. Tier: sonnet; haiku for the per-repo deletions. +. RISK: bulk sweep across ~230 repos; do not touch forks or third-party repos. + +==== #918 — Mirror callers drifted across >=3 live SHAs (de-duplicate worktrees before counting) +. scope:estate,tech-debt,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Census mirror callers via the API, converge them on one SHA, and re-run the census twice. +. GOLDEN: No contradiction, but it fully duplicates #950 AC5 ("Caller pins converge on one ref"). The weekly applier `apply-workflow-pins.yml` (audit by default) is now the mechanism. +. MISCHIEF: Pin drift means fixes never reach callers. Still exists: standards itself now pins `mirror-reusable.yml@b935e639` (#1169), and the estate spread is unverified. +. STATE: Not started as a separate effort. +. *MERGE-INTO(#950)* +. RISK: none. + +==== #919 — Deno retirement sizing: 95 'deno task' definitions across 23 files in the 11 ledgered repos +. priority:p1,migration,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: Enumerate 95 `deno task` definitions per repo, port each to package.json/bun or keep it ledgered, shrink the ledger, and re-measure. +. GOLDEN: No contradiction. +. MISCHIEF: Deno is still used in 11 repos. Still exists: `.machine_readable/deno-allow.txt` is unchanged since `4f7f02ca` (2026-09-22) and lists ambientops, civic-connect, excel-economic-numbers-tool, proven, social-media-tools, burble, gossamer, selur, stapeln, svalinn and vordr. +. STATE: Not started. +. *ESTATE-CAMPAIGN*. This should become the single Deno-retirement umbrella, absorbing #916, the predecessor #658, and #706 (deno part). +. Steps, per ledgered repo: +** (1) port the `deno.json` `tasks` map to `package.json` scripts (`bun run`) and commit `bun.lock`; +** (2) delete `deno.json`/`deno.lock` and setup-deno steps, with an `actions.lock` edit in the same commit; +** (3) remove the slug from `deno-allow.txt` in standards. + +Acceptance: the ledger is empty, then setup-deno is dropped from the allowlists. Effort L. Tier: sonnet; `proven/bindings/deno` is a carve-out, so do not touch it. +. RISK: bulk sweep; carve-out paths such as `*/bindings/deno/*` must be left alone. + +==== #921 — 55 agent-instruction files assert 'TypeScript IS PERMITTED under Bun', contradicting the 2026-08-27 ban +. governance,priority:p1,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: First settle LANGUAGE-POLICY vs CLAUDE.md at source, then correct 55 `.clinerules`/`.cursorrules`/`.windsurfrules` copies and add a check. +. GOLDEN: Yes. *D164* (#787, on #659) rules that per-repo agent files carry a *pointer* to the canonical policy, never a duplicated copy, so "correct the 55 copies" should read "replace the copies with pointers". AC1, "spec/LANGUAGE-POLICY wins", is also stale: `.claude/CLAUDE.md` now says "this file governs". +. MISCHIEF: Agents are instructed to write a banned language. Partly fixed and partly still live: +** the template's rule files now read "TypeScript and ReScript are banned" (rsr-template-repo `.clinerules:32`); +** but **`3-practice/LANGUAGE-POLICY.adoc:60` and rsr-template-repo `.github/copilot-instructions.md:57` still say "TypeScript is permitted *only where AffineScript cannot reach*"**, which `.claude/CLAUDE.md` (TIGHTENED 2026-08-27) calls "too permissive" and leaves as an unresolved owner decision against the TS-Exemptions table. +. STATE: Partly done (template); the source conflict remains in a new form. +. *MERGE-INTO(#659)*. #659 is the duplicated-language-policy umbrella that D164 governs. Raise the LANGUAGE-POLICY.adoc:60 versus TS-Exemptions collision as a #1234 decision row. +. RISK: bulk sweep across ~19 repos; owner decision needed on the TS carve-out wording. + +==== #922 — No pinned Bun lint/format gate: staged JavaScript is a declared skip +. cicd,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Add a read-only, pinned Bun-based lint + format `--check` for staged JS in `.githooks/`, with a denominator, a planted positive, mode 100755, and cmp-identical to the template. +. GOLDEN: Partly: +** Bun ships no linter or formatter, so "Bun-based" means picking a third-party tool run via `bunx` (Biome, Prettier, oxlint…), and that is a policy choice. +** The premise "plain JS is the sanctioned language" is overstated: JavaScript is allowed only where AffineScript cannot reach (CLAUDE.md, NO-JAVASCRIPT-SOURCE-POLICY). +. MISCHIEF: JS is the only staged ecosystem without a check. Still exists: `validate-lint-format.sh` has no JS arm, and `ci-pipeline.yml:210-218` detects Bun but reports it as detected-unsupported. +. STATE: Not started. +. *OWNER-RULING*. Question: *"Should Claude adopt Biome, as a pinned binary run as `bunx @biomejs/biome@ check` (format + lint, read-only), as the estate JS gate in `.githooks/validate-lint-format.sh` and `ci-pipeline.yml`, yes/no? If no, name the tool."* The recommended arm is Biome: one pinned tool for both checks and no Node/npm dependency. +. After the ruling: BOT-DO, S, sonnet. +. RISK: none. + +==== #923 — The Deno ruling is dated two ways across the estate (2026-08-26 vs 2026-09-22) +. migration,scope:estate,decision,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Confirm the canonical date (2026-09-22), fix the wrong occurrences, keep 2026-08-26 where it is a genuinely different event, and state precedence. +. GOLDEN: The precedence clause ("spec/LANGUAGE-POLICY wins") is stale, because CLAUDE.md now governs. There are two genuine events: +** 2026-08-26, "deno is to go", standards#655, a removal/priority ruling; +** 2026-09-22, "deno is over", the ban. +. MISCHIEF: Mostly cured. The ban is dated 2026-09-22 in 23 places, including 0-canon/rsr/LANGUAGE-POLICY, 3-practice/LANGUAGE-POLICY §1.3, JS-RUNTIME-POLICY, ci-pipeline and the launcher deed. One wrong site remains: *`.githooks/validate-lint-format.sh:173`* prints "Deno is BANNED (owner ruling 2026-08-26 …)". +. STATE: Mostly done. +. *BOT-DO* +. Steps: change `.githooks/validate-lint-format.sh:173` to "banned 2026-09-22 (removal ruled 2026-08-26, #655)", mirror the fix into the rsr-template-repo hook copy if it exists, then close. Effort S. Tier: haiku. +. RISK: none. + +==== #924 — rsr-template-repo has 62 unpinned workflow refs, including two @main and one feature branch +. priority:p1,scope:estate,status:ready,security · 2026-09-30 · 0 +. LITERAL: Pin all 62 refs to 40-hex SHAs with version comments, or cover them with a verified actions.lock; pin the `@main` and `@feat/` refs first; report the inherited population. +. GOLDEN: This exposes an unresolved policy split. The template deliberately uses tag refs plus `actions.lock` as the pin authority (comment: "NOSONAR — pin authority is actions.lock"; see also #674, which says inline pinning would break CI in lockfile-enforced repos). Canon rule 10 and `validate-sha-pins.sh` demand inline 40-hex. +. MISCHIEF: Floating refs in the template that seeds the estate. Still exists and has grown: +** *64* unpinned lines at rsr-template-repo `64787ae`: checkout@v7.0.1 ×38, upload-artifact ×5, download-artifact ×3, and more; +** `hyperpolymath/{deed,k9}-ecosystem/validate-action@main` ×4; +** *actions.lock itself records `deed-ecosystem@main` and `k9-ecosystem@main`* (lines 13, 21, 22, 43, 231), so it pins nothing. +. STATE: Not started. +. *OWNER-RULING*. Question: *"In a repo with a GitHub-enforced actions.lock, is `uses: owner/repo@vX.Y.Z` plus a lock record an acceptable pin under canon rule 10, yes/no? If no, the template moves to inline 40-hex everywhere."* Whatever the answer, the four `@main` refs and the `@main` lock records are defects that must be pinned now. +. After the ruling: ESTATE-CAMPAIGN on rsr-template-repo, M, sonnet. +. RISK: touches the template that seeds every repo. + +==== #925 — check-ts-allowlist.deno.js cannot be deleted: 11 of the last 12 governance revisions still invoke it +. scope:estate,tech-debt,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Enumerate the governance-reusable SHAs that callers pin, record which invoke the shim, and delete it only once none do; re-measure the 269-repo figure. +. GOLDEN: No contradiction. +. MISCHIEF: A Deno artefact kept alive by stale pins. Still exists: +** `scripts/check-ts-allowlist.deno.js` is present, and the Debtfile entry `deno-artefacts` shows count 1; +** measured: *every governance-reusable revision from `4f7f02ca` (2026-09-22) onward invokes it 0 times*, while `e13e2ea3` (2026-09-20) and older invoke it 3 times; +** so the gate is "no caller pinned before 4f7f02ca". The caller census is unverifiable from here because the applier artefact download is blocked. +. STATE: Not started; the precondition is measurable. +. *ESTATE-CAMPAIGN* +. Steps: +** (1) Read the weekly `apply-workflow-pins.yml` census for governance callers pinned at commits that are not descendants of `4f7f02ca`. +** (2) Run the applier in `mode: fix` to bump them, and verify the bumps landed. +** (3) Delete `scripts/check-ts-allowlist.deno.js` in standards and set Debtfile `deno-artefacts` to 0. +** (4) Keep `scripts/tests/check-ts-allowlist-test.sh` green. + +Effort M. Tier: sonnet. +. RISK: destructive (deletion) once the gate passes; it breaks stale callers if done early. + +==== #926 — k9-coordination-protocol vendors a Deno test harness: 260 Deno API lines across 10 files +. migration,testing,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Port `generator/*.js` to `bun test`, asserting the test count, with a mutant, or ledger it. +. GOLDEN: Partly. `.claude/CLAUDE.md` names `2-protocols/k9-coordination/tools/k9-init/` (Rust) as *the* generator, so the Deno `generator/` is a second, likely stale implementation. The coordination grammar moved to v1.2.0 in #1233, and the README at lines 245 and 291-301 still documents `deno run … standards/k9-coordination-protocol/generator/generate.js`, a pre-reorg path. Retiring it may be more elegant than porting it. +. MISCHIEF: Banned-runtime code in tracked content. Still exists: the 10 files are present with 260 `Deno.` lines (re-measured). +. STATE: Not started. +. *BOT-DO* +. Steps: +** (1) Diff `generator/generate.js` behaviour against `tools/k9-init` on the v1.2.0 fixtures. +** (2) If k9-init is a superset, port the meaningful property, regression and mutation cases into `cargo test` for k9-init, delete `generator/`, and fix README lines 245 and 291-301 and line 418. +** (3) Otherwise port to `bun test` and assert test count > 0. +** (4) Either way, the Deno count must be 0 and a mutant must go red. + +Effort M. Tier: sonnet. +. RISK: destructive if `generator/` is deleted; needs a parity check first. + +==== #928 — language-policy.scm v2.0.0 has no wired regression test (needs a decision on guile in CI) +. bug,governance,priority:p1,performance,scope:repo · 2026-09-30 · 1 (RULING D167: yes, pinned guile in CI) +. LITERAL: Add pinned guile to CI and commit the 44-assertion suite, keeping the v1.0.0 positive control. +. GOLDEN: Yes, the literal reading is now absurd: +** the module and its only consumer, `rsr-check.scm`, both now live in `9-archive/rhodium-standard-repositories/` (archived 2026-10-09, after D167 on 2026-09-30); +** the 44-assertion suite lived only in `$CLAUDE_JOB_DIR/tmp` and is lost; +** wiring a new CI toolchain to test a frozen archive file is pointless; +** #1066 / D130 ("align language-policy.scm") targets the same archived file. +. MISCHIEF: An unverified policy module. Not live: `git grep` finds no live consumer, and `0-canon/rsr/LANGUAGE-POLICY.adoc:578` links `../spec.scm/language-policy.scm`, a *dangling link*. +. STATE: Moot (archived; suite lost). +. *CLOSE-MOOT*. Note that D167 is overtaken by the 9-archive move. Small follow-up (haiku): fix the dangling links at `0-canon/rsr/LANGUAGE-POLICY.adoc:578` and `VERSION.adoc:230` to point into `9-archive/` or drop them. +. RISK: none. + +==== #929 — Seed CLAUDE.md claims the estate uses GitLab and not GitHub (flag only, owner decision) +. priority:p1,scope:repo · 2026-09-30 · 1 (RULING D168: stale; correct the six lines) +. LITERAL: Correct the six "GitLab, never GitHub" lines. +. GOLDEN: The file is now `9-archive/rhodium-standard-repositories/CLAUDE.md` (frozen). D168 still makes sense because the file is a *CLAUDE.md*: Claude Code loads it whenever an agent works in that directory, so its "❌ Use GitHub (always GitLab)" and "GitLab CI/CD (never GitHub Actions)" text actively misdirects agents. +. MISCHIEF: Stale forge instructions to agents. Still exists at lines 80, 135, 142, 179, 711, 859 and 899 (seven hits now). +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: apply D168 minimally. Reword the forge lines to "hosted on GitHub; GitLab and other forges are mirrors only", or prepend a 3-line "ARCHIVED — not current guidance; see /.claude/CLAUDE.md" banner if the owner prefers not to edit archive text. Effort S. Tier: haiku. +. RISK: edits frozen-archive content, explicitly authorised by D168. No licence text. + +==== #930 — actions-lock gate's remedy text names a repo-relative path that exists in no consumer repo +. bug,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Replace the four `scripts/update-actions-lock.sh` mentions in `check-actions-lock-gate.sh` with a consumer-runnable command (`gh actions-lock --no-narrow`), plus a de-pin warning and a control. +. GOLDEN: No contradiction. D326 ("regenerate lock-only, YAML byte-for-byte unchanged") reinforces `--no-narrow`. +. MISCHIEF: Advice that cannot be followed in consumers. Still exists at `scripts/check-actions-lock-gate.sh` lines 72, 151, 159 and 164. #935's one-line note was added (65d9af01), but the path was not changed. +. STATE: Not started. +. *BOT-DO* +. Steps: +** Reword the four strings to "Regenerate the lock only: `gh actions-lock --no-narrow --no-migrate-local-actions `; verify the *.yml diff is empty (bare fix mode de-pins SHAs, marid#36)". +** Add a test in `scripts/tests/` asserting that no emitted path is repo-relative. + +Effort S. Tier: haiku. +. RISK: none. + +==== #932 — validate-lint-format.sh: Rust and Nickel arms ask a different question than their tool +. bug,priority:p1,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Run cargo per crate (nearest Cargo.toml), report a missing manifest as a scope error, make the Nickel arm skip `K9!` files with a denominator, and stay read-only. +. GOLDEN: No contradiction. +. MISCHIEF: Partly cured: +** *Nickel arm fixed*: it excludes `*.k9.ncl`, aligned with ci-pipeline (#1143 `b3075e04`, lines 54-90) and handles generated imports; +** *Rust arm unchanged*: line 38 is `tracks 'Cargo.toml' '*/Cargo.toml'` followed by `cargo fmt --all --check` from the repo root (line 41), and there is no root Cargo.toml; +** so any staged `.rs` is still rejected with a misnamed message. +. STATE: Partly done. +. *BOT-DO* +. Steps: in `.githooks/validate-lint-format.sh` Rust arm: +** group the staged `.rs` files by their nearest ancestor `Cargo.toml` dir, and in each run `(cd dir && cargo fmt --check)` plus clippy; +** when no manifest is found, report `scope/tooling error: no Cargo.toml above `; +** exclude `9-archive/`; +** add a test planting a clean `.rs` in a crate, which must pass. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #933 — All 12 Rust crates fail cargo fmt --check (pre-existing formatting debt) +. tech-debt,priority:p3,status:blocked,scope:repo · 2026-09-30 · 0 +. LITERAL: `cargo fmt --all --check` exits 0 in all 12 crates; formatting-only commit; CI check-only; #932 first. +. GOLDEN: Yes, partly. 8 of the 12 crates are now under `9-archive/` (frozen), so reformatting them contradicts the archive. The live scope is *4 crates*. +. MISCHIEF: Formatting debt. Still exists in all 4 live crates (re-measured, read-only `--check`, rc=1 each): `.verisimdb/ecosystem-ingest`, `1-formats/sub-specs/inline-annotations/extractor`, `2-protocols/k9-coordination/tools/k9-init`, `hooks/playbook-to-recipe`. +. STATE: Not started; blocked only on #932 by its own wording. +. *BOT-DO* +. Steps: after #932, run `cargo fmt` in each of the 4 crates as one formatting-only commit, confirm `--check` gives rc=0, and leave `9-archive/` untouched. Effort S. Tier: haiku. +. RISK: none (archive excluded). + +==== #934 — 6 contractiles fail nickel typecheck: import path points one level off an existing file +. bug,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Fix the `../k9/template-hunt.k9.ncl` imports so all 6 typecheck, and add a CI typecheck. +. GOLDEN: No. +. MISCHIEF: Fixed: +** the six `*.k9.ncl` now import `../_base.ncl`, with a comment noting the old import "never resolved" (#1149 `aa1c4dd5`, M1 contractile pedigrees); +** all carry `K9!`; +** `.github/workflows/k9-contractile.yml` "K9 corpus conformance (ratcheted, L2)" checks the six contractiles at L2, and is green on main. +. STATE: Done. +. *CLOSE-DONE* (#1149 / `aa1c4dd5`; CI L2 in k9-contractile.yml). +. RISK: none. + +==== #935 — actions-lock gate is permanently red on main, and its remediation contradicts canon rule 10 +. bug,priority:p0,status:ready,scope:repo · 2026-09-30 · 1 +. LITERAL: Decide whether sha-as-ref advises or blocks; reconcile the remedy text with rule 10; resolve the setup-deno EXPECTED_ABSENT contradiction; the gate exits 0 on clean main. +. GOLDEN: No. +. MISCHIEF: Fixed: +** `is_advisory_category sha-as-ref` makes advisories non-blocking (`scripts/update-actions-lock.sh:70-83`, #946 `a2ff696a`); +** `EXPECTED_ABSENT` is now empty, with the comment "setup-deno exception removed 2026-09-22"; +** `actions.lock` has 0 setup-deno records; +** the rule-10 note was added to the gate (65d9af01); +** the Actions Lockfile Gate is green on main. +. STATE: Done. +. *CLOSE-DONE* (#946 `a2ff696a`, `65d9af01`). +. RISK: none. + +==== #937 — Hypatia content_patterns/http_in_docs: plain-HTTP URLs in prose (11 instances) +. documentation,automation,priority:p3,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Remediate the 11 instances or renew the baseline ack (expires 2026-12-22). +. GOLDEN: Partly. All 11 are intentional: +** the speakup.io archive link (axel CoC); +** `curl -I http://axel-protocol.org` and redirect demos; +** TRUST-DEFAULTS-POLICY rule text *about* `http://`; +** a detector-test example; +** `LICENSES/MPL-2.0.txt:360` (licence text, untouchable); +** 3 in 9-archive. +. MISCHIEF: Possible insecure links. None real: all instances are examples, policy text or licence text. +. STATE: Acknowledged in the baseline; not remediated. +. *BOT-DO* +. Steps: +** Replace the 6 live baseline acks with line-scoped `// hypatia:ignore http_in_docs -- ` AsciiDoc comments on the preceding line; content patterns honour the line form, not the file form. +** Keep `LICENSES/MPL-2.0.txt` as a permanent baseline entry or `.hypatia-ignore` (never edit licence text). +** Cover 9-archive by the archive-wide exclusion (see the cross-cutting notes). +** Delete the 9 acks and close. + +Effort S. Tier: haiku. +. RISK: licence text must not be edited (LICENSES/MPL-2.0.txt). + +==== #938 — Hypatia content_patterns/npx_in_workflow: npx/npm in CI config (9 instances, stale rule + vendored) +. cicd,tech-debt,automation,priority:p3,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Remediate the 9 instances or renew the ack, and refresh the stale rule text, which recommends Deno. +. GOLDEN: The rule's recommended cure ("use deno task") is now wrong; it should say bunx. +. MISCHIEF: +** 1 live instance: `.github/copilot/coding-agent.yml` runs `command: npx` with `@hyperpolymath/boj-server@latest`, which is both npx and an unpinned `@latest`, and has no SPDX header; +** the other 8 are in 9-archive (inert). +. STATE: Not started. +. *BOT-DO* +. Steps: +** (1) Switch `.github/copilot/coding-agent.yml` to `command: bunx` and pin `@hyperpolymath/boj-server@`, first confirming the Copilot agent image has bun; if not, keep npx but pin the version and add an inline allow with a reason. +** (2) File upstream hyperpolymath/hypatia: npx_in_workflow message should recommend `bunx`/`bun run`. +** (3) Cover the archive via the archive exclusion; delete the acks. + +Effort S. Tier: haiku. +. RISK: none. + +==== #940 — Hypatia content_patterns/known_fake_action_sha in vendored satellite examples (6 instances) +. priority:p3,status:ready,scope:repo,security · 2026-09-30 · 0 +. LITERAL: Replace the fabricated SHAs in vendored satellite example workflows or renew the ack. +. GOLDEN: Yes. All 6 are now under `9-archive/rhodium-standard-repositories/` (frozen LAST COPY, nested workflows never execute). Repairing them means editing the archive. +. MISCHIEF: Fabricated pins in live CI. Not live. +. STATE: Moot. +. *CLOSE-MOOT*. Cover the instances by the archive-wide Hypatia exclusion rather than 5 per-file acks. +. RISK: frozen archive; vendored content. + +==== #941 — Hypatia RE001: adopt step-security/harden-runner estate-wide, or record WONTFIX (23 instances) +. priority:p1,scope:estate,security · 2026-09-30 · 1 (RULING D131: adopt, egress audit mode, SHA-pinned, in actions.lock, via shared reusables on secret-touching jobs) +. LITERAL: Add harden-runner to every secret-touching job. +. GOLDEN: No contradiction, but a trap. Adding a new action to a `*-reusable.yml` makes every consumer's `actions.lock` need it first, or the consumer startup-fails with no check run. #1084 deliberately stopped short of the reusables for exactly this reason. +. MISCHIEF: No egress monitoring. Partly fixed: +** #1084 (`bd9c319f`) added harden-runner to 6 standards-only workflows, with propagate-hooks set to `egress-policy: block`; +** 11 RE001 baseline entries remain: allowlist-preflight-reusable, boj-build, github-backup-mirror-reusable, governance-reusable, hypatia-scan-reusable, instant-sync, k9-contractile, label-triage, labels, mirror-reusable, tailscale-connect-reusable. +. STATE: Partly done. +. *ESTATE-CAMPAIGN* +. Steps: +** (1) Add the `step-security/harden-runner@` record to every consumer `actions.lock` first, via the dependabot-lock-regen / D326 lock-only regen path, and measure coverage. +** (2) Only then add harden-runner (audit mode) to the secret-touching jobs in the reusables and the consumer-copied workflows, then bump consumer pins via the applier. +** (3) Delete the RE001 acks. + +Acceptance: 0 RE001 findings and 0 startup_failure regressions in a sampled cohort. Effort L. Tier: opus (sequencing across ~368 callers). +. RISK: bulk estate change; startup-kill risk if sequenced wrong. + +==== #943 — Hypatia workflow_hardening triage: secrets-inherit convention + WH013/WH006 false positives (7 instances) +. cicd,research,automation,priority:p3,status:ready,scope:repo,security · 2026-09-30 · 0 +. LITERAL: Remediate the 7 or renew the ack. +. GOLDEN: No. +. MISCHIEF: +** WH008 `secrets: inherit` ×4 is still present (governance.yml:20, hypatia-scan.yml:30, mirror.yml:18, secret-scanner.yml:49). Its real cure is #1141: reusables must declare the secrets they read so callers can forward named secrets. +** WH013 ×2 (mirror pushes to foreign repos via PAT) and WH006 (a `uses:` caller job cannot carry `timeout-minutes`) are scanner false positives. +. STATE: Not started. +. *BOT-DO* +. Steps: +** (1) Move the WH008 part to #1141 and comment there. +** (2) Replace the WH013/WH006 baseline acks with inline `# hypatia: allow workflow_hardening/WH013 -- push targets a foreign repo via PAT` (and the WH006 equivalent). +** (3) File two upstream hypatia false-positive issues (WH013 cross-repo PAT push; WH006 on `uses:` caller jobs). +** (4) Close. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #944 — Banned-language deed tools: port a2ml_to_deed.py + deed_lint.py off Python, or exempt permanently (2 files) +. enhancement,priority:p1,migration,status:needs-ruling,scope:repo · 2026-09-30 · 0 +. LITERAL: Port both Python tools or exempt them permanently. +. GOLDEN: Yes; the question is answered. *D313* (2026-10-06): "`a2ml_to_deed.py` is deleted"; conversion becomes kyX's front end. D320/D323: `deed_lint.js` (bun) is the sole authority. The `status:needs-ruling` label is stale. +. MISCHIEF: Python in tree. Still exists: +** both `.py` files are present and are the only 2 `*.py` in the repo; +** the README says `deed_lint.py` is "kept only because a2ml_to_deed.py imports it"; +** `1-formats/deed/tools/migrate_a2ml_to_deed.sh` (`32d37263`, 2026-10-05, a direct push) plans "full conversion using a2ml_to_deed.py", which contradicts D313; +** `deed_lint.js` is wired in `deed-conformance.yml` (#1164). +. STATE: Ruled; deletion not executed. +. *BOT-DO* +. Steps: +** Delete `1-formats/deed/tools/a2ml_to_deed.py`, `deed_lint.py` and `migrate_a2ml_to_deed.sh`. +** Update `1-formats/deed/tools/README.adoc` (drop the .py sections) and `1-formats/deed/mappings/launcher-standard-to-praxis-deed.adoc:271`, which uses `python3 … deed_lint.py`, so it uses `bun 1-formats/deed/tools/deed_lint.js`. +** Remove the 2 baseline entries (`.hypatia-baseline.json` ~lines 858 and 867). +** Run `bun test 1-formats/deed/tools/`. + +Effort S. Tier: haiku. +. RISK: destructive (file deletion), authorised by D313. + +==== #945 — Hypatia misc: scorecard DependencyPinning + SD022 k9 spec stale path (2 instances) +. cicd,tech-debt,automation,priority:p3,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Clear or renew the two acks. +. GOLDEN: The spec was renamed; the `COORDINATION-K9-SPEC_v1.adoc` path the ack names no longer exists. +. MISCHIEF: +** SD022: `2-protocols/k9-coordination/spec/COORDINATION-K9-SPEC.adoc:97,134` still reference `src/tea/`, which is illustrative example content; +** DependencyPinning: upstream D175 says Hypatia should accept actions.lock-resolved SHAs (hypatia work). +. STATE: Not started. +. *BOT-DO* +. Steps: +** Mark the `src/tea/` example as illustrative with an inline `// hypatia: allow structural_drift/SD022 -- illustrative example path`, or rename it to an obviously-placeholder `src//`. +** Re-point the SD022 ack's file path. +** Drop the DependencyPinning ack if the current scan no longer emits it; otherwise link it to D175 (hypatia). + +Effort S. Tier: haiku. +. RISK: none. + +==== #949 — Estate health: 87% of default branches are red (388 of 447) — a red branch is no longer a signal +. governance,priority:p1,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: The owner decides whether 87% red is accepted debt or a campaign; if a campaign, fix mirror first, then governance; re-run the census. +. GOLDEN: The decision has been taken. *D256–D261* (2026-10-01, the estate health census) treat it as remediation: +** D261 mirror: provision every forge; +** D256 CodeQL: default setup; +** D257 owner bypass; +** D259 dead required contexts; +** D260 hypatia warn→medium. +. MISCHIEF: An unusable red signal. Still largely live (#803: lock drift in 163 repos on 2026-10-13; standards' own Mirror and README Derive are red), but every cluster now has its own carrier issue. +. STATE: Superseded by the D256–D261 programme. +. *CLOSE-SUPERSEDED(#950)*. Close noting the work continues in its children: mirror in #950, lock drift in #968/#803, governance reds in #1070/#994, CodeQL in #1031. Rulings are D256–D261 on #787. +. RISK: none. + +==== #950 — Mirror fleet: 27% of estate CI failures — destinations unprovisioned, advisory doctrine not implemented, 3 live caller refs +. enhancement,priority:p1,scope:estate,status:ready,security · 2026-09-30 · 0 +. LITERAL: Do the following: +** a controlled observation of job-level `continue-on-error` versus check-run conclusion; +** a destination-existence probe in `mirror-reusable.yml`; +** a refuse-or-autocreate decision; +** fix the header-claim disagreement; +** converge pins; +** re-census. +. GOLDEN: *D261* answers the decision: "set every forge up properly; the owner provisions Gitea/Codeberg/Disroot/Bitbucket; verified by destination HEAD == GitHub HEAD; *no forge is to be quietly disabled*". Making jobs advisory must therefore not become a quiet disable. D303/D304 (bundle store host) remain open on #1234. +. MISCHIEF: Still exists: +** `mirror-reusable.yml` has no `gh api -i` probe; +** only `mirror-gitlab` (line 71) has job-level `continue-on-error`; +** the gitea arm has no empty-host guard, though the other 5 arms print `::error::Configure a valid …`; +** no substantive change since 2026-09-20 (only Dependabot bumps); +** Mirror to Git Forges is RED on standards main. +. STATE: Not started (standards side); owner provisioning pending. +. *BOT-DO*. Absorbs #918 and #1002. +. Steps in standards `mirror-reusable.yml`: +** (1) a per-forge destination probe modelled on `github-backup-mirror-reusable.yml` (200/404 split, refuse-not-guess, a named reason in the step summary); +** (2) `::error::` when `vars.GITEA_HOST` or any `*_HOST` is empty; +** (3) correct the header claim in `github-backup-mirror-reusable.yml` to match; +** (4) bump `mirror.yml`'s pin; +** (5) converge estate callers via the applier. + +Owner actions per D261 (Codeberg repo or push-to-create, Disroot key, GITEA_HOST) stay listed here. Effort M. Tier: sonnet. +. RISK: must not disable forges (D261). + +==== #953 — debt paydown: gate-scripts-without-tests re-baselined 30->40, todo-fixme 76->80 +. tech-debt,priority:p3,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Pay down the untested gate scripts and to-do markers. +. GOLDEN: No. +. MISCHIEF: Untested gates. Partly paid: +** `gate-scripts-without-tests` is now *32* (from 40; #1078 added 5 tests); +** but `todo-fixme-markers` *rose* to 84, with its ceiling raised 80→85 in `4d606177`, a direct push; +** #1080 notes the probe miscounts. +. STATE: Partly done; ongoing. +. *BOT-DO* +. Steps: take the 32-list from the `run-debtfile.sh` probe (newest first: `scripts/link-rot-guard.sh`, `scripts/spine/*`, `scripts/sweep-classifiers/*`) and write known-answer tests, each with one planted mutant, under `scripts/tests/-test.sh`. Run `bash scripts/run-debtfile.sh --write` so the ceiling follows. Target ≤ 20. Effort M. Tier: sonnet. +. RISK: none. + +==== #955 — Debt ratchet red on every PR since #820 — run-debtfile.sh --write emits a file check-debtfile-structure.sh rejects +. priority:p0,tech-debt,status:ready,scope:repo · 2026-09-30 · 1 +. LITERAL: Fix the writer/validator contradiction and add a test that grows a probe. +. GOLDEN: Partly. The symptom was cured by #954, and an unnumbered "Decision D???" doc (`docs/decisions/2026-10-04-deno-residue-false-positives.adoc`, a Mistral Vibe direct push `a41f3692`) "accepts false positives". That doc addresses the probe, not the root cause. +. MISCHIEF: Writer and validator contradict each other. Still exists: +** `scripts/run-debtfile.sh:111-113` still appends counts when a probe grows, and `check-debtfile-structure.sh:79` still rejects count > ceiling. Neither script has changed since #947. +** There is no growth test in `scripts/tests/run-debtfile-test.sh`. +** New, measured today: `run-debtfile.sh` *FAILS* on main because `shell-scripts-missing-spdx` is RESOLVED (0) but its `accepted-until 2026-10-01` expired. A resolved entry should not fail on expiry, and `debt-measure.yml` runs this script. +. STATE: Partly done; root cause open. +. *BOT-DO* +. Steps: +** (1) In `run-debtfile.sh`, when measured > ceiling, do not write `count` (or write and exit 1 without saving), and print the reason. +** (2) Skip the expiry check when measured == 0, or drop resolved entries on `--write`. +** (3) Add a test that grows a probe and asserts the structure check accepts the written file, plus a resolved+expired case. +** (4) Give the decision doc a real D-number or withdraw it. + +Effort S. Tier: sonnet. +. RISK: Debtfile.a2ml is legacy A2ML. Values-only edits are allowed; add no new facts. + +==== #957 — PAT-refresh tripwire: live HYPATIA_SCAN_PAT will arm 6 unackable CSA findings in both gates +. priority:p1,scope:repo,security · 2026-09-30 · 1 (RULING D133: exclude CSA live-alert echoes from static apply-baseline.sh; gate on alerts through the ruleset) +. LITERAL: Exclude `code_scanning_alerts` in `apply-baseline.sh` (option 1). +. GOLDEN: No. +. MISCHIEF: Still exists: +** `scripts/apply-baseline.sh` has no `code_scanning_alerts` filter; +** `governance-reusable.yml:385` runs it in blocking mode on raw scan JSON; +** only hypatia-scan-reusable avoids the echoes, by using SARIF. +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: +** In `scripts/apply-baseline.sh` blocking mode, drop findings whose `rule_module == "code_scanning_alerts"` before thresholding, and print the count dropped. +** Add a test with a CSA001 fixture that must not block while a real `high` still blocks. +** Note the change in `docs/HYPATIA-BASELINE-FORMAT.adoc`. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #958 — Debt-exception / Ratchet-exception trailers never survive the squash merge — 0 of 8 in the Debtfile's whole history +. priority:p0,tech-debt,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Make the trailers durable via COMMIT_MESSAGES and/or a PR-body scan, add a squash regression test, and apply to the template. +. GOLDEN: No. +. MISCHIEF: Partly fixed: +** `65d9af01` made `check-debt-ratchet.sh:74-90` and `check-exemption-ratchet.sh:122-138` read `.pull_request.body` from `GITHUB_EVENT_PATH`; +** the repo setting is still `PR_TITLE`/`PR_BODY`, so a column-0 PR-body trailer survives the squash; +** *no test* covers the PR-body path (`debt-ratchet-test.sh` and `exemption-ratchet-test.sh` have 0 `GITHUB_EVENT_PATH` cases); +** rsr-template-repo carries no ratchet scripts, so the template AC is moot. +. STATE: Partly done. +. *BOT-DO* +. Steps: +** Add tests with a fake `GITHUB_EVENT_PATH` JSON: a PR body with a column-0 trailer passes, an indented one fails. +** Document in `docs/DEBTFILE-SPEC.adoc` that the trailer goes at column 0 in the PR body. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #960 — D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted launcher-standard.a2ml +. migration,scope:estate,priority:p2,status:ready · 2026-09-30 · 9 +. LITERAL: +** AC1: no writable repo names `launcher-standard.a2ml`; +** AC2: decide on the 21 descriptors; +** AC3: fix trigger; +** AC4: add a currency gate. +. GOLDEN: AC2 was ruled "migrate all 21 to `.deed`" on 2026-09-22. Since then: +** D313 forbids bulk hand-conversion of A2ML (conversion is kyX's front end); +** open rulings *#1225* (launcher metadata domains) and *#1226* (praxis field vocabulary, "before the 21-descriptor migration") gate it. +. MISCHIEF: Dangling references. Mostly cured: +** AC1: 19 PRs merged plus 5 exemptions; +** AC3: trigger#14; +** AC4: `scripts/check-launcher-standard-currency.sh`, wired in governance-reusable (lines 1104-1186), with CURRENT_VERSION now 0.6.0. +. STATE: AC1, AC3 and AC4 done; AC2 execution blocked. +. *KEEP-OPEN-BLOCKED* on owner rulings #1225 and #1226, and on the kyX front end (D313). Relabel `status:blocked`. +. RISK: bulk conversion is forbidden until kyX exists. + +==== #963 — main is red: actions.lock omits a transitive dependency of asana/push-signed-commits (actions/setup-python@v2) +. bug,priority:p0,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Record setup-python as a transitive dependency, or remove the asana step; no baseline entry. +. GOLDEN: No. +. MISCHIEF: Fixed: +** #1233 (`0b1898e2`) replaced asana with native `push-verified.sh` (createCommitOnBranch); +** #1238 (`7d2041a`, HEAD) dropped both orphan records; +** `actions.lock` has 0 asana/setup-python records; Hypatia scan is green. +** Leftover: the baseline entry `invalid_actions_lock` tracked by #963 (expires 2026-12-22) is now stale, and AC4 forbade it. +. STATE: Done. +. *CLOSE-DONE* (#1233, #1238). Haiku follow-up: delete the stale `invalid_actions_lock` ack from `.hypatia-baseline.json`. +. RISK: none. + +==== #964 — governance-reusable.yml dupkey helper pin 317101e0 is stale by 45 files — and its sparse-checkout scope is too wide for #962's freshness guard +. governance,scope:estate,tech-debt,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Narrow the sparse-checkout to the executed helpers, bump the pin, extend the freshness guard with a mutant, and bump all 3 sites. +. GOLDEN: No. +. MISCHIEF: Still exists: +** `ref: 317101e03b8f…` at `governance-reusable.yml:438, 1279, 1386`; +** site 438 still sparse-checks the whole `scripts` directory; +** `scripts/check-lock-gate-pin-freshness.sh` exists but covers only the lock-gate step. +. STATE: Not started. +. *BOT-DO* +. Steps: +** (1) Enumerate the scripts the `.standards-checkout` consumers at 438+ actually execute, and set `sparse-checkout` to exactly those. +** (2) Bump all 3 refs to a main commit containing current copies, watching #1137 (dupkey false positives on KYAML) when the dupkey helper moves. +** (3) Parameterise the freshness guard by step name, and add the step to `scripts/tests/governance-reusable-contract-test.sh`. +** (4) Mutant: reverting to `317101e0` must fail. + +Effort M. Tier: sonnet. +. RISK: estate-visible (368 callers on their next pin bump). + +==== #967 — ci-pipeline detect is blind to 56 code-bearing repos (and probes Deno, not Bun) +. bug,priority:p1,scope:estate,status:ready · 2026-09-30 · 2 +. LITERAL: Add manifest probes for Julia, Zig, Idris2, Elixir, Lean, Agda, Ada, Gleam and Bun; re-census; seed the ledger after extension; add controls. +. GOLDEN: The issue's own comment corrects the Deno half: the Deno probe is the ban's refusal trigger, not a lint arm, so it must stay. +. MISCHIEF: Fixed: +** `ci-pipeline.yml:160-218` probes Julia, Zig, Idris2, Elixir, Lean, Agda, Ada and Gleam (manifest-keyed) plus Bun, and refuses "detected but unsupported" explicitly (line 295 cites #967); +** pilot wave verified (comment 2); +** `pipeline-allow.txt` deliberately unseeded. +. STATE: Done (#970 `436a89b3`). +. *CLOSE-DONE* (#970). The template-boilerplate residue continues in #976; the Bun lint arm in #922. +. RISK: none. + +==== #968 — actions.lock step-level desync: 39 repos with silently dead CI (startup_failure) +. bug,priority:p0,scope:estate,status:ready · 2026-09-30 · 1 +. LITERAL: For each of 39 repos: regenerate lock-only, verify, land the zero-`uses:` lock-sync gate, jobs > 0. +. GOLDEN: No. D326 confirms the lock-only regen. +. MISCHIEF: Startup-dead CI from Dependabot desync. *Worse now*: bot tracker #803 reports *163 repos with drift* on 2026-10-13, up from 15 on 2026-09-22. #1093 shows about 53 repos startup-dead from codeql 4.38.2 bumps. +** Done in standards: `.github/workflows/lock-sync-gate.yml`, `scripts/check-lock-sync.sh`, clause 4 COVERAGE (a41f3692), and `dependabot-lock-regen.yml` (#1123), which regenerates locks on Dependabot PRs estate-wide. +** Per the comment, 15 batch-1 repos were fixed. +. STATE: Partly done; estate drift is growing. +. *ESTATE-CAMPAIGN*. Make this the umbrella and fold in #1093 and the #803 tracker reference. +. Steps: +** (1) Verify `dependabot-lock-regen.yml` is actually installed and firing in consumer repos (measure on 5). +** (2) Run the D326 lock-only regen (`gh actions-lock --no-narrow --no-migrate-local-actions`) per drifted repo from the #803 TSV, one PR each, with SPDX line 1 restored (#727). +** (3) Land `lock-sync-gate.yml` where it is missing. + +Acceptance: #803 drift ≤ 5, and every sampled repo shows jobs > 0. Effort L. Tier: sonnet; haiku per-repo once the script is stable. +. RISK: bulk sweep (one PR per repo); `gh actions-lock` fix mode can de-pin, so use `--no-narrow`. + +==== #969 — actions.lock omits job-level reusable refs in 159 repos (no runtime impact; tracks upstream #129) +. scope:estate,tech-debt,priority:p3,status:ready · 2026-09-30 · 0 +. LITERAL: Wait for upstream gh-actions-lock #129, then regenerate 159 repos; no PRs until then. +. GOLDEN: Partly contradicted. "No runtime impact" is challenged by #1169 (`8464935a`, 2026-10-06): standards' own `mirror.yml` was startup_failure because its job-level record lacked a nested `uses:` list and the callee's transitive action was unrecorded. Policy is being set in #993. +. MISCHIEF: An incomplete lock. Live, but now a policy question, not a separate defect. +. STATE: Not started (blocked upstream). +. *MERGE-INTO(#993)*. Carry #1169's measured shape (job-level record with a nested `uses:` list) into #993's policy text. +. RISK: none. + +==== #972 — pre-commit hands validators git-QUOTED paths, so non-ASCII filenames are silently skipped (6 validators) +. bug,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: +** (1) `core.quotePath=false` at the shared callers; +** (2) a path that is not on disk is an error, not a `continue`; +** (3) a regression test that fails on the old code. +. GOLDEN: No. +. MISCHIEF: Partly fixed: +** AC1 done: `.githooks/pre-commit:30,45,63` use `git -c core.quotePath=false` (1f099de9, a direct push); +** AC2 not done: `[ -f "$file" ] || continue` remains in validate-actions-lock:131, bot-directives:42, k9:104, permissions:45, sha-pins:139, spdx-workflows:38 and spdx:92; +** AC3: no test. +. STATE: Partly done. +. *BOT-DO* +. Steps: +** Replace the silent `continue` with an error (`missing staged path:

`; count it and fail) in the 7 validators, except for deletions, which ACM already filters. +** Add `scripts/tests/pre-commit-nonascii-test.sh`, which stages `café.rs` and asserts the CHECKED denominator includes it. Run it against `1f099de9^` to show it fails there. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #975 — 21 baseline acks lapse on 2026-10-22 and 17 point at closed issues +. governance,priority:p1,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: For each of 18 orphaned acks, re-point or delete; decide the 2026-10-22 cliff; add a closed-tracking-issue check; consider the 83 no-expiry entries. +. GOLDEN: No. *This is urgent: the cliff lands in 8 days (2026-10-22).* +. MISCHIEF: Still exists: +** `.hypatia-baseline.json` has 21 entries `expires_at: 2026-10-21`; +** 7 of them name files that *no longer exist*: `lol/…`, `scripts/check-ts-allowlist.ts`, `2-protocols/avow/…`, `repo-guardian-fs/…`, `scorecard.yml`; +** *43* baseline entries overall name missing files; +** 84 entries have no expiry. +. STATE: Not started. +. *BOT-DO* (do first). +. Steps: +** (1) Delete every ack whose `file` no longer exists, all 43, and prove main stays green. +** (2) For the remaining 2026-10-21 acks: +*** re-point #399/#492/#494/#378/#254/#496 to live successors (#493 and #124 are open; #1173 for new Hypatia findings); +*** or delete if the defect is gone; +*** stagger the expiries. +** (3) Add `scripts/check-baseline-tracking.sh` (repo-scoped `gh api issues/N` state check; fails on a closed tracker) with a test. + +Effort S. Tier: sonnet. +. RISK: none; each deletion must be shown green. + +==== #976 — detect: the Nickel probe matches RSR template boilerplate, silencing the zero-denominator refusal on 9 of 24 sampled repos +. bug,priority:p1,scope:estate,status:ready · 2026-09-30 · 2 +. LITERAL: Make the template `.ncl` not lift TOTAL (julia-ecosystem must REFUSE); keep the positive controls (laminar, zerotier-k8s-link); separate template from own `.ncl` in the summary. +. GOLDEN: No. +. MISCHIEF: Partly fixed: +** `*.k9.ncl` is excluded from `N_NICKEL` (`ci-pipeline.yml:131,386`), which removes the six k9 template files; +** but rsr-template-repo still ships *11 non-k9 `.ncl`*: `.machine_readable/contractiles/*.ncl` ×7, `coaptation/*.ncl` ×3 and `arrival-pack/arrival-pack.ncl`; +** so TOTAL is still lifted in template-seeded repos; +** the generated-input typecheck problem is handled (`NCL_GENERATED_IMPORTS`, validate-lint-format.sh:126). +. STATE: Partly done. +. *BOT-DO* +. Steps in standards `ci-pipeline.yml` detect: +** count Nickel toward TOTAL only outside `.machine_readable/**` (template-owned), still linting all of them when the job runs; +** print `nickel: N own, M template`. + +Separately, in rsr-template-repo, run `nickel format` on arrival-pack.ncl. Add controls per the ACs. Effort S. Tier: sonnet. +. RISK: estate-visible gate semantics; must keep the positive controls. + +==== #980 — ci-pipeline.yml: the ledger pin's "same commit" invariant is unsatisfiable (12/12 merges are squash) +. bug,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Fix the unsatisfiable `ref: a2ff696a` ledger pin invariant. +. GOLDEN: No. +. MISCHIEF: Fixed. The ledger is now read at `ref: ${{ job.workflow_sha }}` (`ci-pipeline.yml:938-967`, comment: "literally true rather than aspirational"). +. STATE: Done (#989 `ed5e3f65`). +. *CLOSE-DONE* (#989). +. RISK: none. + +==== #981 — validate-actions-lock prescribes a cure that can re-legitimise a blocked action version +. bug,priority:p1,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: On a missing ref, detect the two-sided case (the lock holds a different SHA for the same owner/repo), name both SHAs, do not prescribe bare regeneration, and add a regression test. +. GOLDEN: The motivating example (codeql 4.38.1 "blocked") is itself refuted by #1093 ("4.38.1 was never broken"; the cause was lock drift). The general two-sided-drift defect is still valid. +. MISCHIEF: Still exists. `.githooks/validate-actions-lock.sh:189,210` still always says "Regenerate with the LOCKFILE ONLY"; it has not changed since #1115. +. STATE: Not started. +. *BOT-DO* +. Steps: +** In `validate-actions-lock.sh`, when `ref` is missing but the lock has another SHA for the same `owner/repo`, print "two-sided drift: workflow wants , lock holds — reconcile the workflow to , or change both deliberately" and skip the regen advice. +** Add a test in `scripts/tests/` covering the two-sided case and the single-sided case unchanged, plus a mutant restoring the old text. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #987 — Phantom blob-pin: 18 refs across 7 repos pin standards reusable workflows at non-commit SHAs +. bug,priority:p1,scope:estate,status:ready · 2026-09-30 · 1 +. LITERAL: Re-pin 18 refs (8 live per the comment), confirm jobs > 0, run the guard from outside, add a planted control, fix the template. +. GOLDEN: The template AC is moot: `rsr-julia-library-template-repo` returns 404 (comment). +. MISCHIEF: Dead callers. The detector now runs from outside: `scripts/apply-workflow-pins-remote.sh` classifies DEAD-REF via `sha_is_commit` (lines 289-300) and runs weekly from standards (`apply-workflow-pins.yml`, last success 2026-10-11 run 38118717637). Fix mode needs dispatch. The census result is unreadable here (artefact blob blocked). +. STATE: Partly done (detection); re-pinning unverified. +. *ESTATE-CAMPAIGN* +. Steps: +** Read the 2026-10-11 census artefact. +** Dispatch `apply-workflow-pins.yml` with `mode: fix` for DEAD-REF rows: JuliaForChildren.jl, stateful-artefacts, tma-mark2 (archived?), trope-checker, ubicity, verisimdb, idaptik-ums, universal-modding-studio, common-signal, absolute-zero. +** Verify `governance.yml` jobs > 0 on each. +** Add a planted blob-SHA known-answer control if one is not already in `tests/test_apply_workflow_pins_remote.sh`. + +Effort M. Tier: sonnet. +. RISK: bulk cross-repo PRs (via the signed applier). + +==== #991 — AC4 arming policy: retired-filename blocks, stale-version warns +. governance,tech-debt,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Prove the wiring (red on retired filename, warn on stale version, rc=2 fails); require a blast-radius re-measure before each CURRENT_VERSION bump; owner picks (a) warn permanently or (b) promote/demote per bump. +. GOLDEN: No. +. MISCHIEF: The open policy question. Still open, and AC4 was already breached: `scripts/check-launcher-standard-currency.sh:65` is `CURRENT_VERSION="0.6.0"` (was 0.4.0) with *no re-measure posted* on this issue. The rc=2 fail-closed wiring is present (governance-reusable.yml:1157,1186). +. STATE: Wiring done; ruling outstanding. +. *OWNER-RULING*. Question: *"Should `stale-version` findings from the launcher-currency gate (a) warn permanently, or (b) be promoted to fail between version bumps and demoted on each bump?"* The recommended arm is (a): simplest, and no skipped-demote estate-wide red. +. After the ruling: BOT-DO, S, haiku, to document the rule beside CURRENT_VERSION. +. RISK: none. + +==== #992 — check-lock-sync.sh and GitHub startup disagree for job-level-reusable-only callers, and the gate's error text is inverted +. bug,priority:p1,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: +** stop telling maintainers that `[]` causes zero jobs; +** decide the intended lock shape for job-level-only callers and enforce it; +** make the check advisory meanwhile. +. GOLDEN: No. +. MISCHIEF: Still exists: +** `scripts/check-lock-sync.sh:153-157` prints "GitHub refuses such a run at startup: zero jobs are created" for every desync, including the `[]` shape measured to run 15 jobs; +** the script has not changed since a41f3692 and #1154; +** #1169's comment explicitly says the "gate-text inversion that #992 describes is a separate defect". +. STATE: Not started. +. *BOT-DO* +. Steps: +** Split the message by class: step-level miss gives the startup-death text, and a job-level-only key or `[]` gives an advisory note. +** Accept `[]` *or* a record with a nested `uses:` list (#1169 shape) for job-level-only workflows. +** Add tests for both shapes in `scripts/tests/check-lock-sync-test.sh`. +** Align the result with #993's policy. + +Effort S. Tier: sonnet. +. RISK: estate-propagated gate. + +==== #993 — actions.lock policy: job-level reusable refs are reported, never required — and the pin bump that disarms the latent blocker +. governance,scope:estate,priority:p2,status:ready · 2026-09-30 · 1 +. LITERAL: +** write the rule (step-level required, job-level reported) into prose; +** document `is_advisory_category`; +** repoint consumers off `8f2ee508`; +** correct over-strict checkers; +** add a regression control; +** the comment adds: Form A (base-loaded) or Form B (head-run) lock-sync gate? +. GOLDEN: #1169 refines the rule: a job-level record without its nested `uses:` list, plus an unrecorded callee action, does startup-kill. The prose must say what the record shape must be *if present*. +. MISCHIEF: Two contradictory lock rules circulating. Still exists: +** no policy prose found; +** `lock-sync-gate.yml:62-64` is *Form B* (head-run, a PR can weaken its own judge). +. STATE: Not started. +. *OWNER-RULING*. Question: *"Should Claude standardise the estate lock-sync gate on Form A (checker loaded from the base commit, head copy used only when the base has none), yes/no?"* The recommended arm is Form A, because a gate a PR can disable is not a control. Absorbs #969. +. After the ruling: BOT-DO, M, sonnet. +** Add a "Job-level reusable refs" section to `docs/decisions/2026-10-04-actions-lock-enforcement.adoc` or the CICD canon covering the §1 rule, the #1169 record shape and `is_advisory_category`. +** Convert `lock-sync-gate.yml` to the ruled form. +** Propagate via the applier. +. RISK: estate-propagated. + +==== #994 — Cross-cutting governance reds surfaced by the actions.lock cure — 9 classes across 17 PRs +. governance,cicd,priority:p1,scope:estate,refactor,status:ready · 2026-09-30 · 1 +. LITERAL: +** determine fix/retire/accept for each of 9 classes; +** rule on the A2ML gate; +** settle the Hypatia check-name question; +** list main-red checks; +** never mute. +. GOLDEN: Partly overtaken: +** the A2ML gate was retired via #1010 (13 PRs); +** the per-repo triage lives in umbrella *#1070*; +** #1056 holds the class determinations to fold here. +. MISCHIEF: +** The four Hypatia check names remain: `Hypatia neurosymbolic scan`, `scan / Hypatia Neurosymbolic Analysis`, `hypatia / …`, `governance / Validate Hypatia Baseline`. +** The SPDX-below-gh-actions-lock-stamp false positive (#727) remains. +. STATE: Partly done. +. *OWNER-RULING*. Question: *"Should Claude converge the Hypatia scanner on ONE required-check context name estate-wide (proposed: `hypatia / Hypatia Neurosymbolic Analysis`), rebasing open PRs, yes/no?"* +** The remaining class determinations fold into #1070. +** The SPDX-stamp class takes arm (a): the checker accepts SPDX anywhere in the leading comment block (haiku). +. RISK: renaming required contexts orphans open PRs; needs deliberate rollout. + +==== #998 — ci-pipeline.yml: standards does not call its own pipeline (AC6 of #986) +. bug,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: A standards workflow `uses:` its own ci-pipeline.yml and is green. +. GOLDEN: No. +. MISCHIEF: Fixed. `.github/workflows/self-ci.yml` (header: "AC6 of #986") calls `./.github/workflows/ci-pipeline.yml`; Self-CI is green on main. +. STATE: Done (`e59aad71`, a direct push). +. *CLOSE-DONE*. Link a green Self-CI run when closing. +. RISK: none. + +==== #999 — config.ncl cannot be evaluated: std.record.merge does not exist +. bug,priority:p1,scope:repo · 2026-09-30 · 1 (RULING D169: native `&` merge, fix .schemas, add `nickel export` to CI) +. LITERAL: Fix two palimpsest-license `config.ncl` copies and add `nickel export` to CI. +. GOLDEN: Yes, partly. Both target files are now in `9-archive/…/satellites/palimpsest-license/` (frozen, and a stale snapshot of the real palimpsest-license repo, which is PMPL-register). Editing them contradicts the archive. D169's third clause, evaluate rather than only typecheck, is still the live mischief. +. MISCHIEF: A gate green over unevaluable Nickel. Still exists: +** `ci-pipeline.yml`'s nickel job runs only `format --check` and `typecheck`; +** it does not exclude `9-archive/`; +** `std.record.merge` survives in 9-archive only. +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: +** (1) In `ci-pipeline.yml` (Nickel job), add `nickel export` for non-k9 `.ncl` that are not generated-import files, ratcheted or advisory first. +** (2) Exclude `9-archive/` from the Nickel pathspec, since frozen content should not be gated. +** (3) Do not edit the archived copies; if hyperpolymath/palimpsest-license still carries `config.ncl`, open the D169 fix there. + +Effort M. Tier: sonnet. +. RISK: palimpsest-license is a PMPL-register repo; code edit only, no licence text. + +==== #1000 — 8 of 16 *.k9.ncl files lack the K9! line-1 sentinel +. bug,priority:p2,status:ready,scope:repo · 2026-09-30 · 0 +. LITERAL: Add `K9!` to the 8 files or declare the sentinel non-authoritative; audit the gates. +. GOLDEN: No. +. MISCHIEF: Fixed: +** e59aad71 added the sentinel to the 8; +** K9-CONTRACT-SPEC (#1143) makes the 3-octet envelope normative; +** re-measured, all 36 non-archive `*.k9.ncl` carry `K9!` except 3 deliberate invalid fixtures (`L0-K9-E001-bad-magic`, `E003-crlf`, `E005`). +. STATE: Done. +. *CLOSE-DONE* (`e59aad71`, #1143). +. RISK: none. + +==== #1001 — os_detect.ncl: 'Apple_Darwin falls through to the wildcard in deployment_priority +. bug,priority:p1,scope:repo · 2026-09-30 · 1 (RULING D170: explicit 'Apple_Darwin arm, drop wildcard) +. LITERAL: Add the arm, keeping all 3 copies byte-identical. +. GOLDEN: Partly. The third copy is now in 9-archive (frozen), so the byte-identical AC must relax to the 2 live copies, which sit under `1-formats/a2ml/{agentic,neurosym}/ncl/lib/`: retired-A2ML tooling directories, though `.ncl` code is not A2ML content. +. MISCHIEF: Still exists in both live copies at lines 23-29. +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: in both live `os_detect.ncl`, add `'Apple_Darwin => ""` and remove `_ =>`. The value is not ruled, so use `"container_first"`, the current behaviour made explicit. Run `nickel typecheck` on both and leave the 9-archive copy. Effort S. Tier: haiku. +. RISK: none. + +==== #1002 — Mirror to Git Forges: 3 of 7 forges failing, three different root causes +. bug,priority:p2,status:blocked,scope:repo · 2026-09-30 · 0 +. LITERAL: +** owner: create the Codeberg repo, authorise the Disroot key, decide on Gitea; +** in-repo: `::error::` on an empty host variable, then bump the pin. +. GOLDEN: D261 decides "set every forge up properly" (owner provisions). +. MISCHIEF: Still exists. Mirror to Git Forges is RED on main, and the gitea arm (`mirror-reusable.yml:334-384`) has no empty-host guard, though the other 5 arms do. +. STATE: Not started. +. *MERGE-INTO(#950)*, which carries the same reusable changes and the D261 owner provisioning list. Keep Codeberg/Disroot/Gitea owner actions as #950 checklist items. +. RISK: none. + +==== #1003 — rsr-template-repo: no ruleset requires pull requests on any branch +. governance,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: An active rsr-template-repo ruleset carries a `pull_request` rule, and the planner stops raising. +. GOLDEN: No. +. MISCHIEF: *Live again (regressed).* +** #1008 recorded adding `pull_request` to Base 23218684 on 2026-09-22, but the live GET today shows Base = `deletion, required_signatures, code_scanning, copilot_code_review, non_fast_forward`. There is no `pull_request` rule. +** Base was `updated_at 2026-10-01T23:23:22Z`. +** Canon `config/rulesets/base.json` includes `pull_request`. +. STATE: Regressed. +. *MERGE-INTO(#1008)* (same ruleset, same repair). +. RISK: ruleset write (admin). + +==== #1004 — Estate census: 124 of 456 repos carry retired or unsatisfiable ruleset rules (report only) +. governance,scope:estate,refactor,priority:p3,status:ready · 2026-09-30 · 2 +. LITERAL: The owner decides on: +** 7 retired-rule repos; +** `code_scanning alerts_threshold: all` on 123 repos; +** rulesets for evil-weevil and repo-guardian. + +Repairs go through a sanctioned applier. +. GOLDEN: No. D300 (layered rulesets, nothing armed without a blast-radius list) and D257 (strip owner bypass) frame it. +. MISCHIEF: Unverifiable estate-wide from here. rsr-template-repo (the census's positive control) still carries `alerts_threshold: all` for CodeQL and Hypatia (live GET). +. STATE: Not started. +. *OWNER-RULING*. Question: *"Should Claude trim `code_scanning` to `alerts_threshold: errors` / `security_alerts_threshold: high_or_higher` on the 123 repos (matching standards/main), via the sanctioned applier with a posted blast-radius list, yes/no?"* Secondary question: should evil-weevil (private) and repo-guardian get the L0 floor? The 7 retired-rule repos follow from #1008's repair recipe. +. RISK: bulk ruleset writes (admin). + +==== #1006 — EstateTagging's workflows rule is vacuous (workflows: []), and no Integration can create a tag org-wide +. enhancement,cicd,priority:p1,scope:estate,status:ready · 2026-09-30 · 0 +. LITERAL: Remove or populate the empty `workflows: []` rule; check applied ruleset parameters via the API; record the CI-tagging forward constraint. +. GOLDEN: No. D116 moved tag authorisation to EstateTagging; #1234 A5 (D298) is the same class of metadatastician org-ruleset write needing `admin:org`. +. MISCHIEF: Unverifiable here; the metadatastician org API is outside this session's scope. +. STATE: Not started. +. *KEEP-OPEN-BLOCKED*, on an owner `admin:org` write. Batch it with #1234 A5 (D298 Tag-Floor/Branch-Floor revert) in one blast-radius-listed PUT. Removing an empty rule needs no ruling, since vacuous gates are already ruled against. +. RISK: org ruleset write. + +==== #1007 — EstatePushing is scoped ~ALL but binds to 6 of 68 repos — push rulesets reach private repos only +. governance,priority:p1,scope:estate · 2026-09-30 · 1 (RULING D132: secret-scanning push protection plus a CI blob-size/extension gate via the shared reusables for the 62 public repos) +. LITERAL: Record the reach limitation; protect public repos by another mechanism; measure attachment per repo. +. GOLDEN: No. +. MISCHIEF: Still exists: +** governance-reusable's "Check for large files" (line 1057) is *advisory* (`::warning::`, >1M) with no extension block; +** `config/settings/repo.json` enables push protection, but applier execution is unverified; +** the reach note is not in `config/README.adoc`. +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: +** (1) Add a reach note to `config/README.adoc`: "push rulesets bind private/internal only". +** (2) Add a blob-size (10 MB, matching EstatePushing `max_file_size`) and extension gate as a new governance-reusable job, advisory on first release with a ratchet to blocking. +** (3) Verify `secret_scanning_push_protection` is applied on public repos via the settings applier (report-only census). + +Effort M. Tier: sonnet. +. RISK: estate-visible gate in a reusable (368 callers), so roll out advisory first. + +==== #1008 — rsr-template-repo Base ruleset repaired; 5-8 error-severity alerts remain (threshold semantics undetermined), and copilot_code_review may be a fifth unsatisfiable rule type +. governance,priority:p1,scope:estate · 2026-09-30 · 3 (RULING D171: measure the threshold with a paired control; drop copilot_code_review if shown unsatisfiable) +. LITERAL: Decide on copilot_code_review; triage the 8 alerts; close #193/#192. +. GOLDEN: The "repaired" premise is false today. The live ruleset has *regressed*: +** Base 23218684 (updated 2026-10-01T23:23Z) lacks `pull_request`; +** thresholds are back to `all` (CodeQL, Hypatia); +** Scorecard has been dropped; +** `copilot_code_review` is still present; +** bypass is `RepositoryRole:5` + `Integration:4187077`, contrary to D257 (strip owner bypass) and D128. +. MISCHIEF: Template PRs blocked by unsatisfiable or overly strict rules. Still exists (live GET); code-scanning alerts are 403 to this session; #1003 is the same defect. +. STATE: Regressed / not done. +. *ESTATE-CAMPAIGN* (lands on rsr-template-repo settings). Absorbs #1003. +. Steps: +** (1) Find what rewrote Base at 2026-10-01T23:23Z: candidates are the protection-floor or branch-gates appliers, or a manual edit. Stop it re-asserting. +** (2) Run the D171 paired control: one PR with only warning-severity alerts against `errors` vs `all`. +** (3) Re-converge Base to canon `config/rulesets/base.json` via the sanctioned applier, with a posted diff: `pull_request` present, thresholds errors/high_or_higher, `copilot_code_review` removed if the control shows it unsatisfiable, bypass per D257/D128. +** (4) Close rsr-template-repo #192/#193 if they are still open. + +Effort M. Tier: opus. +. RISK: ruleset write on the template (admin); outward-facing. + +==== #1010 — ci: retire the dead A2ML validation gate (13 repos — the renamed-action population) +. priority:p1,scope:estate,refactor,status:ready · 2026-09-30 · 2 +. LITERAL: Remove the dead `a2ml-ecosystem/validate-action@main` job with its lock entry in the same commit, across the Population-A repos. +. GOLDEN: The scope was corrected to 13 repos; Populations B and C are live DEED validators and must not be removed. +. MISCHIEF: Fixed. ULTRAPLAN-0929 verified 11/11 public PRs MERGED (proven-servers#90 … stapeln#75). The 2 private PRs (boj-server-mk2#47, common-signal#7) are checked by `scripts/triage-2026-09-29-apply.sh`, which has never been run. +. STATE: Done, pending confirmation of the 2 private merges. +. *CLOSE-DONE*. Owner, or a session with private-repo access, confirms boj-server-mk2#47 and common-signal#7 merged. The optional follow-up (re-point the 13 repos to `deed-ecosystem/validate-action@`) is a separate small campaign only if wanted. +. RISK: none. + +==== #1014 — governance: the Hypatia scanner pin predates the consumer fixes it scans for +. governance,priority:p1,scope:estate,chore,automation,status:ready · 2026-09-30 · 0 +. LITERAL: +** document the pin-bump policy; +** measure the delta on sampled callers before a bump; +** bump past `bc8812e`; +** state that compiled-in suppression cannot cure a consumer; +** emit the scanner commit in the summary. +. GOLDEN: No. +. MISCHIEF: Mostly fixed: +** the scanner is now an input `hypatia-ref` defaulting to `51ab6496…` (hypatia#895, 2026-10-01), post-`bc8812e` (2026-09-14) (#1121 `71bb615e`, 2026-10-02); +** the input description documents why it is pinned; +** not found: the "compiled-in suppression cannot cure your gate; use baseline/.hypatia-ignore/inline" note, and an explicit bump policy (who, cadence, evidence). +. STATE: Partly done. +. *BOT-DO* +. Steps: add a comment block beside `hypatia-ref` in both `governance-reusable.yml` and `hypatia-scan-reusable.yml` stating: +** the bump policy: owner-approved, with a sampled-caller delta posted; +** the three scanned-tree cure mechanisms. + +Ensure the resolved scanner SHA is echoed to `$GITHUB_STEP_SUMMARY`. Effort S. Tier: haiku. +. RISK: none. + +==== #1015 — check-action-pins-resolve.sh scans prose: a documentation example SHA fails the gate +. bug,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Restrict the scan to `*.yml`/`*.yaml`; add a two-direction regression control; note it in the header. +. GOLDEN: No. +. MISCHIEF: Fixed in code, but untested: +** `scripts/check-action-pins-resolve.sh:110,119` now iterate only `"$WORKFLOW_DIR"/*.yml *.yaml` (#1115 yq rewrite); +** `scripts/tests/check-action-pins-resolve-test.sh` has no README/prose case; +** the header does not state the behaviour. +. STATE: Partly done. +. *BOT-DO* +. Steps: +** Add a test: a `README.adoc` in the workflows dir with a fabricated 40-hex `uses:` passes, while the same line in a `.yml` fails. +** Add a one-line header note. + +Effort S. Tier: haiku. +. RISK: none. + +==== #1018 — rust-ci-reusable: explicit ref refs/pull/N/merge dies when the PR merges mid-run +. bug,scope:estate,priority:p2,status:ready · 2026-09-30 · 0 +. LITERAL: Replace `ref: ${{ github.ref }}` with `github.sha` (or omit it) in every checkout; add controls; bump caller pins. +. GOLDEN: No. +. MISCHIEF: Still exists at `.github/workflows/rust-ci-reusable.yml:145,171,224,273,309`. +. STATE: Not started. +. *BOT-DO* +. Steps: +** Change the 5 lines to `ref: ${{ github.sha }}`; on pull_request this is the merge commit, the same content. +** Run actionlint. +** The applier will carry the bump to absolute-zero and other callers. + +Effort S. Tier: haiku. +. RISK: none. + +==== #1019 — CodeRabbit's unsigned pushes re-kill CI on every required_signatures repo +. priority:p1,scope:estate,research,status:needs-ruling · 2026-09-30 · 0 +. LITERAL: Choose (a) make CodeRabbit sign, (b) stop it pushing, or (c) drop required_signatures; record the choice; add a check-suite probe. +. GOLDEN: Already ruled, so the `needs-ruling` label is stale: +** *D115*: (a), with fallback (b); +** *D217*: "CodeRabbit commit-pushing is off", tracked in #1091; +** *D230*: org overrides, checklist marid#66; +** `docs/SIGNING-POLICY.adoc:54-55` already says "Turn that off". +. MISCHIEF: Possibly still live. CodeRabbit commits still land: `b9e78cd4` "🔧 CodeRabbit CI Fix" (#1188, 2026-10-06), and rsr-template-repo `.coderabbit.yaml` has `finishing_touches.docstrings.enabled: true`. +. STATE: Ruled; execution tracked in #1091. +. *MERGE-INTO(#1091)*. Carry the check-suite `startup_failure` probe and the finishing_touches config note. +. RISK: none. + +==== #1024 — KYAML step 5/6 — migrate estate-authored non-bot YAML +. scope:estate,refactor,automation,priority:p3,status:blocked · 2026-09-30 · 0 +. LITERAL: Migrate non-bot YAML in reversible batches with no comment loss; exclude bots and lockfiles; re-measure. +. GOLDEN: "Blocked by #1023" is stale: #1023 is closed and ruled by *D280/D307* ("non-workflow YAML migrates now"; estate config uses `.kyaml`). +. MISCHIEF: Non-KYAML config. Partly done: +** standards migrated 22 files (#1193 `63d2bbf6`); +** the formatter `scripts/kyaml-format.sh` (#1117) exists, with the comment-preservation proof (#1067/#1021); +** the estate population of ~11k–14k files is untouched. +. STATE: Partly done (standards); estate not started. +. *ESTATE-CAMPAIGN*. Relabel `status:ready`. +. Steps: +** Per D284, the next batch is the six stapeln-ecosystem repos. +** Per repo: run `scripts/kyaml-format.sh` on estate-owned non-workflow, non-dependabot, non-lockfile YAML; rename to `.kyaml` where no tool demands the name; one revertible commit per repo; run the comment-preservation check. +** Watch #1137 (dupkey false positives on KYAML). + +Effort L. Tier: sonnet (haiku per batch). +. RISK: bulk sweep; exclude forks and third-party repos. + +==== #1025 — KYAML step 6/6 — workflows, only if step 4 rules them in scope +. migration,scope:estate,priority:p3,status:blocked · 2026-10-01 · 1 +. LITERAL: Convert workflows only once ruled in scope, after Dependabot/gh-actions-lock dispositions, with a lock-coverage shim and a jobs ≥ 1 check. +. GOLDEN: D280 put workflows in scope, but only after a yq-based lock-coverage check is a required context. CLAUDE.md: "leave them alone until then". `a695e379` (#1207) restored block YAML until the gates read KYAML; `7712ae15` (#1217) made the lock gate read `uses:` with yq. +. MISCHIEF: N/A (future work). +. STATE: Blocked. +. *KEEP-OPEN-BLOCKED* until the yq-based lock-coverage shim is a *required* context (D280) and the per-workflow keying gap noted in the comment is closed. +. RISK: startup-kill risk if done early. + +==== #1031 — CodeQL default setup and a committed advanced workflow cannot coexist — 3 metadatastician repos run both +. bug,scope:estate,priority:p2,status:ready · 2026-09-30 · 1 +. LITERAL: Pick an estate rule (default or advanced); apply it to first-post, harvard-dehallucinator and metadatastician-governance after the AC5 coverage diff; add detection. +. GOLDEN: Ruled. *D256* (2026-10-01): "Default setup. Retire `codeql*.yml` to `.github-retired/`; first re-point any required context only codeql.yml emits." This matches AC5's finding that default setup covers more: extended suite plus 4 more languages. +. MISCHIEF: Unverifiable here (other repos). Note that standards itself still carries `codeql.yml` + `codeql-reusable.yml`, so D256's applicability to standards needs a line. +. STATE: Ruled; execution not evidenced. +. *ESTATE-CAMPAIGN*. Make this the D256 carrier: 57 repos, starting with these 3. +. Steps per repo: +** (1) list required contexts emitted only by codeql.yml and re-point or remove them via the applier; +** (2) `git mv .github/workflows/codeql*.yml .github-retired/` and remove its `actions.lock` key in the *same commit*; +** (3) verify default-setup analyses continue. + +Add the AC6 detection to governance (default setup enabled AND committed codeql workflow → warn). Effort M. Tier: sonnet. +. RISK: bulk cross-repo; lock/key coupling (startup-kill if split). + +==== #1032 — O6 propagation: four contradictions between the ruling and the committed rulesets +. governance,priority:p1,scope:estate · 2026-09-30 · 2 (RULING D128: remove AI integrations from bypass; reconcile base.json/README) +. LITERAL: Resolve 4 items: (1) Integration bypass, (2) base.json required_status_checks, (3) tag-side `source_type`, (4) "zero is failure". +. GOLDEN: Rulings interact: +** *D128* removes AI integrations; +** *D257* (later) strips *owner* bypass everywhere and keeps Dependabot 29110; +** D17 originally listed claude/dependabot/github-actions/oikosbot. + +The canon must reconcile all three. +. MISCHIEF: Items 3 and 4 fixed in `bd9313a6` (`apply-tag-ruleset-canon.sh` source_type, Property 14). Items 1 and 2 still exist: +** `config/rulesets/gates-only.json` bypass still has claude 1236702 and oikosbot 2538504, plus 15368, 29110 and RepositoryRole:5; +** `base.json` still carries `required_status_checks` and bypass integrations 347564, 46505, and others. +. STATE: Partly done; D128 not executed. +. *BOT-DO* +. Steps: +** Edit `config/rulesets/gates-only.json` and `base.json` to the combined D17+D128+D257 shape: AI integrations (1236702, 2538504 and any other AI apps) removed; RepositoryRole:5 removed per D257; 29110 kept in pull_request mode; github-actions 15368 decided explicitly. +** Decide whether base.json keeps `required_status_checks` (item 2) and record the reasoning. +** Update `config/README.adoc`. +** Keep the paint-type `--no-integration-bypass` record consistent. +** Run `scripts/tests/branch-gates-apply-test.sh`. + +Estate re-convergence via the applier is a follow-up. Effort S. Tier: opus (reconciling three rulings). +. RISK: ruleset canon drives estate writes; outward-facing. + +==== #1033 — gates.json: never_required_contexts cannot catch default-setup CodeQL by name +. bug,priority:p1,scope:estate · 2026-09-30 · 1 (RULING D172: exclude by source app id, not context name) +. LITERAL: Exclude CodeQL default-setup contexts by the producing app id. +. GOLDEN: No. +. MISCHIEF: Still exists: +** `config/rulesets/gates.json` `never_required_contexts` still lists the literal `"CodeQL (default setup)"`; +** `scripts/apply-branch-gates.sh:173-189` matches by name only, with no app-id field. +. STATE: Ruled; not executed. +. *BOT-DO* +. Steps: +** Add `never_required_apps: []` to gates.json and have `apply-branch-gates.sh` drop any derived context whose check-run `app.id` is in it. +** Keep the name list for workflow contexts. +** Add a case to `scripts/tests/branch-gates-apply-test.sh` where `analyze (actions, none)` from the GHAS app is excluded. + +Effort S. Tier: sonnet. +. RISK: none. + +==== #1035 — 27 Scorecard callers omit actions:read and will startup_failure on their next standards pin bump +. meta:campaign,cicd,priority:p1,scope:estate,status:ready · 2026-09-30 · 1 +. LITERAL: All 27 callers carry an effective `actions: read`; census gives 0 LATENT-MISSING; no regressions; recurrence control; separate modshells diagnosis. +. GOLDEN: No. D325 grants `actions: read` at job level on under-granting callers, for named instances. +. MISCHIEF: Latent startup-kill. AC4 option (a) is done: `scorecard-reusable.yml` header (lines 9-14) documents the required caller scopes. The 27-repo sweep is unverified. +. STATE: Partly done. +. *ESTATE-CAMPAIGN* +. Steps: +** (1) Teach `apply-workflow-pins-remote.sh` to refuse, or co-fix, a bump whose callee job declares a permission the caller job lacks (a permission-ceiling check). +** (2) PR `actions: read` into the job block of each of the 27 Scorecard callers. +** (3) Re-census. +** (4) Open a separate issue for modshells. + +Effort M. Tier: sonnet. +. RISK: bulk cross-repo. + +==== #1036 — Scorecard reconciler fails correct repos: gh actions-lock --verify is blind to job-level reusable refs +. bug,cicd,priority:p1,scope:estate,status:ready · 2026-09-30 · 1 +. LITERAL: Make the reconciler handle both directions of job-level blindness, with tests. +. GOLDEN: No. +. MISCHIEF: Fixed: +** `scripts/reconcile-scorecard-actions-lock.rb:18,42-48` (`REUSABLE_REF`, `reusable_workflow_deps`) handles both directions (`bd9313a6`); +** follow-ups `5a0891e9`/#1168 and `043496c2`/#1183 do per-file reconciliation; +** `ruby scripts/tests/reconcile-scorecard-actions-lock-test.rb` gives 10 runs, 65 assertions, 0 failures (re-run today). +. STATE: Done. +. *CLOSE-DONE* (`bd9313a6`, #1168, #1183). +. RISK: none. + +==== #1037 — 48 open Dependabot PRs re-introduce the codeql-action v4.38.1 startup-killer, and the dependabot.yml ignore rule is being bypassed in 15 repos +. enhancement,cicd,priority:p1,scope:estate,status:needs-ruling · 2026-09-30 · 3 +. LITERAL: Close the 48 PRs; make the codeql hold effective (exclude from the group). +. GOLDEN: Yes, the premise is refuted. *#1093* measured that "4.38.1 was never broken": the startup deaths came from `actions.lock` drift (Dependabot moves `uses:` and leaves the lock). The marid evidence (comment 3) shows the "ignore bypass" was a sub-action name mismatch (`github/codeql-action/init` versus a bare name). +. MISCHIEF: Still live, but as lock drift: about 53 repos are startup-dead on 4.38.2. 23 PRs were closed and 2 await a manual close (gitbot-fleet#578, jtv-halting-islands-ct#24). `docs/DEPENDABOT-POLICY.adoc` documents the `/*` rule. +. STATE: Done as literally asked; the premise is superseded. +. *CLOSE-SUPERSEDED(#1093)*. The durable cure is lock regeneration (`dependabot-lock-regen.yml`, #968). D229's 4.38.2 hand-bump proof should also be recorded on #1093. +. RISK: none. + +''' + +=== Cross-cutting findings + +. *Close-outs drafted and never run.* `scripts/triage-2026-09-24-apply.sh` and `-29-apply.sh` were never executed, so already-resolved items are still open. Examples: #808, which those scripts close into #913, and #1010, #963 and #967. +. *The 9-archive move (2026-10-09) changed many issues.* It makes some moot and reshapes others: #914, #928, #940, #999, #1001 (3rd copy), #929, the archive halves of #937/#938, and 8 of 12 crates in #933. Yet the gates still treat the archive as live: +** Hypatia scans `9-archive/` (dozens of baseline acks point there); +** the ci-pipeline Nickel job lints it; +** only validate-sha-pins (`VENDORED_MARK`) and validate-k9 exclude it. + +One rule ("9-archive is frozen and excluded from every gate", plus a `.hypatia-ignore`) would retire a whole class of acks. The archive also has no top-level banner. `9-archive/rhodium-standard-repositories/CLAUDE.md` is still auto-loaded by agents. +. *Owner rulings are applied but not executed.* These are cheap bot work: +** D128 (#1032), D132 (#1007), D133 (#957), D168 (#929), D169 (#999), D170 (#1001), D172 (#1033); +** D313 (#944: both `.py` files are still present, and `migrate_a2ml_to_deed.sh` plans to call them); +** D131 (only partly, #941). +. *Unreviewed direct pushes and unratified decision documents.* Mistral Vibe pushed several commits straight to main with no PR: `65d9af01`, `a41f3692`, `4d606177`, `e59aad71`, `1f099de9` and `32d37263`. +** They added two decision documents titled "Decision D???", which claim owner acceptance but carry no D-number and are not on #787 or #1234: `docs/decisions/2026-10-04-{actions-lock-enforcement,deno-residue-false-positives}.adoc`. +** #1174 records another direct push breaking `kyaml-format.sh`. +. *The actions.lock rules are spread across issues that contradict each other.* #969, #992, #993, #1036, #1093 and #1169 make conflicting measured claims. Lock drift grew from 15 repos to 163 (#803). One lock-shape spec is needed, plus a verified rollout of `dependabot-lock-regen`. +. *Live regression: rsr-template-repo's Base ruleset 23218684.* It was rewritten on 2026-10-01T23:23Z and the #1008 repair is undone: `pull_request` is gone and the code-scanning threshold is back to `all`. +. *Urgent: #975.* 21 baseline acknowledgements expire on 2026-10-21, and 43 baseline entries name files that no longer exist. +. *The language-policy source still contradicts the agent instructions.* `3-practice/LANGUAGE-POLICY.adoc:60` still says "TypeScript is permitted only where AffineScript cannot reach", which `.claude/CLAUDE.md` calls too permissive. This is relevant to #921 and #659. diff --git a/docs/reorg/2026-10-14-tidy/rulings-ledger-snapshot.adoc b/docs/reorg/2026-10-14-tidy/rulings-ledger-snapshot.adoc new file mode 100644 index 000000000..07acb807f --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/rulings-ledger-snapshot.adoc @@ -0,0 +1,572 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Rulings ledger snapshot: #787 (D1 to D331) and #1234 (D332 onward) +:toc: left +:toclevels: 2 + + +Compiled 2026-10-14, read-only, from #787's body and all 70 comments, and #1234's body and its 1 comment. Fetched with the GitHub REST API (`issues/787`, `issues/787/comments?per_page=100`, `issues/1234`, `issues/1234/comments`); every comment was read. Nothing was edited or posted. + +Coverage: *317 of D1-D334* carry ruling or question text on these two surfaces (D321 and D322 are known only through #1234's summary of julia-professional-registry ADR 0003). There are also *13 F-rows* (F1-F13) and *7 session-level or unnumbered rulings*. The numbered table holds 354 rows: an id ruled more than once gets one row per event, and each later row is marked "amends". + +Status vocabulary: ruled / moot / struck / executed / pending-execution / pending (open question). "AUS" = applied-unless-struck (D113 basis). + +=== (a) Ids referenced but not found + +[cols="1,1",options="header"] +|=== +| id | what the surfaces say +| D74, D77 | Reserved on 09-22 for the post-merge rollout session (#967 census arm; 5-repo pilot wave). Only D75 and D76 were ever posted, in the 10-06 register repair. +| D88 | The D85-D87 comment ends "Next free row: *D88*". The next posting starts at D89. No D88 text exists. +| D91 | Cited by D94 as the `pull_request` ruling ("`pull_request` (*D91*)"). Never posted. +| D93 | Cited only as the memory-ledger high-water mark ("the memory ledger's was *D93*"). Never posted. +| D101, D102 | "peers booked D98-D101 concurrently"; "the D89 extension to the 163 D102 repos is applied". Neither text was ever posted. +| D236, D238 | "D236-D238 are booked in the ledger by a peer session". Only D237 was posted (10-06). +| D244 | "session e5960853 booked D239-D244 concurrently". D243 was posted (10-06); D244 never was. +| D268 | Lost in the D266-D268 collision renumbering (D270 comment). +| D273 | Cited as the 15:00Z stop plus the "findings-ledger rule and 3-session cap" (D278/D279). The ruling text was never posted. +| D279 | Cited as the "D273 bounded-items ruling, session 43a0a5a9". It withdrew D275 and D277 and defines "the D279 items" (panll#136 push, up to 21 lock-set PRs, A8 re-sign). The ruling text was never posted. +| D281 | D280 says "Next id after this row: D281", and the D282 note says "issue max 281". No D281 text exists. +| D294 | The 10-06 register repair says "next free id is D294". It was never used: D295 followed. +| D297, D315 | *Lost* with the ledger, per the #787 close-out and #1234: "A code search of the hyperpolymath estate finds neither. If either matters, it has to be asked again." +|=== + + +Posted late: D75, D76, D92, D99, D100, D103-D109, D237, D243, D274-D277 and D284-D293 were recovered from `MEMORY-RULINGS.md` and posted in the 10-06 register repair (#787 comment 63). D215-D218 were posted 09-30 (comment 44). D321 and D322 exist only via #1234 (ADR 0003 in julia-professional-registry). D98 is struck as MOOT. + +=== (b) Conventions block + +* *F4a, ruled 2026-09-14 20:50Z, estate-wide.* +. "New decisions append here as `D49`, `D50`, … Numbers are never reused and never renumbered." +. "Answered rows are struck through, not deleted." +. #637, #715, #709 and #658 "stay open as the evidence". +. Succession rule: "when this issue passes *~30 open rows*, it is re-compiled into a fresh consolidated issue that supersedes it by name and number, with a pointer comment in both directions." This fired on 09-15 and was honoured only on 10-13 (#1234). +. "A ruling is closed on the surface it governs." #1234 restates this as: "a ruling is closed on the surface it governs, and a pointer comment lands here." +* *F3a:* "A ruling is not recorded until it is written back to the surface that governs it and to memory." +* *ANSWER + CLOCK TIME + SCOPE (F4a/F9a):* every row carries all three. +* *F5a:* claim first, then act. +* *F10a:* a record binds only with provenance. +* *F12a:* grep before any estate-wide flip; if two records disagree, execute neither. +* *D113 (09-30):* "ask the consequential, apply-unless-struck on the rest. Rows with one clearly correct long-term arm are applied unless the owner strikes them; every such ruling block carries `basis: applied-unless-struck`." #1234 adds: "*Basis* is stated on every ruling: owner direct answer (selector) or applied-unless-struck (D113)." +* *D296 as #1234 cites it:* "question options name actors in the third person ('Jonathan enables…', 'Claude opens…')". ⚠ On #787, *D296 is the marid satellite-clone ruling* ("Bundle then keep"). The third-person rule there is an *unnumbered* "Owner phrasing rule (same session)", posted in the same 10-06 comment. #1234's attribution is a mislabel. +* *Id rule (#1234):* "next free id = max(id posted on this issue or #787) + 1". #787 ends at D331. #1234 holds D332-D334. *Next free id: D335.* Earlier rule: "max(ledger, issue) computed at write time, never a literal carried forward". The ledger is gone. +* *(E) methodology (09-14):* exactly one arm per row is labelled (E), the most elegant and correct long-term arm. A departure must be named, and so must its reversal. + +=== (c) Rulings that concern the structure and organisation of the standards repo itself + +*Negative finding first.* Neither #787 nor #1234 carries any ruling on: + +* the district layout (0-canon / 1-formats / 2-protocols / 3-practice / 4-readiness / 5-machine / 6-telemetry / 9-archive); +* root clutter in general; +* `docs/` disaggregation as such; +* `READINESS.md`; +* a `9-archive` move. + +A text search of every body and comment finds zero hits for each district name, for "district", and for `READINESS.md`. The only readiness file named on either surface is paint-type's `READINESS.adoc` (D156). In the local checkout (`/home/user/standards` @ `7d2041a2`), the root has `0-canon`, `1-formats`, `2-protocols`, `3-practice` and `9-archive`. No `.adoc`, `.md`, `.deed` or `.k9` file there mentions `4-readiness`, `5-machine` or `6-telemetry`. Whoever ruled the district scheme did so somewhere other than these two issues. + +The rulings that do bite on standards' structure: + +==== Root, moves in and out, docs location +* *D241 (2026-09-30, selector):* "#1095 → *delete all five unmapped roots.* PR #1097; Gate D goes from rc=1 to rc=0, and an unmapped probe makes it fail again." This is the only root-clutter ruling. It implies a root-mapping gate (Gate D) that fails on any unmapped root. +* *D25 (2026-09-15):* "`standards` is canon for `.editorconfig` / `.gitattributes` / `.gitignore`, one file each, per-language additions documented as explicit additions … phase 2 needs an SPDX-preserving merge, never an overwrite." +* *D6 (2026-09-15):* "Separate follow-up PR after `#783` merges for `CCCP-MANIFESTO.adoc` + the 4 uncovered EXPLAINME files." +* *D22 (2026-09-15):* "I scaffold `hyperpolymath/manifesto`; the owner writes the voice." The manifesto lives outside standards. +* *D135 (2026-09-30, owner text, standards#401):* "should be using a berrywiki for standards, and then your recommendation when moved to that". Recorded as: standards docs move to a berrywiki ("metadatastician/berrywiki, hierarchical notebook over the GitHub wiki"); "once moved: single source of truth, optional one-way sync, no Pages/Jekyll (D24)". +* *D295 (2026-10-06, owner verbatim):* "well, berrywiki was designed for in repo use in place of the standard github repo, and seems to be working elsewhere, so that is where it goes for now." Recorded as: the BerryWiki notebook lives at `docs/wikis/` in the repo; "Do *not* enable the GitHub wiki"; it "Generalises estate-wide 'for now': BerryWiki replaces the GitHub wiki." (Applied to marid. For standards, read with D135.) +* *D24 (closed 10-13):* "Keep Pages *only where a repo publishes a real website*; delete docs-only Pages workflows, whose docs go to BerryWiki (D295)." Execution queue: #1234 A3. +* *D134 (2026-09-30, owner text, standards#497):* "this is going now to MPL-2.0 code, and CC-BY-SA-4.0 docs". The 24 All-Rights-Reserved 007 audit docs are "RELICENSED … in place, *not moved private*". +* *D278b (2026-10-01):* "the 17 standards outreach letter drafts are left untouched." +* *D140 (2026-09-30, owner text):* "contractiles and descriptiles spec makes sense in their own combined one ... strong link to standards and the rsr-template-repo". The home is `hyperpolymath/contractiles`, "extended to a combined contractiles+descriptiles spec … k9-ecosystem pins from it. Repo rename … = owner follow-up." (Compare D312 below.) +* *D210 (09-23):* "arrival-pack single source → *rsr-template-repo*; the other 37 copies regenerate from it." +* *D164 (AUS):* "Per-repo CLAUDE.md carries a pointer to the canonical language policy, never a duplicated copy." +* *D218 (09-30):* the signing canon sits in "standards `docs/SIGNING-POLICY.adoc` plus `config/rulesets/require-*.json` (*landed, #1090*)". +* *D300 (10-06):* "The *layered ruleset scheme* (L0 Floor / L1 Integrity / L2 Flow / L3 Quality / T Tags) is adopted as the design for `config/rulesets/`. Every change adds before it removes; nothing is armed without a posted blast-radius list." +* *D269 (10-01):* "supersedes the 2026-05-29 'no unattended majors' rule in `docs/DEPENDABOT-POLICY.adoc`." +* *D256 (10-01, estate):* "Retire `codeql*.yml` to `.github-retired/`." (This is a directory convention for retired workflows.) +* *F8 (09-14):* "Six process rules become written doctrine in `standards`, PR-only." +* *D5 (09-15) and 10-06 execution:* "One shared ancestry assertion in `standards`". Landed as standards#1159, `scripts/lib/pin-ancestry.sh`. +* *D209 / D208 (asked 09-23, booked 09-30):* "write ADR-005 retroactively with the six CHANGE-PROCEDURE fields". Ratify "Always leave it working" (standards#1041, ADR-006, rule 16); its precondition was met on 09-30. +* *D331 (10-13):* "#787 closes as completed; successor #1234". + +==== A2ML retirement, deed and CHORA +* *D99 (09-23, posted 10-06):* "A2ML retirement: *find the shared source first and fix at the sender.* 14 repos emit `Validate A2ML manifests`; 0 require it." +* *D43:* asked 09-14 ("When is the A2ML / `.deed` agent clear?"). Held as owner-only on 09-23. Closed 10-13: "*Superseded by D313.* There is no agent sweep: `.a2ml` → `.deed` conversion is kcX's first front end, and the hold ends when that front end lands." +* *D73 (09-22):* "*C — convert `launcher-standard` to `.deed`*. The bunx route lands in a *live* format; `launch-scaffolder` gets a `.deed` reader; a real first increment of #837 rather than boiling 222 files." Context recorded then: standards was "at *222 `.a2ml` / 0 `.deed`*". +* *D224 (09-30):* the Julia General submission is gated on "a hyperpolymath/standards PR adding the bunx launcher route has merged". +* *D231 (09-30), registry:* "`REGISTRY.a2ml` `source_hash` drifted … Ruling: *regenerate now, migrate later.* … Moving the registry off `.a2ml` stays tracked in #1010 and #479." This is the only registry-retirement ruling. No move-off date is set. +* *D165 (AUS 09-30):* "Items 1/3/4 wait for the .deed conversion (D43: no new .a2ml writes until #837 steps 1-3)." *D196 (AUS):* "no new .a2ml write". *D269c:* "(Not a new .a2ml key — A2ML is retired.) → **Repo deed (`*_chora.deed`)**", as an `(updates …)` clause. +* *D222 (09-30, owner free text):* "do the first templates, etc. stuff and then do the 27 deletes". Rationale: "STATE.a2ml should not exist now the estate moved to .deed (with .k9 and coordination)". This was a "Departure from D43's 'conversions, never in-place edits' hold", scoped to echo-types. +* *D129 (09-30, standards#1059):* "Canon at the top; .deed attests conformance by citing canon by hash; .k9 attests execution; Nickel/serialisations derived, never restated." +* *D173 (AUS):* "deed.abnf is sole normative since #856; K9 needs a Nickel contract, not an ABNF." *D308 (10-06):* "*deed.abnf is authoritative* over the deed README (tabs, `_` in symbols, `:schema-version` order)." +* *D312 (10-06):* "*Descriptiles are clauses of `_chora.deed`*, not separate files." +* *D313 (10-06):* "a2ml→deed conversion becomes kcX's first front end (Bun shim until then). `a2ml_to_deed.py` is deleted." +* *D314 (10-06):* "Apply now: agent memory + AGENTS.md; standards PRs; rsr-template-repo PR; kcq PR." +* *D320 (10-07):* "Retired `.a2ml` files are skipped by the checker. Their IDs become v8 when kcX converts them to deed (D313). No hand conversion." Clade IDs become `:repo-uuid #u8"gv-clade-index:github.com//"`. +* *D323 (10-07):* "deed `#u8` lands in bun only … `deed_lint.js` learns `#u8` (deed.abnf v1.0.0 → v1.1.0, additive; `#u5` stays legal). `deed_lint.py` is frozen at v1.0.0 and kept only while `a2ml_to_deed.py` imports it." (D313 says that file is deleted.) +* *D203 (AUS):* "The missing artifact is rsr-profile.deed after the a2ml→deed conversion; keep it in the Canon lockstep list." +* *D305 (10-06):* "*UUIDv8 ratified* (ADR-008) … *v8 for every ID* … `#u7` literals are illegal"; "deed `#u5` folds into the v8 profile". + +==== k9 and coordination +* *D143 (09-30):* ".k9 magic becomes a Nickel comment line ('# K9!') so the file stays valid Nickel and both gates coexist — spec change in k9 SPEC." +* *D177 (AUS):* contractiles use "the estate DSL format (.k9/Nickel) … not TOML". *D310:* "*K9.Component is an open record.*" +* *D311 (10-06):* "*k9-coordination is canonical at 1.1.0.*" *D317:* grammar 1.1.1 nests `languages:` items one level under their key. *D318:* "Grammar 1.1.1 admits full-line `#` comments *between* sections … `---` stays invalid. The canonical label becomes *1.1.1* … Supersedes the '1.1.0' label of D311." +* *D213 / D214 (09-30):* actor grants live "in k9-coordination (re-expressing the dead bot_exclusion_registry axes in .k9, no a2ml edits), .deed as actor identity". "fence = WHERE … leash = WHAT". +* *D316 (10-06):* the `validate-bot-directives.sh` "staged mode is fenced to `.machine_readable/`". + +==== kyX, kyq and data formats +* *D309 (10-06):* "*kcq gen1* = strict parser for data formats only … *kcX* (new, metadatastician) = one-way projection compiler: deed + k9 + coordination are the source of truth, and Guix/Nickel/CUE/Dhall are emitted. Order: fix kcq gen1 → kcX parses deed+k9 → Nickel emitter." +* *D333 / D334 (#1234, 10-14):* "*kcq → kyq*" and "*kcX → kyX* for the planned projection compiler". Live references updated in standards#1237 (CLAUDE.md, README, deed `nostos` vocabulary, AFFIRMATION, ADR-008, the `check-uuid-v8.sh` comment). "dated records keep the name they were written with … the closed #787 and the ruling texts of D309, D313 and D320." +* *D280 (10-01):* "KYAML is the base form for *all* estate-authored YAML. *Workflows are in scope.*" Workflows migrate "only after a yq-based lock-coverage check is in place as a required context". *D307:* "Estate-owned config uses *`.kyaml`*; `.yml/.yaml` only where a tool demands the name … YAML-POLICY §3.4 is to be corrected." *D293:* Python YAML/KYAML parsers "are *not wanted*". +* *D306 (10-06):* "Every .json/.jsonl must be *I-JSON (RFC 7493) + JCS (RFC 8785)* … *Extensions unchanged* … The rule lives in standards." + +==== Gates on standards itself +* *D76:* the required set on `standards/main` is "Hypatia baseline and scan, governance, self-tests". It excludes "SonarCloud and the mirror trio until #950". *D276* later says "standards#1081: *bring SonarCloud back*". +* *D167:* "add a pinned guile to standards CI". *D169:* Nickel native `&` plus `nickel export` in CI. +* *D207:* strip the RepositoryRole-5 bypass from standards ruleset 23787415 (done). *F13:* "Optimus-Branch on standards" is guarded by name. +* *D40:* "fix the vacuous `Idris2 — a2ml proofs` context: make it run on PRs or remove it from required". +* *D232 → D240:* #1088 holds "until #1094 and #1095 are cured". +* *"governance.yml / the banned runtime" (09-15):* "*Port `governance-reusable.yml` to bun.*" + +=== Contradictions and tensions found + +==== Recorded ruling against ruling + +* *D67 (09-21) vs D67 (09-22).* Both are labelled "A", with opposite meanings: "julia-professional-registry first, General later" against "straight to General, no staging registry". The register flagged this itself on 10-06. It was resolved on 10-13 by amending D321: stay in the professional registry *and* go to General. +* *D70 (09-21) vs D226 (09-30).* D226 says "D70's npm-provenance route is *still open*" although D70-A was ruled. Closed by *D302* (10-06). +* *D84 (09-22) vs D85 (09-22).* The same question was ruled opposite ways on two repos. D84 re-scopes `code_scanning` to CodeQL + Hypatia, dropping Scorecard, for nextgen-typing. D85 says "keep Scorecard, cure #168 first" for absolute-zero. D159 later cites "D84 precedent" estate-wide. +* *D17 vs D128 / D257.* D17's literal text is "a second checks-only ruleset *with bypass = claude, dependabot, github-actions, oikosbot*", yet its stated intent is "the AI actors are HELD TO THE GATES, not exempt". D128 says "Remove AI integrations from ruleset bypass lists (held to the gates, D17 literal)". D257 says "Strip everywhere, keep Dependabot". The bypass list D17 names and the intent D17 states do not agree. +* *D19 (squash-only + linear, estate-wide) vs D216.* D216 has "193 repos with local merges keep merge commits (O8 remainder)". D216 narrows D19 without striking it. +* *D90 vs D215 / D253, and D252 vs D233.* Signing sequencing was superseded twice. D215 says "This supersedes D90's sequencing". D252 and D253 are struck as superseded by D233 and D215. +* *D125 → D221 → D242.* The allow-list PUT: the owner runs it (D125), then "Not yet, carry on" (D221), then the owner runs it again (D242). +* *D232 vs D240.* D232's hold rested on a wrong premise (erratum). D240 re-asks it with a corrected premise. +* *D116 vs D298.* D298 "Supersedes the unapplied D116". D116 removed `creation`; D298 also moves linear history and secret scanning out. +* *D263 / D264 vs D272 vs D330.* +** D263 lists 688-attack-hub as an owner's game. +** D264 says universal-modding-studio and canonical-ums are "NOT the son's". +** D272 reverses all three ("all 3 are his") and says they are untouched. +** D330 then deletes canonical-ums ("amends D272's 'untouched'"). +** The 10-13 close-out confirms D272 for the other two. +* *D114 / D120 vs D246 vs D262.* D120 kept the son's IDAp* repos AGPL. D246 makes the son's repos "AGPL … and it is his" and owner repos (echidna, 007, 007-lang, lol) MPL-2.0. D262 "SUPERSEDES the 2026-08-07 AGPL ruling" for echidna and 007-lang. +* *D278 vs itself.* "Resume the rollout" was superseded minutes later by "Stop — stay paused". D278a-d stand. +* *D311 vs D318.* The coordination-k9 canonical label went from 1.1.0 to 1.1.1. Note that standards' CLAUDE.md cites grammar v1.2 / `schema_version: 1.2.0`, and no ruling for 1.2 appears on either surface. +* *D43 vs D165 / D222.* The 10-06 register repair lists D43 under "No ruling at all", yet D165 (09-30) quotes "D43: no new .a2ml writes until #837 steps 1-3" and D222 cites "D43's 'conversions, never in-place edits' hold". D43's working content lived only in the ledger. The question was superseded by D313 on 10-13. +* *D313 vs D323.* D313 says "`a2ml_to_deed.py` is deleted". D323, the next day, keeps `deed_lint.py` "only while `a2ml_to_deed.py` imports it", which implies the file still existed. +* *D135 vs D295.* D135 puts standards docs on "metadatastician/berrywiki, hierarchical notebook over the GitHub wiki". D295 says BerryWiki "was designed for in repo use", sits at `docs/wikis/`, and "Do not enable the GitHub wiki", estate-wide "for now". Where standards' BerryWiki lives (in-repo `docs/wikis/` or the berrywiki repo) is not reconciled. +* *D140 vs D312.* D140 makes `hyperpolymath/contractiles` the home of a combined contractiles+descriptiles *spec*. D312 makes descriptiles *clauses of the chora deed*, whose grammar lives in standards (`deed.abnf`). The two can coexist (spec home vs instance format), but neither cross-references the other. +* *D143 vs the coordination.k9 convention.* D143 changes the ".k9 magic" to the Nickel comment `# K9!`. Standards' CLAUDE.md still says `coordination.k9` starts with `K9!`. D143 does not state which `.k9` family it covers. +* *D55 tiers vs D72.* D72-A adds a `packages/Marid` umbrella as tier 3. The 09-22 comment then says "D55 is now *13 packages in two tiers*, not 14 in three" (it struck RelationshipExplorer). D117 parks the umbrella "behind the evidence ledger". The umbrella was never explicitly struck. +* *D13 vs measured state.* D13(E) was "confirm no Probot Settings App install, then delete". The app *is* installed (id 1561), so the precondition fails. This is re-asked as *D332* (open). D16 independently strips 1561's bypass. +* *D119 vs execution.* D119 ruled "archive the 18 marid satellites", but D296 records that "all 18 GitHub repos 404; they were deleted, not archived as D119 ruled". +* *D3 and D2 vs surface.* #780 had merged before the D3 hold was ruled (moot). affinescriptiser#69's changes reached main by another route (D2 discharged in substance). +* *D296 numbering clash.* #1234's conventions cite "D296" for the third-person phrasing rule. On #787, D296 is the satellite-bundle ruling, and the phrasing rule is unnumbered. + +==== Ruling against the standing CLAUDE.md licence policy (flag only, no action) + +* *D134 and D246 vs CLAUDE.md category 2 ("All Rights Reserved … `hyperpolymath/007` … Out-of-scope for any normalisation").* D246 says owner repos including "007 … are *MPL-2.0*". D134 relicenses the 24 ARR 007 audit docs in standards. +* *D271 vs the CLAUDE.md Palimpsest register.* The register lists `insolvency-tycoon` as PMPL. D271 says "insolvency-tycoon is a GAME … Its 190 PMPL files flip to AGPL/CC-BY-SA". +* *D114 / D263 (games → AGPL) vs rsr-template-repo CLAUDE.md "Deny: … AGPL"*, and vs the CLAUDE.md five-way table, which has no "games" category. + +=== Ledger table + +==== Numbered rows (F-series, then D-series) + +[cols="1,1,1,1,1,1",options="header"] +|=== +| id | date | topic keywords | one-sentence ruling | status | where it bites +| F1 | 2026-09-14 21:03-21:18Z | credit use, memory index | File the three unfiled discoveries and sweep the memory index (94 of 860 topic files indexed nowhere). | ruled | memory corpus +| F2 | 2026-09-14 | answer order | Answer the 48 estate rows Tier 1 (D1-D7) first, not all at once (Claude's departure from (E), taken). | ruled | #787 +| F3 | 2026-09-14 | write-back | "A ruling is not recorded until it is written back to the surface that governs it and to memory." | ruled | every ruling surface +| F4 | 2026-09-14 20:50Z | decision surface (F4a) | #787 is the standing estate-wide decision surface; new decisions append as D49+; numbers never reused; answered rows struck not deleted; #637/#715/#709/#658 stay as evidence; succession at ~30 open rows; ruling closed on the surface it governs. | ruled | #787 -> #1234 +| F5 | 2026-09-14 | claim-first | "Claim first, then act": any session may execute an answered row after posting a claim comment and re-reading for a competing claim. | ruled | estate +| F6 | 2026-09-14 | scope carry | A ruling with no scope line still CARRIES until superseded (owner overrode Claude's session-scoped recommendation). | ruled | estate +| F7 | 2026-09-14 | resume pointer | Resume through one canonical pointer: one MEMORY.md line -> #787 -> checkpoints; pointer verified to resolve before written. | ruled | MEMORY.md +| F8 | 2026-09-14 | process doctrine | Six process rules become written doctrine in `standards`, PR-only (read body back; full 40-char SHA; every non-200 is FAIL; non-zero population; known-answer positive control; peer disagreement = different inputs first). | ruled | standards doctrine page +| F9 | 2026-09-14 | sha_pinning_required | The sha_pinning_required contradiction resolves to NEITHER; recency does not win; no session flips it until re-ruled with clock time + scope. | ruled | 385/391 repos +| F10 | 2026-09-14 | provenance | Another session's record binds only with PROVENANCE (asking session, question, owner reply); otherwise a peer assertion. | ruled | estate +| F11 | 2026-09-14 | MEMORY.md | MEMORY.md stops being hand-appended; sessions write topic files and tier-2 indexes only; index regenerated from corpus under hard byte budget. | ruled | MEMORY.md +| F12 | 2026-09-14 | contradiction detection | Before any estate-wide flip, grep the corpus for that policy name; if two records disagree, execute NEITHER and raise a row. | ruled | estate +| F13 | 2026-09-14 | ruleset guard | Re-key the ruleset guard by NAME ("Optimus-Branch on standards"), resolving name->id at use time. | ruled | standards ruleset 23359343 +| D1 | 2026-09-15 | Cloudflare token, stapeln | "the leaked Cloudflare token is DEAD; hold CLEARED"; stapeln's 19->0 gitleaks cure proceeds. | ruled | stapeln, #756 +| D2 | 2026-09-15 | affinescriptiser#69 | Reopen affinescriptiser#69 and land it as originally ruled (overrode Claude's regenerate-first). | ruled | affinescriptiser +| D2 | 2026-10-06 | surface state | PR closed, but both net changes already on main: "D2 discharged in substance". | amends - executed (in substance) | affinescriptiser +| D3 | 2026-09-15 | hypatia#780 test gate | Keep holding hypatia#780 until the test gate genuinely works; startup-death cure is the critical path. | ruled | hypatia +| D3 | 2026-10-06 | surface state | #780 merged 2026-09-14T21:10Z, before the ruling: "D3 is moot as a hold"; startup-death cure tracked separately. | amends - moot | hypatia#780 +| D4 | 2026-09-15 | orphan pins | Neither session repins the 61 orphan-pin rows until the bumper asserts ancestry. | ruled | #782, #42 +| D5 | 2026-09-15 | ancestry assertion | One shared ancestry assertion in `standards`, called by every bumper (made mandatory by D19). | ruled | standards +| D5 | 2026-10-06 | execution | standards#1159: scripts/lib/pin-ancestry.sh called by both bumpers (auto-merge armed). D4c precondition met. | amends - executed (PR) | standards scripts/lib/pin-ancestry.sh +| D6 | 2026-09-15 | manifesto, EXPLAINME | Separate follow-up PR after #783 merges for CCCP-MANIFESTO.adoc + 4 uncovered EXPLAINME files. | ruled | standards #783 +| D7 | 2026-09-15 | pin-consumption census | Re-run the pin-consumption census (execution waits for a fresh credit window). | ruled | estate +| D8 | 2026-09-23 | wordpress-tools #662 | "(a) retire/archive". | ruled | wordpress-tools +| D9 | 2026-09-23 | AGENTIC.md fleet | "(E) guarded AGENTIC.md template estate-wide (~252); fix the generator; resume the stalled 152/313 sweep." | ruled | ~252 repos +| D10 | 2026-09-23 | affinescript npm | "(a) publish the real affinescript compiler CLI to npm; (b) git/path consumption as stopgap if publish slips." | ruled | affinescript, 18 builds +| D11 | 2026-09-23 | badge pilot | "yes: boj-server is the single badge pilot before any engine." | ruled | boj-server +| D12 | 2026-10-13 | close-out | Moot: metadatastician carries six org rulesets; premise dead. | moot | metadatastician +| D13 | 2026-09-23 | Probot Settings | "(E) confirm no Probot Settings App install, then delete the dead .github/settings.yml files." Premise found false 2026-10-13 (re-asked as D332). | ruled (precondition failed) | estate .github/settings.yml +| D14 | 2026-10-13 | close-out remainder | ClusterFuzzLite cflite_* stays only on Rust/Zig repos with real fuzz targets; deleted where it runs template stubs (A2 on #1234). | pending-execution | estate +| D15 | 2026-09-23 | O4 repo moves | "later; revisit after D97 scoping." | ruled (deferred) | +| D16 | 2026-09-23 | bypass app ids | "(E) remove the three unrecognised bypass-actor app IDs (1561, 85455, 946600) after a glance at Settings -> Applications names." Execution queued A1 on #1234. | pending-execution | rulesets +| D16 | 2026-09-30 ~18:15Z | amends: bypass apps | "remove bypass from every app that never pushes to the default branch"; 85455 = Cloudflare Workers and Pages loses bypass; 1561 / 946600 owner names. | amends | rulesets (A1 on #1234) +| D16 | 2026-10-13 | close-out remainder | 1561 = Probot "Settings" (installed, never pushes); 946600 not installed; both lose bypass (A1 on #1234). | amends - pending-execution | rulesets +| D17 | 2026-09-15 | O6 gates vs bypass, #40 | "a second checks-only ruleset with bypass = claude, dependabot, github-actions, oikosbot" -- AI actors HELD TO THE GATES. Settles D42. | ruled | rulesets estate +| D18 | 2026-09-23 | Renovate Julia | "yes: Renovate stays on Julia repos until Dependabot reads the private registry." | ruled | Julia repos +| D19 | 2026-09-15 | O8 squash-only | "Squash-only + linear history, estate-wide, knowingly"; makes D5 mandatory; authorises ruleset change barred under D40/D42/D17. | ruled | 435 repos +| D20 | 2026-09-23 | metadatastician app installs | "(E) uninstall the five ownerless app installs (slack, ms-teams, thanks-dev, linear x2)." | ruled | metadatastician +| D21 | 2026-09-23 | workflow-templates | "no action on User-account workflow-templates/." | ruled | .github +| D22 | 2026-09-15 | manifesto #403 | "I scaffold hyperpolymath/manifesto; the owner writes the voice." | ruled | manifesto +| D23 | 2026-09-23 | #408 merge-options shape | "approve #408's canonical merge-options/branch-protection shape, aligned to D19a; governance/* -> new-context rename proceeds". | ruled | ~190 repos +| D24 | 2026-10-13 | close-out | Keep Pages only where a repo publishes a real website; delete docs-only Pages workflows (docs to BerryWiki, D295) (A3 on #1234). | pending-execution | 48 repos +| D25 | 2026-09-15 | dotfile canon #343 | "`standards` is canon" for .editorconfig/.gitattributes/.gitignore, one file each, per-language additions documented; SPDX-preserving merge, never overwrite. | ruled | standards; #31 phase 2 +| D26 | 2026-09-23 | the-nash-equilibrium | "bless the-nash-equilibrium as permanent v1 holdout and fix the guard defect first"; v2 migration scheduled separately. | ruled | the-nash-equilibrium +| D27 | 2026-09-23 | credential revocation | "now: revoke + purge the credential behind the 40 unbaselined findings". | ruled | +| D28 | 2026-09-23 | SonarCloud | "provision SonarCloud ... and canonise sonar.exclusions=fixtures/*,deferred/*". | ruled | estate +| D29 | 2026-10-13 | close-out | Moot: standards#245 already closed as not planned. | moot | +| D30 | 2026-09-15 | #438 recovery session | Recovery session AUTHORISED; protected-repo list derived from measured state and put back for confirmation. Unblocks AffineScript port #26. | ruled | #438, #26 +| D31 | 2026-09-23 | dead .gitmodules | "(E) delete each dead .gitmodules claim where a vendored survivor exists." | ruled | #493 +| D32 | 2026-09-23 | DYADT | "rewrite DYADT against the reference verifier spec (no unattended mint, per D34)." | ruled | patallm-gallery +| D33 | 2026-09-23 | #95 tracker | "narrow #95 to governance-audit items; close the rest as discharged." | ruled | standards#95 +| D34 | 2026-09-23 | unattended minting | "(E) no unattended repo creation; workflow_dispatch-only phase 1 still delivers enrollment." | ruled | #636 +| D35 | 2026-09-23 | scaffoldia | "build scaffoldia's composer (the living half); the dormant Haskell engine stays down." | ruled | scaffoldia +| D36 | 2026-09-23 | actuate.sh | "wire actuate.sh, behind D34's dispatch-only guard." | ruled | #633 +| D37 | 2026-09-23 | gitbot-fleet orphan commits | "(E) recover the 3 orphaned commits (incl. 632b54a) to a branch first; decide after." | ruled | gitbot-fleet +| D37 | 2026-10-13 | close-out | Discharged: rescue landed as gitbot-fleet#596 (632b54a rebuilt as d19776e). | amends - executed | gitbot-fleet +| D38 | 2026-09-23 | actions.lock vs sha pinning | "(a) regenerate actions.lock estate-wide, then pin". Re-affirmed 2026-09-30. | ruled | estate +| D39 | 2026-09-23 | allowed_actions payload | "(a) apply the canon allowed_actions payload; fallback (b) for standards itself only if the payload slips." | ruled | estate +| D40 | 2026-09-23 | Idris2 a2ml proofs context | "fix the vacuous Idris2 -- a2ml proofs context: make it run on PRs or remove it from required." | ruled | standards ruleset +| D41 | 2026-09-15 | uncommitted workflow files | "Discharged by execution on 2026-09-15": rollout committed estate-wide under owner authorisation. | executed | 504 clones +| D41 | 2026-09-23 | uncommitted workflow files | "(E) commit the 4,595 uncommitted workflow files as audited campaign work." (Already discharged 09-15 per body.) | amends - executed | +| D42 | 2026-09-15 | #40 admin bypass | Answered by D17b (same decision). | ruled (via D17) | rulesets +| D42 | 2026-09-23 | strike | "D42: STRIKE -- settled by D17b". | struck | +| D43 | 2026-10-13 | close-out | "Superseded by D313": no agent sweep; .a2ml -> .deed conversion is kcX's first front end; hold ends when it lands. | struck (superseded by D313) | estate A2ML +| D44 | 2026-09-23 | repo-guardian / oikosbot-estate | "(E) close repo-guardian and oikosbot-estate with status-banner READMEs; avoid the fix/agentic-licence-and-validate-pin branch". | ruled | repo-guardian, oikosbot-estate +| D45 | 2026-09-23 | unindexed memory | "(E) sweep the 85 unindexed memory topic files into tier-2 indexes." | ruled | memory +| D46 | 2026-09-23 | MEMORY.md eviction | "(E) adopt a written MEMORY.md eviction policy any session applies identically." | ruled | MEMORY.md +| D47 | 2026-09-23 | empty-index clones | "(E) repair or delete the 45 empty-index clones." | ruled | local clones +| D48 | 2026-09-23 | stub density | "confirm (a): declare stub debt per repo, status-banner READMEs above them." | ruled | panll etc. +| D49 | 2026-09-14 20:58Z | git identity | FIX GLOBAL, LEAVE HISTORY (no filter-branch on hypatia main). | ruled | machine git config, hypatia +| D50 | 2026-09-14 20:58Z | gcrypt vaults rulesets | BOTH: exclusion class `gcrypt-vault` (dev-notes-vault, memory-vault) AND deletion-only ruleset Gcrypt-Vault-Guard; never apply Base/Optimus-Branch etc. | executed | dev-notes-vault, memory-vault +| D51 | 2026-09-14 20:58Z | oi: verb scope | EVERYTHING INCLUDING GUIX (delivered as resolver preferring guix, falling back). | ruled | oi verb +| D52 | 2026-09-14 20:58Z | what next | Stale memory claims; harvard-dehallucinator tidies; RESUME THE SECURITY SWEEP (re-census first). | ruled | security alerts +| D53 | 2026-09-21 | Marid source of truth | "A -- the monorepo is canonical": hyperpolymath/marid holds source of truth for all 13 Julia packages; satellites become mirrors or archived (D66). | ruled | marid +| D54 | 2026-09-21 | Marid transfer | "A -- transfer all 19 repos to metadatastician" (inherits four ~ALL org rulesets). | ruled | marid family -> metadatastician +| D54 | 2026-09-21 | amends: hypatia-scan org-side | D54 acceptance added: "after transfer, hypatia-scan must be supplied org-side at metadatastician, not re-added per repo". | amends | metadatastician +| D55 | 2026-09-21 | Marid registration order | "A -- register bottom-up" after D53/D54: nine zero-dep in parallel -> four dependents -> RelationshipExplorer. | ruled | Julia registries +| D55 | 2026-09-22 | amends: General timing (precondition) | Owner precondition, verbatim: "want to stick to bun only, also to make sure that standards compliant launcher in standards is available for the bun route, and I mean bun/x" (became D73). | amends | Julia General +| D55 | 2026-09-22 | amends: wait for D56/D57 | "Wait for D56 and D57 too": family submits to General as one coherent set after renames/UUID fixes. | amends | marid +| D55 | 2026-09-22 | amends: subdir registration | "D55 registers by subdir from the monorepo" (github.com/metadatastician/marid + subdir=packages/); satellite renames MOOT; RelationshipExplorer is an example, not a registration target; D55 now 13 packages in two tiers. | amends | marid, General +| D56 | 2026-09-22 | RelationshipExplorer | Executed (marid PR #41): four blockers fixed ([package] Cargo-ism hoisted, real uuid4, compat, Manifest deleted). | executed | marid +| D57 | 2026-09-21 | ArangoDB name | "rename ArangoDB -> MaridArango" (keep UUID 719c9fe8-...; F38: UUIDs not name-derived). | ruled | marid#12 +| D57 | 2026-09-22 | ArangoDB rename | Executed (marid PR #41): ArangoDB -> MaridArango, keeps UUID 719c9fe8-.... | amends - executed | marid +| D58 | 2026-09-21 | npm scope | Scope half: "Scoped -- @metadatastician/marid-client"; publish-vs-placeholder half open (marid#13). | ruled (partial) | npm +| D58 | 2026-09-21 | npm publish (2nd half) | "publish a real 0.1.0, scoped @metadatastician/" (after D69/D70 proven: trap 7). | amends - ruled | marid#13 +| D59 | 2026-09-22 | in-toto artifact | "Both -- tarball digest and git tree hash". | ruled | marid#14 +| D59 | 2026-09-30 | amends (D225) | Subject narrowed to tree hash + subdir (D225). | amends | marid#14 +| D60 | 2026-09-21 | hypatia-scan Marid | Closed completed; surviving requirement moved to D54 acceptance: hypatia-scan supplied org-side at metadatastician. | moot (folded into D54) | marid#15 +| D61 | 2026-09-21 | marid-client TS description | "Not needing a ruling, proceeding as issues": fix description and generator (marid#16). | pending-execution | marid#16 +| D62 | 2026-09-21 | Marid clone placement | "_JULIA_LIBRARIES _SET/_MARID _SET/" (nested); against Claude's rec. | ruled | marid#17 +| D63 | 2026-09-21 | Marid codeql.yml | "fix codeql.yml (not remove)"; later found off critical path (startup failures stopped 09-20). | ruled | marid#18 +| D64 | 2026-09-21 | satellite template | Closed not planned; moot under D66-A. | moot | marid#19 +| D65 | 2026-09-22 | EstatePushing | "Give EstatePushing real push rules (not delete)"; measure blast radius first. | ruled | metadatastician, standards#887 +| D66 | 2026-09-21 | Marid satellites | "archive all 18 satellites" (transfer first, then archive: trap 4). | ruled | marid#20 +| D67 | 2026-09-21 | Julia staging registry | "julia-professional-registry first, General later" (General date not set). | ruled | marid#21 +| D67 | 2026-09-22 | amends: Julia staging | Recorded as "A -- straight to General, no staging registry"; wire a local RegistryCI AutoMerge guideline check instead. CONTRADICTS the 09-21 record of D67-A ("julia-professional-registry first"). | amends | marid#21 +| D67 | 2026-10-13 | close-out (amends D321) | 9 Marid Tier-1 packages STAY in julia-professional-registry AND also go to General now with same UUIDs after local RegistryCI AutoMerge check; both 09-21/09-22 "A" wordings superseded (A6 on #1234). | amends - pending-execution | marid, General +| D68 | 2026-09-21 (not put to UI) | Marid [compat] | Add missing [compat] (all deps + weakdeps, stdlibs included) in the PR that deletes path= Manifests; before FIRST registration (trap 6). Execute-only row. | pending-execution | marid#22 +| D68 | 2026-09-22 | Marid compat | Implemented in marid PR #34 (20 entries, check-julia-compat.jl gate, deliberately stricter than AutoMerge). | amends - executed (PR) | marid +| D69 | 2026-09-21 | tag naming | "A -- accept -v*, fix release.yml's trigger to match"; TagBot key/bypass in same change. | ruled | marid#23 +| D70 | 2026-09-21 | npm provenance under bun | "A -- bun publish + actions/attest-build-provenance on the tarball" (GitHub attestation, not npm badge). | ruled | marid#24 +| D71 | 2026-09-21 | fix@local commits | "A -- rewrite now, before D54" (2 commits on marid main). Ruled, not executed as of 09-21. | ruled | marid#25 +| D72 | 2026-09-21 | claim Marid name | "A -- register a packages/Marid umbrella" (owner chose against no recommendation; adds D55 tier 3). | ruled | marid#26 +| D73 | 2026-09-22 | launcher standard bun/bunx route | "C -- convert launcher-standard to .deed" first; bunx route lands in live format; launch-scaffolder gets a .deed reader; first increment of #837. | ruled | standards launcher/, launch-scaffolder +| D74-D77 | 2026-09-22 | reserved block | Reserved for the post-merge rollout session (standards #967 census arm, #966, #956, 5-repo pilot); only D75 and D76 were ever posted (10-06 register repair). | reserved (D75, D76 posted) | standards +| D74 | -- | #967 census arm | Reserved for post-merge rollout session (#967 census arm); text never posted. | not found | standards#967 +| D75 | ~09-2x (posted 10-06) | list-valued rule_module | One baseline entry may name several modules; schema bump + regression tests. | ruled | standards#966 +| D76 | ~09-2x (posted 10-06) | standards required checks | Require the reliably-green set on standards/main (Hypatia baseline+scan, governance, self-tests); exclude SonarCloud and mirror trio until #950 paid down. | ruled | standards#956, standards ruleset +| D77 | -- | 5-repo pilot wave | Reserved for post-merge rollout session; text never posted. | not found | +| D78 | 2026-09-22 14:27Z | residual-evidence-types CI | "Container recipe" (copy epistemic-types' Proof Safety job, digest-pinned debian, zero third-party actions). | ruled | residual-evidence-types proofs.yml +| D79 | 2026-09-22 14:27Z | rescue commit 4a4483e | "Three-way apply all 39, then fix in place" (departure from E "keep repo minimal"). | ruled | residual-evidence-types +| D80 | 2026-09-22 14:27Z | absolute-zero #125 Lean False | "Fix first" (departure from E quarantine); blocks every other absolute-zero item. | ruled | absolute-zero +| D81 | 2026-09-22 14:27Z | choreographic-types | "Correct the description and keep" (pre-registration). | ruled | choreographic-types +| D82 | 2026-09-22 20:5xZ | choreographic-types Actions billing | "(b) make choreographic-types public" (departure from E cure billing). Executed: flipped public 20:57Z after gitleaks gate. | executed | choreographic-types +| D83 | 2026-09-22 20:5xZ | agda-stdlib pin | "(a) keep agda-stdlib v2.1 (97bc55e4)". | ruled (no change) | residual-evidence-types +| D84 | 2026-09-22 20:5xZ | nextgen-typing merge gate | "(a) re-scope the code_scanning rule to CodeQL + Hypatia" (drop Scorecard); executed, #116 squash-merged no bypass. | executed | nextgen-typing ruleset 15402968 +| D85 | 2026-09-22 22:5xZ | absolute-zero Scorecard | "(b) keep Scorecard, cure #168 first" (departure from E/re-scope). Contrasts with D84 on same question. | ruled | absolute-zero ruleset 18110203 +| D86 | 2026-09-22 22:5xZ | CodeRabbit required context | "(a) drop CodeRabbit from required_status_checks, app stays advisory". | ruled | absolute-zero ruleset 18110203 +| D86 | 2026-09-23 | CodeRabbit (re-affirm) | Batch re-affirms D86(a). | amends - ruled | +| D87 | 2026-09-22 22:5xZ | how #165 lands | "(a) auto-merge, squash, once every rule passes; rule-suite must read pass". | ruled | absolute-zero#165 +| D87 | 2026-09-23 | #165 (re-affirm) | Batch re-affirms D87(a), consistent with D19a. | amends - ruled | +| D88 | -- | (not found) | Comment 26 says "Next free row: D88"; next posting jumps to D89. No D88 text located on #787. | not found | +| D89 | 2026-09-23 | allow_rebase_merge | "(a) disable allow_rebase_merge estate-wide on repos enforcing required_signatures" (D19a's enforcement arm). | ruled | 182 enforcing repos +| D90 | 2026-09-23 | signatures gap repos | "(a) fix producers first, then enforce signatures; the 163 measured-clean repos are the safe first tranche." | ruled | 227 gap repos +| D91 | -- | pull_request rule | Referenced by D94 ("pull_request (D91)") but its text not posted on #787. | referenced only | +| D92 | 09-2x (posted 10-06) | ruleset consolidation rollback | "HOLD; do not write blind" while the API is unreadable. | ruled | +| D93 | -- | memory ledger | Referenced only as the memory-ledger high-water "D93" on 09-23; text never posted (D92 posted 10-06). | referenced only | +| D94 | 2026-09-23 | base branch canon | "base branch canon = deletion + non_fast_forward ONLY", target branch ~DEFAULT_BRANCH; no CI check needed. | ruled | hyperpolymath 268 repos +| D94-D96 | 2026-09-23 | ratification | "D94-D96 ratified as booked. D97: scope & cost first; per-repo floors meanwhile." | ruled | +| D95 | 2026-09-23 | disabled Optimus-Branch | "leave the ~279 disabled Optimus-Branch rulesets DISABLED and add the base ALONGSIDE". | ruled | estate rulesets +| D96 | 2026-09-23 | base bypass | "bypass_actors: [] on the base" (safe only because no pull_request/creation rule). | ruled | estate rulesets +| D97 | 2026-09-23 | transfer more repos to org | "transfer more repos to the org" (extends D54-A); scope and cost first (census queued A4 on #1234). | pending-execution | hyperpolymath -> metadatastician +| D97 | 2026-10-13 | close-out | "Census, then decide": candidates with per-repo cost (A4 on #1234). | amends - pending-execution | +| D98-D109 | -- | (peer bookings) | Booked by peers in the ledger 09-23; D98 struck moot 09-30, D99-D100 and D103-D109 posted 10-06; D101 and D102 never posted. | block note | +| D98 | 2026-09-30 | slug-shaped contexts | D98-MOOT (struck): premise false. | moot | +| D99 | 2026-09-23 (posted 10-06) | A2ML retirement | "find the shared source first and fix at the sender" (14 repos emit Validate A2ML manifests; 0 require it). | ruled | estate A2ML validators +| D100 | 2026-09-23 (posted 10-06) | MCP github plugin | Stay on gh CLI; relaunch at owner's convenience. | ruled | +| D101 | -- | peer booking | Referenced ("peers booked D98-D101"); D98 later moot; D101 text never posted. | not found | +| D102 | -- | 163 repos | Referenced only as "the 163 D102 repos" (D89 extension applied 163/163); text never posted. | referenced only | +| D103 | 2026-09-23 (posted 10-06) | MetaManifold-WebUI rebase | Disable rebase-merge now (done), enforce required_signatures later. | executed (part) | MetaManifold-WebUI +| D104 | 2026-09-23 (posted 10-06) | second identity hypothesis | "web/UI edit" hypothesis tested and falsified; recorded as dead hypothesis, not an instruction. | moot | +| D105 | 2026-09-23 (posted 10-06) | Joshua signing doc | Write signing setup document for Joshua (done: SIGNING-SETUP.md). | executed | llm-coding-configs +| D106 | 2026-09-23 (posted 10-06) | COVERED-BY-RICHER | COVERED-BY-RICHER must require bypass_actors == []. Executed in standards#1103. | executed | standards#1103 +| D107 | 2026-09-23 (posted 10-06) | archived repos floor | Two archived repos get the floor (unarchive -> write -> re-archive). Executed 10-01. | executed | tma-mark2, avow-protocol +| D108 | 2026-09-23 (posted 10-06) | EstateBranching always actors | Trim mode=always bypass actors from EstateBranching 18225024. Executed 10-01; 0 remain. | executed | metadatastician +| D109 | 2026-09-23 (posted 10-06) | 43 blocking rulesets | Fix the 43 permanently blocking rulesets now (they require governance / Code quality + docs, which never ran). | ruled | 43 repos +| D110 | 2026-09-30 (asked 09-23) | stale-premise closures | "close stale-premise issues unilaterally" with pointer comment + state_reason citing D110; AMENDS 2026-08-27 "close only FACTUALLY-DEAD issues". | ruled | estate issues +| D111 | 2026-09-30 | priority/scope labels | Mechanical rule: p0 red default branch/live security/estate-blocking gate; p1 blocks ruled campaign or unresolved owner decision; p2 specified+unblocked; p3 roadmap. scope:estate if >=3 repos or shared workflow/ruleset. | ruled | estate labels +| D112 | 2026-09-30 | bot-filed issues | "fix the producer first" (dedupe / update-in-place) before reconciling issues it filed. | ruled | estate +| D113 | 2026-09-30 | decision cadence | "ask the consequential, apply-unless-struck on the rest"; such blocks carry `basis: applied-unless-struck`. | ruled | all rulings +| D114 | 2026-09-30 | licensing | Owner's repos -> MPL-2.0 (code) + CC-BY-SA-4.0 (docs); Games -> AGPL-3.0-or-later + CC-BY-SA-4.0; son's repos keep their licensing (switch only where it permits); non-game => MPL-2.0. | ruled | estate licences +| D115 | 2026-09-30 | CodeRabbit signing #1019 | "make CodeRabbit sign its commits consistently"; fallback "no bot pushes on signature-enforcing repos". | ruled | standards#1019 +| D116 | 2026-09-30 | Tag-Floor shape | "Tag-Floor 23868851 -> restore the D94 shape": deletion + non_fast_forward only, bypass []; needs owner re-grant of admin:org. | pending-execution | metadatastician Tag-Floor +| D117 | 2026-09-30 | Marid registration scope | "the Tier-1 nine, once gated" (after main green + #40 precompile gate + bun test CI over web/); umbrella and tier 2 wait. Narrows D55. | ruled | marid +| D118 | 2026-09-30 | Marid Dependabot codeql | Exclude github/codeql-action from actions group; bump deliberately with actions.lock regeneration. | ruled | marid +| D119 | 2026-09-30 | archive Marid satellites | "D66-A executes NOW: archive the 18 marid satellites and delete scripts/publish_all_to_github.sh". | ruled (execute) | marid satellites +| D120 | 2026-09-30 | licence populations | Games -> AGPL list (IDApTIK, metadatastician game line, airborne-submarine-squadron, megadog, the-nash-equilibrium, game tooling); NOT games -> MPL-2.0 (affinescript-vite, pow-the-game, vcl-ut, universal-modding-studio, enaction-engine); son's IDAp* keep AGPL; proof-of-work unresolved. | ruled | listed repos +| D120 / D246 | 2026-10-13 | close-out remainder | idaptik-ums (now Invisible-Door-Studios/universal-modding-studio), 688-attack-hub and proof-of-work are the son's (AGPL); canonical-ums see D330. | amends D120/D246 | Invisible-Door-Studios +| D121 | 2026-09-30 | deferred label | MetaManifold-WebUI `deferred` label folds into priority:p3. | ruled | MetaManifold-WebUI +| D122 | 2026-09-30 | major label | `major` stays repo-local (SIZE not priority); epics get meta:umbrella; no size axis in canon. | ruled | standards, affinescript +| D123 | 2026-09-30 | residual licence | MPL-2.0 code + CC-BY-SA-4.0 docs; full MPL text root LICENSE; REUSE LICENSES/; remove LICENSE.txt notice. | ruled | residual-evidence-types#14 +| D124 | 2026-09-30 | absolute-zero #176 | "census fix + restore FilesystemCNO.lean". | ruled | absolute-zero +| D125 | 2026-09-30 | allow-list PUT | 93-pattern canon allow-list PUT on residual/choreographic/echo-types run by the owner via `!`; verify by GET expecting 93. | ruled | 3 repos +| D126 | 2026-09-30 | echo-types #329 | Agent opens the curing PR on echo-types; lands only fully green. | ruled | echo-types +| D127 | 2026-09-30T14:10Z | valence-shell feeders | OWNER DOCTRINE: 19 feeder repos are FEEDERS of valence-shell; judged by what they feed it; umbrella in valence-shell + label feeds:valence-shell + THEORY-FEED doc. | ruled | valence-shell + 19 repos +| D128 | 2026-09-30T14:10Z | AI bypass removal | Remove AI integrations from ruleset bypass lists (D17 literal); reconcile base.json/README to committed rulesets. | ruled | standards#1032 +| D129 | 2026-09-30T14:10Z | canon/deed/k9 layering | "Canon at the top; .deed attests conformance by citing canon by hash; .k9 attests execution; Nickel/serialisations derived, never restated". | ruled | standards#1059 +| D130 | 2026-09-30T14:10Z | provers | Idris2 core; Agda/Lean4 admitted as named secondary provers only where already load-bearing; align language-policy.scm. | ruled | standards#1066 +| D131 | 2026-09-30T14:10Z | harden-runner | Adopt step-security/harden-runner (egress audit, SHA-pinned, in actions.lock) via shared reusables on secret-touching jobs. | ruled | standards#941 +| D132 | 2026-09-30T14:10Z | push protection public repos | Cover 62 public repos with secret-scanning push protection + CI blob-size/extension gate via shared reusables. | ruled | standards#1007 +| D133 | 2026-09-30T14:10Z | CSA echoes | Exclude CSA live-alert echoes from apply-baseline.sh; gate via ruleset. | ruled | standards#957 +| D134 | 2026-09-30T14:10Z | 007 audit docs relicence | OWNER TEXT: "this is going now to MPL-2.0 code, and CC-BY-SA-4.0 docs" -- 24 ARR 007 audit docs relicensed in place, not moved private. | ruled | standards#497 +| D135 | 2026-09-30T14:10Z | berrywiki for standards docs | OWNER TEXT: "should be using a berrywiki for standards, and then your recommendation when moved to that" -- standards docs move to metadatastician/berrywiki; once moved single source of truth, optional one-way sync, no Pages/Jekyll. | ruled | standards docs, standards#401 +| D136 | 2026-09-30T14:10Z | allowed_actions producer | Find and stop the off-tree allowed_actions writer; apply D39a payload (never 'all'). | ruled | hypatia#638 +| D137 | 2026-09-30T14:10Z | hypatia fix pipeline | Recipe-matchable pipeline with fix_script linkage, dispatch-only behind D34, piloted on ONE repo. | ruled | hypatia#369 +| D138 | 2026-09-30T14:10Z | major bumps | Accept each major bump and fix breakage by default; defer only with written per-repo justification. | ruled | .git-private-farm#96 +| D139 | 2026-09-30T14:10Z | gate format | Per-file capability granularity + path-root field for nested modules. | ruled | standards#895 +| D140 | 2026-09-30T14:10Z | contractiles+descriptiles home | OWNER TEXT: "contractiles and descriptiles spec makes sense in their own combined one ... strong link to standards and the rsr-template-repo" -- home = hyperpolymath/contractiles extended to combined spec; k9-ecosystem pins from it; rename = owner follow-up. | ruled | contractiles, k9-ecosystem#12 +| D141 | 2026-09-30T14:10Z | k9-ecosystem layout | Monorepo of sibling directories wins; retire/rewrite membership-integrity. | ruled | k9-ecosystem#35 +| D142 | 2026-09-30T14:10Z | LSP converter | OWNER OVERRODE: LSP plugin embeds its OWN document converter; no docmatrix dependency. | ruled | universal-language-server-plugin#96 +| D143 | 2026-09-30T14:10Z | .k9 magic line | .k9 magic becomes a Nickel comment line ('# K9!') so the file stays valid Nickel -- spec change in k9 SPEC. | ruled | system-et#30, k9 SPEC +| D144 | 2026-09-30T14:10Z | verisimdb canon | MPL-2.0 + CC-BY-SA-4.0 (D114), standard GOVERNANCE/CODEOWNERS, security.txt -> estate contact. | ruled | verisimdb#204 +| D145 | 2026-09-30T14:10Z | developer-ecosystem toggles | Every element togglable; target all gain a kernel backend; without backend listed but toggled OFF. | ruled | developer-ecosystem#110 +| D146 | 2026-09-30T14:10Z | BoJ MCP registry | Publish BoJ to MCP Server Registry once badge-pilot gates are green. | ruled | boj-server#188 +| D147 | 2026-09-30T14:10Z | JanusKey reversibility | Prove reversibility in JanusKey's own kernel; cross-reference absolute-zero, no dependency. | ruled | januskey#137 +| D148 | 2026-09-30T14:10Z | echidna Stage 5 | Sign off three Stage 5 preconditions TOGETHER; #194 folds into #195. | ruled | echidna#195 +| D149 | 2026-09-30T14:10Z | echidna#194 | Folded into echidna#195. | ruled | echidna#194 +| D150 | 2026-09-30T14:10Z | AffineScript Http/Async/Json | ADR for typed AffineScript primitives as typed externs, no raw escape. | ruled | echidna#266 +| D151 | 2026-09-30T14:10Z | typed-wasm Phase 3 | OWNER OVERRODE: Phase 3 runtime enforcement uses its OWN interpreter (not Wasmtime extension). | ruled | typed-wasm#51 +| D152 | 2026-09-30T14:10Z | reconciliation | Stop where a change would alter meaning: report, never normalise silently. | ruled | recon-silly-ation#68 +| D153 | 2026-09-30T14:10Z | secret type definition | Value whose flow is constrained by a confidentiality label with explicit declassification. | ruled | secret-types#2 +| D154 | 2026-09-30T14:10Z | epistemic lattice | Reuse existing lattice, prove noninterference, declassification at explicit audited points. | ruled | epistemic-types#32 +| D155 | 2026-09-30T14:10Z | docmatrix criterion 2 | Round-trip precision bound on DocMatrix output, tested in CI. | ruled | docmatrix#79 +| D156 | 2026-09-30T14:10Z | paint-type TRG | TRG = graded ladder against canon toolchain-readiness-grades criteria, recorded in READINESS.adoc. | ruled | paint-type#119 +| D157 | 2026-09-30T14:17Z (AUS) | dotmatrix seam | Document seam in ECOSYSTEM.adoc only if real data handoff exists; else 'no seam' and close. | ruled | dotmatrix-fileprinter#83 +| D158 | 2026-09-30 (AUS) | verisimdb argv | Verify argv-list calls; FP with inline suppression; fix shell interpolation. | ruled | verisimdb#203 +| D159 | 2026-09-30 (AUS) | hypatia code_scanning | Triage 71 alerts, reinstate code_scanning scoped to CodeQL + Hypatia (D84 precedent). | ruled | hypatia#470 +| D160 | 2026-09-30 (AUS) | hypatia#485 | Moot: run divergence audit and close. | moot | hypatia#485 +| D161 | 2026-09-30 (AUS) | Hypatia check run | Hypatia app always posts a check run (neutral/skipped on no-op); keep required. | ruled | hypatia#519 +| D162 | 2026-09-30 (AUS) | Logtalk invariant | Retire Logtalk-engine invariant in MUST.contractile:79; sweep INTENT.contractile. | ruled | hypatia#864 +| D163 | 2026-09-30 (AUS) | DISCUSSION_TEMPLATE | Seed DISCUSSION_TEMPLATE estate-wide; toggle question moot. | ruled | standards#411 +| D164 | 2026-09-30 (AUS) | CLAUDE.md language policy pointer | Per-repo CLAUDE.md carries a pointer to the canonical language policy, never a duplicated copy. | ruled | standards#659 +| D165 | 2026-09-30 (AUS) | #732 items | Items 1/3/4 wait for .deed conversion (D43: no new .a2ml writes until #837 steps 1-3); item 5 rule (b) unit-relative ply numbering. | ruled | standards#732 +| D166 | 2026-09-30 (AUS) | rhodibot crons | Pause the 72 mutating rhodibot crons now; remake as report-only canary (D14 keep-and-remake). | ruled | standards#759 +| D167 | 2026-09-30 (AUS) | guile in CI | Add pinned guile to standards CI to run language-policy.scm suite. | ruled | standards#928 +| D168 | 2026-09-30 (AUS) | GitHub hosting text | Estate hosted on GitHub (GitLab only mirrors); correct six lines. | ruled | standards#929 +| D169 | 2026-09-30 (AUS) | Nickel merge | Replace std.record.merge with native &; fix .schemas contracts; add nickel export to CI. | ruled | standards#999 +| D170 | 2026-09-30 (AUS) | Apple_Darwin arm | Add explicit 'Apple_Darwin arm and drop wildcard. | ruled | standards#1001 +| D171 | 2026-09-30 (AUS) | code_scanning threshold | Measure with paired control; drop copilot_code_review from Base if unsatisfiable. | ruled | standards#1008 +| D172 | 2026-09-30 (AUS) | CodeQL exclusion by source | Exclude by app id rather than context name. | ruled | standards#1033 +| D173 | 2026-09-30 (AUS) | deed.abnf normative | Delete stale 'pending owner ruling' line (deed.abnf sole normative since #856); K9 needs a Nickel contract, not ABNF. | ruled | standards#1058 +| D174 | 2026-09-30 (AUS) | template auto-merge policy | Policy step enforces documented table (block HIGH/CRITICAL and majors from auto-merge) in template; propagate to ~135 repos. | ruled | rsr-template-repo#204 +| D175 | 2026-09-30 (AUS) | Hypatia DependencyPinning | actions.lock-resolved SHAs satisfy pinning; keep SHA-pin policy. | ruled | proven-tests-and-benches#34 +| D176 | 2026-09-30 (AUS) | stable category IDs | Categories carry stable IDs; no renumbering. | ruled | proven-tests-and-benches#46 +| D177 | 2026-09-30 (AUS) | contractile format | Use estate DSL (.k9/Nickel) for contractiles, not TOML. | ruled | echo-types#188 +| D178 | 2026-09-30 (AUS) | TOPOLOGY vs ROADMAP | Keep TOPOLOGY.adoc and create ROADMAP.adoc separately. | ruled | echo-types#192 +| D179 | 2026-09-30 (AUS) | CLAUDE.md.audit | Remove 108 KB CLAUDE.md.audit from tree. | ruled | echo-types#193 +| D180 | 2026-09-30 (AUS) | scorecard permissions | Least-privilege permissions in scorecard.yml. | ruled | echo-types#268 +| D181 | 2026-09-30 (AUS) | CodeQL actions language | Set CodeQL matrix to language: actions. | ruled | echo-types#269 +| D182 | 2026-09-30 (AUS) | LICENSE SPDX exemption | Exempt LICENSE from SPDX-header rule. | ruled | echo-types#282 +| D183 | 2026-09-30 (AUS) | stateful-artefacts description | One-line description from README first sentence. | ruled | stateful-artefacts#66 +| D184 | 2026-09-30 (AUS) | clamp signature | clamp(lo, hi, value) estate-wide matching SafeMath; confirm repr(C). | ruled | proven#88 +| D185 | 2026-09-30 (AUS) | oikos Route B | Aggregation-morphism library over MacroState. | ruled | oikos-economics-accounting-dsl#59 +| D186 | 2026-09-30 (AUS) | oikos allowlist | Align to rsr-template-repo allowlist; remove SECURITY/MAINTAINERS duplicates. | ruled | oikos-economics-accounting-dsl#109 +| D187 | 2026-09-30 (AUS) | Bustfile runner | Drop the Bustfile runner unless a concrete need appears. | ruled | absolute-zero#81 +| D188 | 2026-09-30 (AUS) | OND residue list | Rename OND 'residue list'; approve two map rows. | ruled | absolute-zero#175 +| D189 | 2026-09-30 (AUS) | presswerk provenance | Record machine-filled provenance as metadata in print path. | ruled | presswerk#118 +| D190 | 2026-09-30 (AUS) | %%raw | Port every %%raw to a typed extern. | ruled | affinescript#245 +| D191 | 2026-09-30 (AUS) | one module per file | Split multi-block-module files; no new grammar form. | ruled | affinescript#262 +| D192 | 2026-09-30 (AUS) | informational gates blocking | Every informational gate green on main becomes blocking via required checks. | ruled | affinescript#557 +| D193 | 2026-09-30 (AUS) | Pat => {} | Make Pat => {} legal, parsed as unit. | ruled | affinescript#644 +| D194 | 2026-09-30 (AUS) | echidnabot publish | Ship binaries only; drop cargo publish until gitbot-shared-context published. | ruled | echidnabot#95 +| D195 | 2026-09-30 (AUS) | system-et validator | Non-Node reimplementation (bun), no AGENTIC override. | ruled | system-et#18 +| D196 | 2026-09-30 (AUS) | gv-clade-index phase | Correct phase as part of .deed conversion (no new .a2ml write). | ruled | gv-clade-index#96 +| D197 | 2026-09-30 (AUS) | BoJ name origin | Record name origin or drop reference. | ruled | boj-server#198 +| D198 | 2026-09-30 (AUS) | validate-template.sh | Delete with its wiring in de-templating PR. | ruled | snifs#59 +| D199 | 2026-09-30 (AUS) | rebase-onto-base | Adopt automated rebase-onto-base after squash-merge. | ruled | .github#13 +| D200 | 2026-09-30 (AUS) | k9-ecosystem submodules | Pin submodules to reviewed SHAs; gate via membership-integrity. | ruled | k9-ecosystem#14 +| D201 | 2026-09-30 (AUS) | paint-type eval | Rewrite without eval; no waiver. | ruled | paint-type#111 +| D202 | 2026-09-30 (AUS) | berrywiki ADR-0004 | Verify empirically on rendered wiki page; amend ADR if needed. | ruled | berrywiki#61 +| D203 | 2026-09-30 (AUS) | rsr-profile.deed | Missing artifact is rsr-profile.deed after a2ml->deed; keep in Canon lockstep list. | ruled | marid#31 +| D204 | 2026-09-30T14:29Z | filesystem reversibility model | ONE model: absolute-zero factors out ABSTRACT CNO interface; valence-shell proves is_CNO over its own FS model; januskey refines; FilesystemCNO.v retires or becomes toy. | ruled | nextgen-typing#118, absolute-zero#167 +| D205 | 2026-09-30T14:29Z | zerostep dropped | zerostep DROPPED from D127 feeder set; 17 feeders remain. | amends D127 | valence-shell +| D206 | 2026-09-30T14:29Z | feeds label | feeds:valence-shell stays REPO-LOCAL, not canonical. | ruled | labels +| D207 | 2026-09-30T14:28Z | standards ruleset bypass | STRIP RepositoryRole 5 (pull_request) bypass from standards ruleset 23787415 (added with no ruling, contradicting D96). Done. | executed | standards ruleset 23787415 +| D208 | 2026-09-23 (booked 09-30) | "Always leave it working" | Ratify standards#1041 / ADR-006 / rule 16 AFTER the Immutable-Tags repair (precondition met 09-30; owner-ready). | pending (ratification owner-ready) | standards ADR-006 +| D209 | 2026-09-23 | Rule 15 Elegance | Ratify properly: write ADR-005 retroactively with six CHANGE-PROCEDURE fields. | ruled | standards ADR-005 +| D210 | 2026-09-23 | arrival-pack source | arrival-pack single source = rsr-template-repo; 37 copies regenerate from it. | ruled | rsr-template-repo +| D211 | 2026-09-23 | credentials | All four in scope: OikosBot key+install, codecov token, Renovate/Sonar binding, ANTHROPIC_API_KEY org secret; owner-minted, agent wires. | ruled | estate secrets +| D212 | 2026-09-30 14:3xZ | marid #56 supersession | Superseding PR marid #58 (signed d3afb4e); #56 closed; bot commit dropped. | executed | marid +| D213 | 2026-09-30 14:3xZ | bot/agent actor grants | Protocol + compiler + marid fix: actor grants in k9-coordination (no a2ml edits), .deed as actor identity, compiler emitting bypass lists/bot configs/PreToolUse hook; marid .coderabbit.yaml now. | ruled | standards, k9-coordination, marid +| D214 | 2026-09-30 14:3xZ | leash vs fence | fence = WHERE (paths/repos), leash = WHAT (verbs); compose. | ruled | k9-coordination +| D215 | 2026-09-30 | signature floor sequencing | "Clean repos now, the rest after": standalone zero-bypass Require-Signed-Commits on 66 clean repos now; rest as producers convert (standards#1091). Supersedes D90's sequencing. | executed (66/66) | 66 repos +| D216 | 2026-09-30 | linear history | "255 safe + squash-only": Require-Linear-History (zero bypass) + squash-only on 255 repos; 193 with local merges keep merge commits. Executed on 252 (vaults excluded). | executed | 252 repos +| D217 | 2026-09-30 | apps/bots signing | "Convert all to API signing": every app/bot/workflow write via createCommitOnBranch / signed-push or squash; CodeRabbit commit-pushing off. | pending-execution | standards#1091 +| D218 | 2026-09-30 | signing canon placement | All three: standards docs/SIGNING-POLICY.adoc + config/rulesets/require-*.json (landed #1090), rsr-template-repo (#212), per-repo CONTRIBUTING "Signed commits" (~448 PRs). | partly executed | standards docs/, config/rulesets/, rsr-template-repo +| D219 | 2026-09-30 | residual LICENSE PR #14 | "Land now"; landed c622c369. | executed | residual-evidence-types +| D220 | 2026-09-30 | absolute-zero PR #177 | "Cure actions.lock first, then land". | ruled | absolute-zero +| D221 | 2026-09-30 | allow-list PUT | "Not yet, carry on" -- defers the owner-run `!` PUT; supersedes 11:20Z "Running it now" (D125). | amends D125 | 3 repos +| D222 | 2026-09-30 | echo-types #331 | Free text: "do the first templates, etc. stuff and then do the 27 deletes"; echo-types deletes all 27 .a2ml (STATE.a2ml should not exist); departure from D43 hold. | ruled | echo-types +| D223 | 2026-09-30 | OWASP-only doctrine | Every tool/application uses only OWASP-safe practice, including agents' REST/GraphQL calls (safe reads, write verbs only when ruled, no write across redirect, spaced calls, honour Retry-After, no secrets in URLs, checksum downloads, no curl-pipe-to-sh). | ruled | estate +| D224 | 2026-09-30 | D55 General timing | "Date, gated on a bunx PR": submit only once a standards PR adding the bunx launcher route has merged; proposed date 2026-10-14 (applied-unless-struck). | ruled | marid, standards launcher +| D225 | 2026-09-30 | D59 attestation subject | "Attest tree hash + subdir" (exactly what General records, not a tarball). | amends D59 | marid#14 +| D226 | 2026-09-30 | JS package shape | "Fix imports + bun test, 0.1.0"; D70 provenance route still open and gates first publish. | ruled | marid#13, #24 +| D227 | 2026-09-30 | SonarCloud marid | "Move to metadatastician org"; owner creates org/token. | ruled | marid#49 +| D228 | 2026-09-30 | 8080-class ports | "One issue, all 23 files" (done, #51 re-scoped). | executed | marid#51 +| D229 | 2026-09-30 | codeql-action 4.38.2 | Owner verbatim: "can you do 2 but ensure that that proof is proritised with an agent" -- marid waits for estate-wide proof 4.38.2 loads/runs, then one signed PR. | ruled | marid +| D230 | 2026-09-30 | CodeRabbit write paths | "You set org overrides"; checklist marid#66 with positive control. | ruled | marid#66 +| D231 | 2026-09-30 | REGISTRY.a2ml source_hash drift | "regenerate now, migrate later": one-line generator hash fix; moving registry off .a2ml tracked in #1010/#479. | ruled | standards#1092, REGISTRY.a2ml +| D232 | 2026-09-30 | #1088/#1087 hold | "hold until #1014 is cured"; premise later found wrong (erratum), re-asked as D240. | amended (by D240) | standards#1088 +| D232 | 2026-09-30 | erratum | D232 premise wrong (red is uuid-v7.yml findings, not #1014); owner re-asked. | amends | standards +| D233 | 2026-09-30 | bypass-only floors | "Add floor to 164": standalone zero-bypass signature floor on clean ones now; 18 dirty on #1091. Executed. | executed | 164 repos +| D234 | 2026-09-30 | rsr-template-repo#212 | Owner merges from UI; agent does not use bypass. | ruled | rsr-template-repo +| D235 | 2026-09-30 | gcrypt vault exclusion | "Restore D50 on all 3": vaults EXCLUDED from every signing/linear/base-floor ruleset by explicit 3-member list (dev-notes-vault, memory-vault, claude-config-vault), never by /vault/ regex. Executed. | executed (amends D50) | 3 vaults +| D236-D238 | -- | (peer ledger) | Booked in the ledger by a peer session 09-30; only D237 was posted (10-06 register repair); D236 and D238 never posted. | block note | +| D237 | 2026-09-30 (posted 10-06) | required context floor | Every default-branch ruleset gets >=1 required status context so --auto queues; census first. | ruled | estate rulesets +| D239 | 2026-09-30 ~16:15Z | absolute-zero code-owner deadlock | Repair ruleset 18110203 to canon: owner PUT flipping require_code_owner_review and require_extra_approval_for_unattributed_changes to false. | ruled | absolute-zero +| D240 | 2026-09-30 | #1088 hold | "hold until #1094 and #1095 are cured" (re-asks D232 with corrected premise). | ruled (amends D232) | standards#1088 +| D241 | 2026-09-30 | #1095 unmapped roots | "delete all five unmapped roots" (PR #1097). | ruled | standards root, Gate D +| D242 | 2026-09-30 | allow-list PUT | Canon allow-list on residual/choreographic/echo-types -> the owner runs the PUT. | ruled | 3 repos +| D243 | 2026-09-30 ~16:2xZ (posted 10-06) | D237 floor context | D237 floor is `scan / gitleaks` after unifying caller job key to `scan`; integration_id = GitHub Actions. | ruled | estate rulesets +| D244 | -- | (session e5960853) | Booked concurrently with D239-D243 per the D245 note; never posted (D243 was posted in the 10-06 register repair). | not found | +| D245 | 2026-09-30 | CONTRIBUTING signed-commits PRs | "Open all, I merge as they go green": only where a zero-bypass required_signatures floor is verified; per-PR merge, squash, no --auto. | pending-execution | ~448 repos +| D246 | 2026-09-30 | licence ownership (amends D114/D120) | Son's repos: AGPL-3.0-or-later "and it is his"; owner's distinguishable contributions may be MPL-2.0; "No carving up of files"; owner's repos (echidna, 007, 007-lang, lol, other non-game) MPL-2.0; docs/non-code CC-BY-SA-4.0. canonical-ums, 688-attack-hub, idaptik-ums open. | amends D114/D120 | estate licences +| D247 | 2026-09-30 | MetaManifold R | renv.lock is source of truth; Guix/host supplies R 4.5.x + system libs. | ruled | MetaManifold +| D248 | 2026-09-30 | MetaManifold Julia | "(b) outside Guix": official tarball sha256-pinned in tool_versions.yml. | ruled | MetaManifold +| D249 | 2026-09-30 | swarm/trimAl/IQ-TREE/gappa | Private channel as staging, then upstream to Guix proper. | ruled | MetaManifold +| D250 | 2026-09-30 | MetaManifold bun | Keep, installed by pinned checksummed download. | ruled | MetaManifold +| D251 | 2026-09-30 | B-track | Live, as upstream PRs, one piece at a time; fork main equals upstream. | ruled | MetaManifold +| D252 | 2026-09-23 | strip :always bypasses | "Strip all :always bypasses on the 69 repos" -- superseded by D233. | struck (superseded) | +| D253 | 2026-09-23 | 64 would-break repos | "re-measure, enforce the subset now clean" -- superseded by D215. | struck (superseded) | +| D254 | 2026-09-23 | unsigned forensic | Deeper forensic on unsigned configured-identity commits -- done. | executed | +| D254 | 2026-10-01 | amends: forensic correction | hermeneia x5 are merge-commit carries (D216 cures); corrected split 33/12/37/1 = 83, nothing unresolved. | amends | +| D255 | 2026-09-23 | MetaManifold-WebUI signing | "measure inflow first, then decide" -- measured: 4 unsigned (all Joshua); enforcement stays deferred. | executed (measure); enforcement deferred | MetaManifold-WebUI +| D256 | 2026-10-01 | CodeQL configured twice | "Default setup"; retire codeql*.yml to .github-retired/ after re-pointing required contexts. | ruled | 57 repos +| D257 | 2026-10-01 | owner bypass | "Strip everywhere, keep Dependabot" (29110, pull_request mode); vaults excluded by name; strip only once required contexts emitted+green and code-owner booleans false. | ruled | 141 hp + 50 md rulesets +| D258 | 2026-10-01 | Codeac OAuth | "Reinstall it as an App" (owner action). | ruled (owner action) | +| D259 | 2026-10-01 | 5 unemitted contexts | "Repair where possible, else drop". | ruled | +| D260 | 2026-10-01 | hypatia-scan red | "Both": hypatia maps warn->medium now; callers repinned to standards bd9313a6+; mapping removed after census. | ruled | ~354 repos +| D261 | 2026-10-01 | mirror.yml red | "Set every forge up properly": owner provisions Gitea, Codeberg, Disroot key, Bitbucket workspace; verify destination HEAD == GitHub HEAD; no forge quietly disabled. | ruled (owner action) | ~165 repos +| D262 | 2026-10-01 | echidna + 007-lang licence | MPL-2.0 code / CC-BY-SA-4.0 docs; SUPERSEDES the 2026-08-07 AGPL ruling; rewrite AGPL-enforcing gates too. | ruled | echidna, 007-lang +| D263 | 2026-10-01 | games list | Games keep AGPL-3.0-or-later / CC-BY-SA-4.0: the-nash-equilibrium, airborne-submarine-squadron, 688-attack-hub, game-server-admin, chronicles-of-slavia. | ruled (amended by D272) | listed repos +| D264 | 2026-10-01 | NOT the son's | chronicles-of-slavia, universal-modding-studio, enaction-engine, canonical-ums are NOT the son's; non-games -> MPL-2.0/CC-BY-SA. | ruled (amended by D272) | listed repos +| D265 | 2026-10-01 | PMPL->MPL rollout | Pilot PMPL->MPL/CC-BY-SA on claude-integrations, then one PR per repo over 32 PMPL-bearing repos; exclude palimpsest-license + 3 gcrypt vaults. | amended by D270; paused (D273/D278) | 32 repos +| D266 | 2026-10-01 | squabble rollout | GitHub App with access to all repos on hyperpolymath + metadatastician; advisory check, never required. | ruled (owner install) | cicd-squabbler#122 +| D267 | 2026-10-01 | App hosting | Owned compute (farm). | ruled | cicd-squabbler +| D268 | -- | (collision) | D266-D268 collision renumbered; D268 is the ledger max referenced by D269 ("ledger 268"); no separate D268 text on #787. | not found | +| D269 | 2026-10-01 | dependency updates | D269a "Merge majors on green"; D269b "Add a required build check first"; D269c toggle lives in "Repo deed (*_chora.deed)" -- (updates ...) clause, not a new .a2ml key; D269d "Pipeline first, intel as phase 2". Supersedes 2026-05-29 "no unattended majors" in docs/DEPENDABOT-POLICY.adoc. | ruled | standards docs/DEPENDABOT-POLICY.adoc, repo deeds +| D270 | 2026-10-01T12:5xZ | licence rollout shape (amends D265) | ONE PR per repo covering all three PMPL residue classes; all 29 queued repos in ONE pass. | ruled; paused | 29 repos +| D271 | 2026-10-01 | insolvency-tycoon | insolvency-tycoon is a GAME: code AGPL-3.0-or-later, docs CC-BY-SA-4.0; its 190 PMPL files flip to AGPL/CC-BY-SA, NOT MPL. | ruled | insolvency-tycoon +| D272 | 2026-10-01 | amends D263 + D264 | 688-attack-hub, universal-modding-studio, canonical-ums are the SON's => untouched ("New answer: all 3 are his"). | amends D263/D264 | 3 repos +| D273 | -- | stop / findings-ledger / 3-session cap | Referenced by D278 (15:00Z peer-relayed stop; findings-ledger rule; 3-session cap) but not posted on #787 in what was read. | referenced only | +| D274 | 2026-10-01 ~22:1xZ (posted 10-06) | close-out items | (a) close 7 A8 launcher PRs; (b) roll back D3 merge setting on claude-config-vault; (c) diagnose 8 BLOCKED + 4 RED D243 caller PRs; (d) lock records for 21 lock-set repos. | ruled | +| D275 | 2026-10-01 (posted 10-06) | BULK_OK D243 | Recreate BULK_OK for remaining D243 rollout -- Withdrawn by D279. | struck | +| D276 | 2026-10-01 (posted 10-06) | SonarCloud standards | standards#1081: bring SonarCloud back, keeping ruleset 23787415's requirement. | ruled | standards#1081 +| D277 | 2026-10-01 (posted 10-06) | billing-dead private repos | Floor the 6 billing-dead private repos anyway -- Withdrawn by D279. | struck | +| D278 | 2026-10-01 ~22:2xZ | D270 rollout resume | "Resume the rollout" for 29 D270 repos only -- then SUPERSEDED minutes later by "Stop -- stay paused". | struck (superseded) | +| D278a | 2026-10-01 | DUAL LICENSE LICENSE.txt | "Verbatim MPL-2.0" (stands for when rollout resumes). | ruled | 57 LICENSE.txt +| D278b | 2026-10-01 | Palimpsest Stewardship Council holder | "Holder -> hyperpolymath" in SPDX-FileCopyrightText; 17 standards outreach letter drafts untouched. | ruled | ~30 files +| D278c | 2026-10-01 | rhodibot AGPL->PMPL sed | "Delete the rewrite step". | ruled | 28 rhodibot.yml +| D278d | 2026-10-01 | PMPL on prose | "Prose -> CC-BY-SA-4.0"; code/workflows/configs/LICENSE grants -> MPL-2.0 (insolvency-tycoon -> AGPL). | ruled | +| D279 | 2026-10-01 | bounded items (D273) | Booked in ledger by session 43a0a5a9 for "the D273 bounded-items ruling"; text not posted on #787 in what was read. | referenced only | +| D280 | 2026-10-01 | KYAML scope | "KYAML is the base form for all estate-authored YAML. Workflows are in scope." Non-workflow YAML now (#1024); workflows (#1025) only after a yq-based lock-coverage check is a required context. (Basis facts later corrected; choice unchanged.) | ruled | standards#1023, estate YAML +| D281 | -- | (never posted) | D280 says "Next id after this row: D281" and the D282 posting says issue max was 281, but no D281 ruling text exists on #787. | not found | +| D282 | 2026-10-01 ~23:1xZ | BULK_OK | "Yes, for the D279 items only"; removed when session ends. | ruled | +| D283 | 2026-10-02 ~00:3xZ | secret-scanner lock key [] | "Hand-set the key to []" in same signed PR; one substitution only. 19/21 merged. | executed | standards#1108, lock-set repos +| D284 | 2026-10-02 (posted 10-06) | KYAML follow-through | One throwaway probe on standards (keyed deed-conformance.yml); #1024 next batch = six stapeln-ecosystem repos; bot-read YAML converts, drift accepted in writing. | ruled | standards, stapeln repos +| D285 | 2026-10-02 (posted 10-06) | BULK_OK 3 PRs | Moot: all 3 had merged. | moot | +| D286 | 2026-10-02 (posted 10-06) | MetaManifold-WebUI#17 | Independent Julia package, one API, two backends (pure Julia + R MGLM via RCall), cross-validated. | ruled | MetaManifold-WebUI +| D287 | 2026-10-02 (posted 10-06) | prover | Agda; MetaManifold becomes a named D130 exception. | ruled | MetaManifold +| D288 | 2026-10-02 (posted 10-06) | hosting | New hyperpolymath repo (MPL-2.0 code, CC-BY-SA-4.0 docs); upstream gets small AGPL adapter PR. | ruled | new repo +| D289 | 2026-10-02 (posted 10-06) | #17 ACs | Validate against R MGLM <=1e-3 + planted-truth simulations; drop songbird match and Python/TensorFlow route. | ruled | MetaManifold-WebUI#17 +| D290 | 2026-10-02 (posted 10-06) | DM parameterisation | Adopt MGLM's DM parameterisation (posted). | executed | MetaManifold-WebUI#22 +| D291 | 2026-10-02 (posted 10-06) | scan key | Also move epistemic-types, deed-ecosystem, firmboot to canonical `scan` key. | ruled | 3 repos +| D292 | 2026-10-02 (posted 10-06) | occupancy-types Python | Rewrite the Python session-IR checker on bun/bunx; no exemption. | ruled | occupancy-types +| D293 | 2026-10-02 (posted 10-06) | Python YAML parsers | Python YAML/KYAML parsers carried by KYAML migration are not wanted; remove or replace on bun/bunx. | ruled | estate +| D294 | -- | (never assigned) | Register repair said "next free id is D294"; no D294 ruling was ever posted (D295 booked next). | not found | +| D295 | 2026-10-06 | BerryWiki in-repo | Owner verbatim: "berrywiki was designed for in repo use in place of the standard github repo ... so that is where it goes for now." Marid wiki at docs/wikis/; do not enable GitHub wiki; generalises estate-wide "for now": BerryWiki replaces the GitHub wiki. | executed (marid PR #72) | marid docs/wikis/, estate +| D296 | 2026-10-06 | marid satellite clones | "Bundle then keep": 18 satellite clones (GitHub repos were deleted, not archived as D119 ruled) bundled to dev-notes; archive dirs left; stale hub branch deleted; closes marid#20. | executed | dev-notes, marid +| D297 | -- | lost | Booked in ledger (next free after D296); lost with the workstation wipe. | lost | +| D298 | 2026-10-06 | metadatastician floors revert | Branch-Floor 23868655 + Tag-Floor 23868851 revert to canon: deletion + non_fast_forward, bypass []; linear history + secret scanning move to own layers; supersedes unapplied D116. Precondition measured 10-06 (safe if both rules leave in same PUT). | pending-execution (A5 on #1234) | metadatastician +| D299 | 2026-10-06 | metadatastician merge method | Proof PRs squash only; rebase leaves allowed_merge_methods; allow_rebase_merge false on 9 repos. | ruled | metadatastician +| D300 | 2026-10-06 | layered rulesets | Layered ruleset scheme (L0 Floor / L1 Integrity / L2 Flow / L3 Quality / T Tags) adopted as design for config/rulesets/; add before remove; posted blast-radius list before arming. | ruled | standards config/rulesets/ +| D301 | 2026-10-06 | coverage rule | Coverage rule (min 80 on ~ALL) measured, then tiered via rsr_tier; unchanged until tiers assigned. | ruled | rulesets +| D302 | 2026-10-06 | closes D70 | bun publish + actions/attest-build-provenance on the tarball (not npm-native badge). | ruled (closes D70/D226) | marid#24 +| D303 | 2026-10-06 | mirror bundle recovery | Bundles must recover from history rewrites, deleted refs, deleted repos and whole-account loss. | ruled | mirrors +| D304 | 2026-10-06 | mirror store host | Mirror bundles in a dedicated encrypted store off GitHub, not dev-notes; host still to be chosen (open on #1234 B). | pending (host open) | mirrors +| D305 | 2026-10-06 | UUIDv8 | UUIDv8 ratified (ADR-008); v7 gate replaced by v8 (add-before-remove); "v8 for every ID"; #u7 illegal; deed #u5 folds into v8 profile. | ruled | standards ADR-008, gates +| D306 | 2026-10-06 | I-JSON + JCS | Every .json/.jsonl must be I-JSON (RFC 7493) + JCS (RFC 8785), ijson-jcs --check gate; extensions unchanged; rule lives in standards. | ruled | standards JSON-POLICY +| D307 | 2026-10-06 | .kyaml extension | KYAML content everywhere (D280); estate-owned config uses .kyaml; .yml/.yaml only where a tool demands the name; YAML-POLICY s3.4 to be corrected. | ruled | estate YAML, standards YAML-POLICY +| D308 | 2026-10-06 | deed.abnf authority | deed.abnf is authoritative over the deed README. | ruled | standards 1-formats/deed +| D309 | 2026-10-06 | kcq / kcX | kcq gen1 = strict parser for data formats only; kcX (new, metadatastician) = one-way projection compiler, deed + k9 + coordination are the source of truth, Guix/Nickel/CUE/Dhall emitted. (Renamed by D333/D334.) | ruled | kcq/kyq, kcX/kyX +| D310 | 2026-10-06 | K9.Component | K9.Component is an open record; restore tails removed by #1154 (settles #1165). | ruled | standards k9 +| D311 | 2026-10-06 | k9-coordination version | k9-coordination canonical at 1.1.0 (label superseded by D318). | ruled (amended by D318) | standards 2-protocols/k9-coordination +| D312 | 2026-10-06 | descriptiles | "Descriptiles are clauses of _chora.deed, not separate files." | ruled | every repo +| D313 | 2026-10-06 | a2ml->deed conversion | "a2ml->deed conversion becomes kcX's first front end (Bun shim until then). a2ml_to_deed.py is deleted." | ruled | standards 1-formats/deed/tools, kyX +| D314 | 2026-10-06 | apply now | Apply now: agent memory + AGENTS.md; standards PRs; rsr-template-repo PR; kcq PR. | ruled | standards, rsr-template-repo, kcq +| D315 | -- | lost | Booked in ledger (next free after D314); lost with the workstation wipe. | lost | +| D316 | 2026-10-06 | bot-directives gate | Fix validate-bot-directives.sh staged-mode false positive first in own PR, then re-make k9 commit with hooks; no --no-verify. Executed (#1179). | executed | standards +| D317 | 2026-10-06 | coordination-k9 1.1.1 languages | languages: items nest one level under their key (indent2). | ruled (in #1182) | standards 2-protocols/k9-coordination +| D318 | 2026-10-06 | coordination-k9 1.1.1 comments | Full-line # comments between sections (rule gap); --- invalid; canonical label becomes 1.1.1; supersedes D311's 1.1.0 label. | amends D311 | standards 2-protocols/k9-coordination +| D319 | 2026-10-06 | uuid-v8 branch | Cherry-pick c5c6c891, open PR, delete stale feat/adr-008-ratify-uuid-v8 after verifying. Executed (#1180). | executed | standards +| D320 | 2026-10-07 | UUID v8 strict | check-uuid-v8.sh --strict in governance-reusable.yml and uuid-v7.yml; retired .a2ml skipped (IDs become v8 when kcX converts, D313); clade IDs to ADR-008 profile C; Julia package uuid re-minted v8. Landed #1197. | executed | standards, governance-reusable.yml +| D321 | 2026-10-07 (ledger-only; via ADR 0003) | Marid Tier-1 registry | Marid Tier-1 packages register in the professional registry now; one owner-chosen package to General later. Executed (registry PR #109). | executed; amended 2026-10-13 | julia-professional-registry +| D322 | 2026-10-07 (ledger-only; via ADR 0003) | Marid UUIDs v8 | Their UUIDs re-minted as UUIDv8 profile T before registration. | executed | julia-professional-registry +| D323 | 2026-10-07 | deed #u8 bun-only | python/bun parity step removed; deed_lint.js learns #u8 (deed.abnf v1.0.0 -> v1.1.0 additive; #u5 stays legal); deed_lint.py frozen at v1.0.0 while a2ml_to_deed.py imports it. Landed #1198. | executed | standards 1-formats/deed +| D324 | 2026-10-13 | bot refusals intended | GitHub refusing dependabot[bot], coderabbitai[bot], arena-ai-coding-agent[bot] in metadatastician is intended; CI-Health treats as policy. | ruled | metadatastician-governance#63 +| D325 | 2026-10-13 | actions: read grants | Grant actions: read at job level on under-granting reusable callers (cadastra, consent-aware-web, kcq). | ruled | listed repos +| D326 | 2026-10-13 | lock-only regen | Claude regenerates actions.lock lock-only, workflow YAML byte-for-byte unchanged, SHA pins literal (D38a); one PR per repo. | ruled | metadatastician repos +| D327 | 2026-10-13 | kcq @main callers | Pin kcq's six standards@main reusable callers to standards 0b1898e. | ruled | kcq/kyq +| D328 | 2026-10-13 | allow-list superset | Add julia-actions/julia-buildpkg and julia-docdeploy to metadatastician allow-list superset. | ruled | metadatastician-governance#66 +| D329 | 2026-10-13 | paint-type lock PR | Lock-only PR may be opened; the merge is the son's. | ruled | paint-type#129 +| D330 | 2026-10-13 | canonical-ums | "canonical-ums is deleted permanently, online and offline (abandoned)"; amends D272's "untouched"; Jonathan to check GitLab (A7). | executed (GitLab check pending) | canonical-ums +| D331 | 2026-10-13 | succession | "#787 closes as completed; successor #1234". | executed | standards#787 -> #1234 +| D332 | 2026-10-13 (open) | Probot Settings installed | D13's premise false (Settings app id 1561 IS installed). Keep app + settings.yml, or uninstall then delete? (E) uninstall, then delete files. | pending (open) | estate .github/settings.yml +| D333 | 2026-10-14 | kcq -> kyq | kcq renamed kyq (Kubernetes YAML Query); npm publish scoped @metadatastician/kyq; :repo-uuid keeps preimage github.com/metadatastician/kcq. | executed | metadatastician/kyq +| D334 | 2026-10-14 | kcX -> kyX | kcX -> kyX for the planned projection compiler; live references updated (standards#1237: CLAUDE.md, README, deed nostos vocabulary, AFFIRMATION, ADR-008, check-uuid-v8.sh comment; rsr-template-repo#234; seven CLAUDE.md copies; boj-server#364; QuantumCircuit.jl#42); dated records (incl. D309/D313/D320 texts, #787) not renamed. | executed | standards, rsr-template-repo +|=== + + +==== Session-level and unnumbered rulings recorded on the same surfaces + +[cols="1,1,1,1,1,1",options="header"] +|=== +| id | date | topic keywords | one-sentence ruling | status | where it bites +| (unnumbered, 2026-10-06) | 2026-10-06 | phrasing rule | "in question options Claude names actors in the third person ("Jonathan pushes" / "Claude pushes"), never "I"." (#1234 cites this as D296.) | ruled | all decision sheets +| R21 (session row) | 2026-09-15 | actions.lock resync | A fresh session next window; R-A is ONE PR / TWO COMMITS. | ruled | +| (session row) governance.yml | 2026-09-15 | banned runtime | "Port governance-reusable.yml to bun" -- port, do not key setup-deno. | ruled | standards governance-reusable.yml +| (session row) #48 | 2026-09-15 | F11a enforcement | Guard enforces the Inbox marker: unleased appends only below it. | ruled | MEMORY.md guard +| (session row) #47 | 2026-09-15 | ruling-sheet provenance | Fix the template, then retrofit only the sheets that actually bind (owner departure from E). | ruled | 34 sheets +| Priority-0 (D94-D96 floor correction) | 2026-09-23 | metadatastician floors | RATIFIED: two standalone org rulesets on metadatastician, bypass_actors [] -- Branch-Floor (~DEFAULT_BRANCH deletion + non_fast_forward) and Tag-Floor (~ALL same); do NOT execute the old "one field on EstateBranching" PUT. | ruled | metadatastician Branch-Floor 23868655, Tag-Floor 23868851 +| (unnumbered) standards lock | 2026-10-13 | close-out | Discharged without a hand edit: standards#1232 regenerated the lock; D283's approval not needed. | executed | standards actions.lock +|=== + diff --git a/docs/reorg/2026-10-14-tidy/wiring-audit.adoc b/docs/reorg/2026-10-14-tidy/wiring-audit.adoc new file mode 100644 index 000000000..bd88239cf --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/wiring-audit.adoc @@ -0,0 +1,547 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Wiring audit: standards and its seven sibling repositories +:toc: left +:toclevels: 2 + + +* *Audited:* 2026-10-14. Read-only: nothing was edited or committed. +* *Standards:* `/home/user/standards` @ `7d2041a` (= `origin/main`), full history (1287 commits), so the commits-behind counts are exact. +* *Siblings:* all are shallow clones (50–56 commits) on branch `claude/eager-noether-1seyvi`: +** rsr-template-repo `64787ae` +** hypatia `4be38c8` +** gitbot-fleet `1894258` +** proven-tests-and-benches `f0ee59c` +** .git-private-farm `dd45a63` +** cicd-squabbler `b34cd53` +** cicd-suite `4f54042` +* *Tool limits:* +** The local `yq` is not Go yq ("yq 0.0.0"), so `scripts/lock-selfcheck.sh` reported every SHA as UNEXAMINED. I used an awk re-implementation of the same logic instead (case-folded, reusable calls skipped). +** The local awk is mawk, so neither `check-lock-sync.sh` would run. +** I made no remote GitHub calls. + +''' +=== 1. CONSUMPTION MATRIX + +Columns, for each standards SHA: `type` = `git cat-file -t`; `behind` = `git rev-list --count ..HEAD`; `@HEAD` = the workflow file still exists at HEAD; `chg` = the number of commits to that file since the pin (the blob differs from HEAD in every case except one). + +==== Distinct standards SHAs pinned by siblings (all are real commits that main reaches) + +[cols="1,1,1,1,1,1",options="header"] +|=== +| SHA | date | behind | on first-parent? | lock-selfcheck (approx) | builds hypatia from +| da2c748a | 2026-09-10 | 395 | no (reached via merge 5331019b) | self-consistent | *floating hypatia HEAD* (`git ls-remote … HEAD`) +| 571cc734 | 2026-08-29 | 456 | yes | self-consistent | n/a (secret-scanner/mirror) +| 2479cf76 | 2026-09-24 | 138 | yes ("ziz-drop" commit) | self-consistent | n/a (mirror) +| 71bb615e | 2026-10-02 | 101 | yes | self-consistent | vetted `hypatia-ref` 51ab6496 +| 84355587 | 2026-08-27 | 474 | yes | self-consistent | *floating hypatia HEAD* +| bd0df9ea | 2026-08-04 | 544 | yes | self-consistent | n/a (mirror) +| 8f2ee508 | 2026-09-09 | 413 | yes | self-consistent | n/a (governance pins its own hypatia) +| ed5e3f65 | 2026-09-22 | 162 | yes | self-consistent | n/a (ci-pipeline) +| 74d2f66f | 2026-09-30 | 121 | yes | self-consistent | n/a (secret-scanner; blob == HEAD) +|=== + + +*No phantom SHAs, blob SHAs or deleted PR heads (the issue #987 class).* Every pin is a commit, and main reaches all of them. No `actions.lock` record has a 40-hex `ref` that differs from its `commit`. + +The KNOWN_BAD_BEFORE fix `e9c88887` is an ancestor of every pin. All pins are outside the 50-commit window. Only 71bb615e (12 days old) is inside the 14-day window, and the age axis has been advisory since 2026-07-21. + +==== rsr-template-repo +`actions.lock` coverage is complete: it keys `hyperpolymath/standards@da2c748` and `cicd-suite@55556cf`, plus the transitive `cicd-suite@0da816c`. + +[cols="1,1,1,1,1,1",options="header"] +|=== +| caller (.github/workflows/) | callee | SHA | behind | @HEAD | chg +| governance.yml:21 | governance-reusable.yml | da2c748a | 395 | yes | 25 +| hypatia-scan.yml:30 | hypatia-scan-reusable.yml | da2c748a | 395 | yes | 20 +| secret-scanner.yml:29 | secret-scanner-reusable.yml | da2c748a | 395 | yes | 4 +| scorecard.yml:19 | scorecard-reusable.yml | da2c748a | 395 | yes | 8 +| rust-ci.yml:19 | rust-ci-reusable.yml | da2c748a | 395 | yes | 5 +| mirror.yml:16 | mirror-reusable.yml | da2c748a | 395 | yes | 5 +| main-estate-audit.yml:20 | cicd-suite main-estate-audit.yml | 55556cf5 | 26 behind cicd-suite HEAD | yes | composites @0da816c (27 behind) +|=== + + +Refs not pinned to a SHA: +* `deed-ecosystem/validate-action@main` (deed-validate.yml:39, dogfood-gate.yml:47) +* `k9-ecosystem/validate-action@main` (k9-validate.yml:43, dogfood-gate.yml:96) +* `smtp-notify-action@v0.3.0` +* dogfood-gate.yml:628-634 checks out *standards and hypatia at their default branch, with no ref* +* dogfood-gate.yml:366 fetches canon.lock from `raw…/standards/main` + +==== hypatia +In `actions.lock`, the five standards-calling workflows are keyed `[]` (lines 45, 48, 60, 94 and 95), so they are not covered. + +[cols="1,1,1,1,1",options="header"] +|=== +| caller | callee | SHA | behind | chg +| governance.yml:19 | governance-reusable | da2c748a | 395 | 25 +| hypatia-scan.yml:24 | hypatia-scan-reusable | da2c748a | 395 | 20 +| secret-scanner.yml:25 | secret-scanner-reusable | 571cc734 | 456 | 6 +| scorecard.yml:19 | scorecard-reusable | da2c748a | 395 | 8 +| mirror.yml:44 | mirror-reusable | 2479cf76 | 138 | 2 +| security-policy.yml:284 | checkout of standards `config/gitleaks/estate-baseline.toml` | 571cc734 | 456 | file exists at HEAD +|=== + + +Also: three different standards SHAs in one repo; `deed-ecosystem` and `k9-ecosystem` `@main` (dogfood-gate.yml:50, 128); `smtp-notify-action@v0.5.0`. + +==== gitbot-fleet +`actions.lock` coverage is complete. + +[cols="1,1,1,1",options="header"] +|=== +| caller | callee | SHA | behind +| governance.yml:38 | governance-reusable | da2c748a | 395 +| hypatia-scan.yml:34 | hypatia-scan-reusable | da2c748a | 395 +| secret-scanner.yml:27 | secret-scanner-reusable | 571cc734 | 456 +| scorecard.yml:21 | scorecard-reusable | da2c748a | 395 +| mirror.yml:18 | mirror-reusable | 571cc734 | 456 +|=== + + +Also: `deed-ecosystem` and `k9-ecosystem` `@main` (dogfood-gate.yml:50, 112); `smtp-notify-action@v0.5.0`. + +==== proven-tests-and-benches +In `actions.lock`, the five standards callers are keyed `[]`. The lock also records `smtp-notify-action@v0.3.0` while push-email-notify.yml:44 uses `@v0.5.0` (desync). + +[cols="1,1,1,1,1",options="header"] +|=== +| caller | callee | SHA | behind | chg +| governance.yml:29 | governance-reusable | 71bb615e | 101 | 4 +| hypatia-scan.yml:36 | hypatia-scan-reusable | 71bb615e | 101 | 1 +| secret-scanner.yml:22 | secret-scanner-reusable | 84355587 | 474 | 6 +| scorecard.yml:28 | scorecard-reusable | da2c748a | 395 | 8 +| mirror.yml:23 | mirror-reusable | bd0df9ea | *544 (oldest pin)* | 8 +|=== + + +==== .git-private-farm +In `actions.lock`, the five standards callers are keyed `[]`. The hypatia-scan caller's job id is `scan`, not `hypatia` (hypatia-scan.yml:26). + +All five callers (governance, hypatia-scan, secret-scanner, scorecard and mirror) pin *84355587 (474 behind)*. Other refs: `deed-ecosystem` and `k9-ecosystem` `@main` (dogfood-gate.yml:45, 95); `smtp-notify-action@v0.1.0`. + +==== cicd-squabbler +`actions.lock` keys the standards SHAs, but it records `smtp-notify-action@v0.3.0` while the workflow uses `@v0.5.0` (desync). + +[cols="1,1,1,1,1",options="header"] +|=== +| caller | callee | SHA | behind | chg +| governance.yml:21 | governance-reusable | 8f2ee508 | 413 | 25 +| secret-scanner.yml:25 | secret-scanner-reusable | 8f2ee508 | 413 | 5 +| rust-ci.yml:19 | rust-ci-reusable | 8f2ee508 | 413 | 5 +| mirror.yml:16 | mirror-reusable | 8f2ee508 | 413 | 5 +| hypatia-scan.yml:30 | hypatia-scan-reusable | da2c748a | 395 | 20 +| scorecard.yml:19 | scorecard-reusable | da2c748a | 395 | 8 +| standards-pipeline.yml:42 | ci-pipeline.yml (deliberate dry-run observation) | ed5e3f65 | 162 | 7; nested calls go to standards@571cc734 +|=== + + +==== cicd-suite +main-estate-audit.yml and secret-scanner.yml are absent from `actions.lock`. main-estate-audit.yml is deliberately "de-onboarded", as its header records. + +[cols="1,1,1,1",options="header"] +|=== +| caller | callee | SHA | behind +| secret-scanner.yml:27 | standards secret-scanner-reusable | 74d2f66f | 121 (blob identical to HEAD: the only byte-current pin) +| main-estate-audit.yml:54-104 | 26 of its own composites `hyperpolymath/cicd-suite/actions/*@1aa6bfb` | 1aa6bfb6 | 1 behind its own HEAD +|=== + + +`hyperpolymath/standards/.github/actions/*` (affirmation-check, signed-push) is consumed by *none* of the seven repos. + +''' +=== 2. CANON PIN AND MACHINE-READABLE SUBSTRATE + +standards `canon.lock` [canon]: +* `version = "2.1.2"`, status draft +* `commit` = all-zero placeholder (:231); tag `canon-v2.1.2` is not present locally +* The artefact hashes are verified to match the files at HEAD: +** criteria `6a5aa885…` +** gates `e70efd2f…` +** applicability `1c5caa46…` +** lifecycle `2f405c9e…` +** constitution `be48496f…` + +[cols="1,1,1,1,1,1,1,1",options="header"] +|=== +| repo | `_chora.deed` | (canon …) pin | coordination.k9 | legacy .a2ml (descriptiles/descriptiles) | total tracked .a2ml | *.k9.ncl (contractiles dir files) | root Mustfile +| rsr-template-repo | *yes* | *2.1.2, criteria + gates sha match* (deed:32-40) | no; ships `coordination.k9.ncl` (Nickel `pedigree`, schema "1.0.0") | 0 | 0 | 18 (15) | no (Justfile) +| hypatia | no | none; never reads canon.lock; fixture criteria are *2.0.0-draft* (d03f87d8) | no | 6 | 30 | 3 (6) | no (tasks/Mustfile) +| gitbot-fleet | no | rhodibot `bots/rhodibot/canon/pin.toml`: label 2.1.1, criteria + gates sha *match*, vendored copies byte-match | no | 7 | 42 | 7 (3) | no (per-bot Mustfiles) +| proven-tests-and-benches | no | none | no | 6 | 16 | 1 (0) | no +| .git-private-farm | no | none | no | 3 | 10 | 1 (0) | no +| cicd-squabbler | no | none | `coordination.k9` copied from the template (`schema_version = "1.0.0"`, :6) | 11 | 122 | 16 (28) | no +| cicd-suite | no | none | no | 0 | 0 | 0 | no (no Justfile either) +|=== + + +Standards against itself: +* `.machine_readable/rsr-profile.a2ml:76` says `[canon] version = "2.1.0"` while canon.lock says 2.1.2 (the hashes match). +* The standards root has no Mustfile either. + +''' +=== 3. POLICY COPIES (agent instruction files) + +[cols="1,1,1",options="header"] +|=== +| repo | files carrying policy | contradictions with standards (path:line) +| rsr-template-repo | CLAUDE.md, .cursorrules, .windsurfrules, .github/copilot-instructions.md, GEMINI.md (pointer only), docs/onboarding/llm-warmup-*.adoc | CLAUDE.md:54 "Deny: *Nix, Python, Go, TypeScript, Deno, ReScript, AGPL*" and :66 "Never: … AGPL" contradict LICENCE-POLICY Rules 3/4/5. copilot-instructions.md:19 "Never use AGPL-3.0." copilot-instructions.md:57 "TypeScript is permitted only where AffineScript cannot reach" contradicts the 2026-08-27 TIGHTENED ruling in standards/.claude/CLAUDE.md. .windsurfrules:9 "Never AGPL-3.0. MPL-2.0 only as platform-required fallback" (PMPL-era wording; under Rule 1, MPL-2.0 is the default). +| hypatia | .claude/CLAUDE.md, 0-AI-MANIFEST.a2ml | .claude/CLAUDE.md:74-79 lists `.machine_readable/descriptiles/*.a2ml` as the machine-readable artefacts (A2ML retired, D312). :227 scores against a stale criteria fixture. :301 "SPDX-License-Identifier: CC-BY-SA-4.0" for code, but 0 of 139 lib/*.ex files use it (code is MPL-2.0). The policy is also encoded in code: lib/rules/cicd_rules.ex:1637-1741 (see drift 1). language-blockers.yml duplicates the governance language-policy job. +| gitbot-fleet | .claude/CLAUDE.md, 0-AI-MANIFEST.a2ml, robot-repo-automaton/.claude/CLAUDE.md, bots/*/CLAUDE.md | .claude/CLAUDE.md:74 "The seven canonical A2ML files … per the current estate-wide policy" (D312). 0-AI-MANIFEST.a2ml:46 "All code PMPL-1.0-or-later unless platform requires MPL-2.0" and :117 "License: PMPL-1.0-or-later" (not in the Rule 2 register; its own CLAUDE.md:66 says MPL-2.0). robot-repo-automaton/.claude/CLAUDE.md:32 bans pnpm (tier 2, permitted). +| proven-tests-and-benches | AGENTS.adoc, 0-AI-MANIFEST.a2ml | no language or licence statements found +| .git-private-farm | CLAUDE.md, GEMINI.md, copilot-instructions.md, 0-AI-MANIFEST.a2ml, llm-warmup-*.md | copilot-instructions.md:19 "Python — reject unless interfacing with Python-only libraries" (Python has no exceptions). :20 "JavaScript — use AffineScript or *TypeScript* instead". :80 "npm/yarn → pnpm" (Bun is tier 1). 0-AI-MANIFEST.a2ml:59 "License is MPL-2.0 (AGPL-3.0 is BANNED)". CLAUDE.md:3 points to `.machine_readable/INTENT.contractile` (a pre-k9 contractile form). +| cicd-squabbler | CLAUDE.md, GEMINI.md, .github/copilot-instructions.md, .machine_readable/ai/.cursorrules, .windsurfrules, 0-AI-MANIFEST.a2ml (×3 copies) | CLAUDE.md:54 "Deny: *Guix, Node/npm, TypeScript, Python, Go, AGPL*. (Guix, not Guix.)": it denies the primary package manager, and the parenthetical is the fingerprint of a blind `s/Nix/Guix/`. It omits Deno and ReScript, and it denies npm (tier 3, permitted). copilot-instructions.md:39 "No Node.js / npm / bun (use Deno)". .cursorrules:26-27 "TypeScript -> use ReScript", "Node.js / npm / bun -> use Deno". .windsurfrules:27-28 says the same. .cursorrules:9 and .windsurfrules:9 say "Never AGPL … MPL-2.0 only as platform fallback". CLAUDE.md:28-40 gives an A2ML reading order (CLADE.a2ml…) and says it was "generated … from a2ml". +| cicd-suite | none | none (no CLAUDE.md, deed or AGENTS file) +|=== + + +Contradictions inside standards itself (they propagate): +* *007 and licensing:* +** .claude/CLAUDE.md:18 says 007 is "All Rights Reserved". +** .machine_readable/licensing-policy.toml:51-54 says 007 is OUT-OF-SCOPE. +** Both conflict with 3-practice/LICENCE-POLICY.adoc:133-143, Rule 4: "Current members: *007*" (AGPL-3.0-or-later). +* *Palimpsest register:* +** licensing-policy.toml:35 says "EXACTLY three repos" (revised 2026-06-04). +** LICENCE-POLICY.adoc:47-53 registers five. +* *Rules 4 and 5:* The .claude/CLAUDE.md five-way table has no row for Rule 4 (network services) or Rule 5 (games). +* *TypeScript:* 3-practice/LANGUAGE-POLICY.adoc:26 says the Bun row offers "Native TypeScript execution", and :60 says "TypeScript is permitted only where AffineScript cannot reach". Both conflict with the 2026-08-27 TIGHTENED note in .claude/CLAUDE.md. +* *Two LANGUAGE-POLICY documents:* +** `0-canon/rsr/LANGUAGE-POLICY.adoc` (v1.6.0, 768 lines) +** `3-practice/LANGUAGE-POLICY.adoc` (227 lines; standards-map.toml:700-708 makes it `canonical_doc`) +** Siblings cite both: farm runtime-policy.yml:4 cites 0-canon; hypatia language-blockers.yml:16 cites 3-practice. +* *Missing enforcement file:* .claude/CLAUDE.md:197 says the bans are enforced by `.github/workflows/language-policy.yml`, which does not exist. + +''' +=== 4. SCRIPT COPIES (basename shared with standards/scripts or standards/hooks) + +[cols="1,1,1,1,1",options="header"] +|=== +| sibling file | standards file | sha256 +| hypatia hooks/validate-{codeql,permissions,sha-pins,spdx}.sh | hooks/ same | *SAME* (×4) +| gitbot-fleet bots/{rhodibot,seambot}/hooks/validate-*.sh | hooks/ | *SAME* (×8) +| .git-private-farm hooks/validate-permissions.sh, validate-spdx.sh | hooks/ | SAME +| .git-private-farm hooks/validate-sha-pins.sh | hooks/validate-sha-pins.sh | *DRIFTED*: the farm anchors the `uses:` regex (a bug fix not upstreamed) +| .git-private-farm hooks/validate-codeql.sh | hooks/validate-codeql.sh | *DRIFTED*: the farm adds `\ | \ | true` pipefail guards (a fix not upstreamed) +| rsr-template-repo scripts/check-lock-sync.sh (297 lines) | scripts/check-lock-sync.sh (164 lines) | *DRIFTED*: the sibling adds clause 3 (transitive closure) and a gawk guard +| cicd-squabbler scripts/check-lock-sync.sh | same as rsr-template-repo (0b3c7a82) | DRIFTED from standards +| gitbot-fleet scripts/check-lock-sync.sh (415 lines) | scripts/check-lock-sync.sh | DRIFTED (a third fork) +| hypatia scripts/check-trusted-base.sh (59 lines, `hypatia: allow` contract) | scripts/check-trusted-base.sh (298 lines, proof-debt §a–d + TRUSTED:/AXIOM:) | *different policy, same name* +| hypatia hooks/pre-commit | hooks/pre-commit | different (repo-specific) +| rsr-template-repo .github/hooks/install.sh | hooks/install.sh | different purpose +| gitbot-fleet docs/upstream-proposals/…/apply-baseline.sh | scripts/apply-baseline.sh | drifted (a proposal copy) +|=== + + +Non-script copies: +* *Rulesets:* rsr-template-repo `.github/rulesets/{base,branch-floor,require-linear-history,require-signed-commits}.json` are byte-identical to standards `config/rulesets/`. `Immutable-Tags.json` (rsr-template-repo and cicd-squabbler) *differs* from `immutable-tags.json`: +** The sibling copy has `bypass_actors: []` and no `creation` rule. +** The standards copy has admin + integration 2538504 `always` bypass and a `creation` rule. +** `cicd-squabbler/.github/rulesets/Optimus-Branch.json` has no standards counterpart. +* *lock-sync-gate.yml* exists in standards, rsr-template-repo, gitbot-fleet and cicd-squabbler, and all four differ (the standards copy calls itself the template). +* *affirmation-check* exists in both standards/.github/actions and cicd-suite/actions, and all three files differ. + +''' +=== 5. REVERSE WIRING (standards → siblings; excluding 9-archive) + +File counts by name: hypatia 204, rsr-template-repo 331 (238 of them in docs/proofs), gitbot-fleet 48, .git-private-farm 20, cicd-squabbler 9, proven-tests-and-benches 7, cicd-suite 6. + +*hypatia* +* Role: the *oracle* (canon.lock [canon.roles]). +* hypatia-scan-reusable and governance-reusable build the scanner from hypatia at the input `hypatia-ref`, default `51ab6496…` (hypatia #895, 13 commits behind hypatia HEAD). The pins older than 10e0b6ff (#1120, 2026-10-01) use floating HEAD. +* `hypatia-rules/*.a2ml` (eight rules: HYP-S001–S005, S007, S008 and UUID-001) are standards-authored rules that hypatia's `RuleLoader` parses. +* canon.lock:49 claims "hypatia → Hypatia.Rules.RsrConformance" reads it. *Hypatia does not reference canon.lock.* +* The licence cap (`license_finding_strategy` :review, `license_finding_severity_cap` :warn) is wired as standards CLAUDE.md says. +* `path_allow_prefixes` against the standards CLAUDE.md tables (which claim to mirror hypatia): + +[cols="1,1,1,1",options="header"] +|=== +| rule | hypatia entries | standards table entries | difference +| typescript_detected | 19 | 14 | hypatia adds `/adapter/` (BoJ cartridge adapters, #602), which standards does not document, plus 4 stale "(8) CLAUDE.md documented exemptions not yet in this list" entries (`a2ml/bindings/deno/`, `k9-svc/bindings/deno/`, `lol/test/vitest.config.ts`, `scripts/check-ts-allowlist.ts`) +| rescript_detected / _interface | 14 / 14 | 14 | hypatia has `/panels/`; standards has `zotpress/*` (CLAUDE.md:294), which *hypatia lacks** +| nodejs_detected | 20 | 19 | hypatia adds `/bindings/rescript/` +| javascript_detected | 18 | 18 | same +| javascript_jsx_detected | 17 | 18 (shared table) | hypatia lacks `affinescript-cli/` +|=== + + +The V-lang lists (21, 9 and 9 entries) only partly correspond to the classes in the prose. Examples of each: TS `".d.ts"`, `"/bindings/deno/"`, `"/vscode/"`; npm `"tree-sitter-"`, `"/.lake/"`, `"/office-addin/"`; V `"echidna/examples/"`, `"/v-cartridge"`, `"polystack/"`. + +*gitbot-fleet* +* Role: the *fleet*. +* scripts/propagate-workflow-pins.sh stages bumps "for a human / gitbot-fleet to open a PR". check-workflow-staleness.sh names the "Hypatia sha_bump_propagation rule + gitbot-fleet". The UUID standard lists gitbot-fleet as a consumer. +* The licence refusal gate in dispatch-runner.sh:356-381 and the `exit 1` banners in fix-license-{hygiene,file}.sh and fix-missing-spdx.sh are present, as standards CLAUDE.md requires. + +*rsr-template-repo* +* Role: the *spine*. It reads canon.lock through the deed's (canon) clause. canon.lock [canon.lockstep] `order = spine-adopts-then-canon-releases`. +* Rulesets are sourced from config/rulesets. +* 238 docs/proofs files cite it. + +*.git-private-farm* +* standards `instant-sync.yml:48` checks out `hyperpolymath/.git-private-farm`. +* debt-measure.yml and lockfile-drift-detect.yml mention it. +* The regularisation spec names its ci-deadlock-audit.sh as the §7.4 verifier core and its `_rsr_*` hookset as DROP. + +*cicd-squabbler* +* docs/DEPENDABOT-POLICY.adoc:38,156 specifies `squabble bump/rollback` and a `dependency-update-reusable.yml`; neither exists, and the policy itself says "specified, not built". +* scripts/close-lock.sh and regen-dependabot-locks.sh cite measurements taken on squabbler. +* pipeline-allow.txt:57 records it as a dry-run observer. It appears on the estate board. + +*cicd-suite* +* It appears on the estate board, YAML-POLICY.adoc:105, regen-dependabot-locks.sh and the regularisation spec, which rules it REMAKE·PERIODIC (keep as a library, drop as a gate). The spec rules rollout DROP, folds secrets-check and spdx-license-check, and says "11/26 cannot fail". + +*proven-tests-and-benches* +* TESTING-TAXONOMY.adoc:39-64 says "draw from proven-tests-and-benches FIRST"; it is the reference test suite. +* toolchain-readiness-grades/testing and the .github/ISSUES roadmap also cite it. +* Note: `.machine_readable/integrations/proven.a2ml` is about the `proven` repo, not this one. + +''' +=== 6. cicd-suite and cicd-squabbler against standards + +*What cicd-suite is.* cicd-suite holds 26 bash composite actions (`actions/-check/action.yml`) plus `main-estate-audit.yml`. That workflow runs on push, pull_request and workflow_call, and calls all 26 composites remotely at a full SHA ("de-onboarded" from actions.lock; cross-repo matrix in the header at :23-46). The README classifies the actions as 15 enforcing, 9 advisory and 2 stubs (prat, semantic-audit). + +*What `rollout_estate.sh` does.* It has 14 lines, no SPDX header and no `set -euo pipefail`. It `cp`s cicd-suite's main-estate-audit.yml into every directory under the hard-coded path `/home/hyperpolymath/developer/hyper-repos/*`. It runs no checks and opens no PRs. The README says it reached 199 repos, 198 of them untracked. + +*Duplicate functions.* The 2026-09-02 regularisation spec (owner-approved) rules on these explicitly: +* `secrets-check` duplicates `secret-scanner-reusable` (spec :104: "Drop cicd-suite/secrets-check (same job)"). +* `spdx-license-check` duplicates the governance `licence-consistency` job (spec :185, :511: FOLD). +* `affirmation-check` is a fork of `standards/.github/actions/affirmation-check`. +* `code-hygiene-check` (believe_me/sorry/admit) overlaps the governance `trusted-base` job. +* `linguist-check` overlaps the governance `language-policy` job. +* `vaulted-tokens-check` overlaps the secret scanner. +* `manifest-check` and `contractile-validation-check` overlap deed-ecosystem/k9-ecosystem validate-action. +* `formatting-check` (.md→.adoc) overlaps governance `quality`. +* `rollout_estate.sh` is ruled DROP (:201); its distribution model (copy) conflicts with the template's thin-caller model. +* The README is stale. :97 says "cicd-squabbler does not exist yet": it exists, but it has no `audit --semantic` subcommand (the CLI has fetch, diagnose, fight and chains). :122 says there is no permissions block and checkout is pinned by tag: both are now fixed. + +*What cicd-squabbler is.* It is a Rust and SPARK "fighter" that drives a stuck gate to a legitimate green. It reads rulesets and classic protection, attributes STARTUP_FAILURE, classifies reds (self-win, escalate or assign-owner), and maps cross-repo `chains`. + +*Overlap with standards' gate scripts:* +* `scripts/check-required-contexts.sh` (unsatisfiable required contexts, file-derived) overlaps squabbler `gate_triage.rs`. It also overlaps farm `ci-deadlock-audit.sh` (the same phantom-context class): *three implementations*. +* `scripts/apply-branch-gates.sh` (derives contexts from runs and writes `required_status_checks`) is the applier squabbler's "required-context reconcile" self-win will need. *Squabbler does not consume `config/rulesets/` or any standards script* and keeps its own `.github/rulesets/Optimus-Branch.json`. +* `scripts/lock-selfcheck.sh`, `close-lock.sh` and `check-allowed-actions.sh` encode lessons measured on squabbler (#101). Squabbler's "reusable re-pin" self-win should call `lock-selfcheck.sh` before re-pinning. +* These are complementary roles (canon definition, per-repo executor, estate verifier), but nothing links them. Squabbler pins no standards gate artefact. + +''' +=== 7. .git-private-farm + +*What it does:* +* *maintenance.sh* (37 lines) is a read-only estate report. It counts open Dependabot PRs and the code-scanning and Dependabot alerts for every repo in `repo-list.txt` (427 entries), and never approves or merges. +* *farm-manifest.json* (v1.0.0, updated 2026-02-28) has 25 repos, 10 forges (github, gitlab, sourcehut, codeberg, bitbucket, radicle, gitea, forgejo, azure-devops, codecommit) and `default_forges` gitlab, sourcehut, codeberg and bitbucket. `propagate.yml` does `git clone --mirror` and pushes per forge on `repository_dispatch`. +* *dispatch-templates/* contains `instant-sync.yml`, `notify-dependents.yml`, `receive-events.yml`, `budget-resume-sweep.yml`, `seed/` and `github-hookset/_rsr_{lint,policy,security,test}.yml`. +* *Other scripts:* +** `actuate.sh`: the privileged merge actuator ("hand"), which re-verifies the hypatia "brain"'s decisions and defaults to dry-run +** `sha-bump-propagate.sh` + `.yml`: manual-only under ruling R-F3 +** `ci-deadlock-{audit,degate,realign,realign-rulesets}.sh` +** `migrate-classic-to-rulesets.sh` +** label tooling, *seven of whose scripts are Python* +* *Billing:* GitHub Actions is blocked by account billing, per its CLAUDE.md. + +*Which standards policy it enforces or duplicates:* +* *Mirror policy:* duplicates standards `mirror-reusable.yml` (7 forges: gitlab, bitbucket, codeberg, sourcehut, *disroot*, gitea, radicle; selected per repo with `vars.*_MIRROR_ENABLED`). The forge sets differ, and the farm itself also calls mirror-reusable@84355587. The spec rules mirror "OWNER?" and `instant-sync` DROP. +* *SHA propagation:* duplicates standards `scripts/propagate-workflow-pins.sh` (audit-first, no commit or push) and the `check-workflow-staleness.sh` window. Rulings R-F1 and R-F3 are recorded only in the farm (its CLAUDE.md, REMEDIATION-2026-09-26.adoc:26,132), not in standards docs/decisions. +* *Merge actuator:* has no standards-side policy document. It enforces doctrine 5 and 11 ("squabble, don't bypass"; "stop-first"). `actuate.sh` refuses rebase and veto cases. +* *CI deadlock:* `ci-deadlock-audit.sh` is the spec's §7.4 verifier core (KEEP), and overlaps standards check-required-contexts.sh. +* **Hookset `_rsr_*.yml`:** ruled DROP by the spec (:173, "0 callers, superseded by standards reusables"), but still present. +* *Language and licence policy:* cited from `0-canon/rsr/LANGUAGE-POLICY.adoc v1.6.0` rather than the 3-practice copy. The farm still ships 8 Python files and a copilot file that recommends TypeScript and pnpm. + +''' +=== 8. DRIFT LIST + +Severity: H = high, M = medium, L = low. "SSOT" names the source of truth that should win. Every licence item is FLAG-ONLY: owner approval is required, and no agent edits. + +. *H*: hypatia's licence tables contradict LICENCE-POLICY. +** hypatia/lib/rules/cicd_rules.ex:1738 lists palimpsest repos `["palimpsest-license","palimpsest-plasma","consent-aware-http"]` (wrong name, and missing insolvency-tycoon and sim-public-relations). +** :1656 `@pmpl_exception_repos ["paint-type"]`, but paint-type is AGPL under Rule 3 (LICENCE-POLICY.adoc:222). +** :1649 the AGPL list covers only 3 repos; Rules 4/5 members are missing (007, chronicles-of-slavia, 688-attack-hub, f117a, f19, the-nash-equilibrium, paint-type). +** :1637-1646 lists PMPL and AGPL as `@wrong_licenses`, so `validate_license/2` returns `:wrong_license` for register repos. +** SSOT: 3-practice/LICENCE-POLICY.adoc (Rule 2 register; Rules 3–5 member tables). +. *H*: standards contradicts itself on licensing. +** .claude/CLAUDE.md:18 says 007 is ARR. +** .machine_readable/licensing-policy.toml:51 says 007 is OUT-OF-SCOPE, and :35 says "EXACTLY three repos" (revised 2026-06-04). +** Against both: LICENCE-POLICY.adoc:133-143 (Rule 4: 007 is AGPL) and :47-53 (five-repo register). CLAUDE.md's five-way table omits Rules 4 and 5. +** SSOT: LICENCE-POLICY.adoc for the register. The 007 status is an *owner decision*. +. *H*: the runtime and language policy is inverted in cicd-squabbler. +** .github/copilot-instructions.md:39 "No Node.js / npm / bun (use Deno)". +** .machine_readable/ai/.cursorrules:26-27 "TypeScript -> use ReScript" and "… -> use Deno"; .windsurfrules:27-28 says the same. +** SSOT: 3-practice/LANGUAGE-POLICY.adoc §1 and §1.3. +. *H*: cicd-squabbler/CLAUDE.md:54 "Deny: Guix, Node/npm, … (Guix, not Guix.)". +** It denies the primary package manager, denies tier-3 npm, and omits Deno and ReScript. The text is an artefact of `s/Nix/Guix/`. +** SSOT: regenerate it from the template generator against LANGUAGE-POLICY. +. *H*: .git-private-farm tracks 8 Python files (scripts/{gen-classifier-json,gen-labels-json,label-apply-graphql,label-classify,label-migrate-graphql,label-sync-graphql,labelutil}.py and tests/test-classifier-parity.py). +** copilot-instructions.md:19 invents a Python exception. +** SSOT: LANGUAGE-POLICY ("fully banned, no exceptions"). +. *H*: 6 of 7 siblings build the Hypatia scanner from floating hypatia HEAD. +** Their hypatia-scan pins (da2c748a, 84355587) predate 10e0b6ff/#1120, which introduced `hypatia-ref` default 51ab6496 (evidence: `git show da2c748:.github/workflows/hypatia-scan-reusable.yml:43`, `git ls-remote … HEAD`). +** This is the 09-12..14 / 09-26..30 outage class. Only proven (71bb615e) is protected. +** SSOT: standards main reusables, repinned through actions.lock after lock-selfcheck. +. *M*: lock-coverage gap. +** hypatia, proven-tests-and-benches and .git-private-farm key their standards-calling workflows as `[]` (e.g. hypatia/.github/workflows/actions.lock:45,48,60,94,95). cicd-suite omits main-estate-audit.yml and secret-scanner.yml. +** None of these four has lock-sync-gate.yml. This is the job-level desync class that check-lock-sync.sh documents. +** SSOT: standards check-lock-sync.sh plus the lock-sync-gate template. +. *M*: Dependabot-bumped refs were not relocked. +** proven-tests-and-benches push-email-notify.yml:44 uses `@v0.5.0`; lock:22,46 records `@v0.3.0`. +** cicd-squabbler: workflow `@v0.5.0`, lock `@v0.3.0`. +** SSOT: the workflow, with the lock regenerated. +. *M*: three forks of check-lock-sync.sh. +** standards has 164 lines and two clauses, and gives mawk syntax errors instead of a gawk guard. +** rsr-template-repo and cicd-squabbler have 297 lines and add clause 3 (transitive closure). +** gitbot-fleet has 415 lines. +** SSOT: standards, after upstreaming the three-clause version (doctrine 14). +. *M*: hypatia scores against stale criteria. +*** test/fixtures/a2ml/rsr-criteria-v2.a2ml is 2.0.0-draft (d03f87d8); the canon is 6a5aa885, release 2.1.2. +*** .claude/CLAUDE.md:227 and lib/mix/tasks/hypatia.rsr_score.ex:76-77 use or fall back to it. +*** canon.lock:49 says hypatia reads canon.lock; it does not. +*** SSOT: canon.lock [canon.artifacts].criteria. +. *M*: only the spine pins the canon. +*** rsr-template-repo is the only sibling with a deed and a (canon) clause (2.1.2; hashes match). +*** Its canon-lockstep job (dogfood-gate.yml:354+) checks only the criteria hash, and fetches canon.lock from floating `main` (:366). +*** hypatia (the oracle) and gitbot-fleet (the fleet) have no deed pin. +*** SSOT: canon.lock. +. *L*: canon version labels drift (the hashes are identical). +*** standards .machine_readable/rsr-profile.a2ml:76 says "2.1.0"; gitbot-fleet bots/rhodibot/canon/pin.toml:29 says "2.1.1"; canon.lock:223 says 2.1.2. +*** canon.lock `commit` is still all zeros (:231). +*** SSOT: canon.lock. +. *M*: hypatia's carve-outs do not match the standards CLAUDE.md tables, although the tables claim to mirror them. +*** TS: 19 entries against 14. `/adapter/` is not documented in standards, and cicd_rules.ex:205-209 holds four stale "(8)" entries. +*** ReScript: `/panels/` is only in hypatia, and `zotpress/**` (CLAUDE.md:294) is only in standards. +*** npm: hypatia adds `/bindings/rescript/`. +*** JSX: hypatia lacks `affinescript-cli/`. +*** SSOT: hypatia `@blocked_patterns` is declared the SSOT, so update the tables. Ask the owner about `/adapter/`, `/panels/` and `zotpress`. +. *M*: standards' own LANGUAGE-POLICY still advertises TypeScript. +*** 3-practice/LANGUAGE-POLICY.adoc:26 "Native TypeScript execution" and :60 "TypeScript is permitted only where AffineScript cannot reach". +*** Both conflict with the 2026-08-27 ruling in .claude/CLAUDE.md. The wording is copied into rsr-template-repo/.github/copilot-instructions.md:57. +*** SSOT: the owner ruling (the exemptions question is still open). +. *M*: two "canonical" LANGUAGE-POLICY documents exist. +*** 0-canon/rsr/LANGUAGE-POLICY.adoc (v1.6.0) and 3-practice/LANGUAGE-POLICY.adoc (standards-map.toml:700-708). +*** Farm runtime-policy.yml:4 and check-runtime-policy.sh:3 cite the 0-canon copy; hypatia language-blockers.yml:16 and rsr copilot:40 cite 3-practice. +*** SSOT: 3-practice, per standards-map. Archive the other copy or turn it into a redirect. +. *M*: blanket AGPL denials. +*** rsr-template-repo: CLAUDE.md:54,66; .github/copilot-instructions.md:19; .windsurfrules:9 (which also calls MPL-2.0 a "fallback"). +*** Copied into cicd-squabbler CLAUDE.md:54, copilot:17, .cursorrules:9 and .windsurfrules:9, and into farm 0-AI-MANIFEST.a2ml:59. +*** SSOT: LICENCE-POLICY Rules 1 and 3–5. +. *M* (flag only): gitbot-fleet/0-AI-MANIFEST.a2ml:46,117 says "All code PMPL-1.0-or-later". gitbot-fleet is not in the register, and its own CLAUDE.md:66 says MPL-2.0. SSOT: LICENCE-POLICY Rules 1 and 2. +. *M*: agent files still describe the A2ML era. +*** gitbot-fleet/.claude/CLAUDE.md:74 calls "seven canonical A2ML files" the current policy. +*** hypatia/.claude/CLAUDE.md:74-79 lists A2ML descriptiles. +*** cicd-squabbler/CLAUDE.md:28-40 gives an A2ML reading order. +*** No sibling except the template has a `_chora.deed`. +*** SSOT: the standards Machine-Readable Artefacts section (D312) and deed.abnf. +. *M*: the coordination file has the wrong shape. +*** rsr-template-repo ships `coordination.k9.ncl` (Nickel, schema "1.0.0", :7). cicd-squabbler copies it as `coordination.k9` (:6). +*** Standards requires `coordination.k9`, beginning `K9!`, with `schema_version: 1.2.0`. +*** SSOT: 2-protocols/k9-coordination grammar v1.2 and the k9-init generator. +. *M*: two trusted-base contracts run on hypatia. +*** The governance-reusable `trusted-base` job uses standards scripts/check-trusted-base.sh. +*** hypatia's verify-proofs.yml:322 runs hypatia/scripts/check-trusted-base.sh, which has the same name but a different contract (`hypatia: allow`). +*** SSOT: the standards trusted-base policy and script. +. *M*: immutable-tags rulesets have drifted. +*** rsr-template-repo and cicd-squabbler `.github/rulesets/Immutable-Tags.json` have no bypass actors and no `creation` rule. +*** standards config/rulesets/immutable-tags.json has two `always` bypass actors and a `creation` rule. +*** squabbler's Optimus-Branch.json has no canon counterpart. +*** SSOT: config/rulesets (the owner decides the bypass actors). +. *M*: workflows that the owner-approved regularisation spec rules FOLD or DROP are still live. +*** Inline codeql.yml in all 6 siblings; no sibling calls codeql-reusable (spec :117). +*** static-analysis-gate.yml in rsr-template-repo and cicd-squabbler (:118). +*** workflow-linter.yml in rsr-template-repo, farm and cicd-squabbler (:121). +*** security-policy, runtime-policy, wellknown, estate-rules and guix-policy in rsr-template-repo, farm and cicd-squabbler, plus hypatia language-blockers (:125, "Delete the files"). +*** instant-sync.yml in gitbot-fleet, cicd-squabbler and farm dispatch-templates (:107). +*** openssf-compliance.yml in cicd-squabbler (:104). +*** Farm `_rsr_*` hookset (:173). +*** rollout_estate.sh (:201). +*** main-estate-audit run as a pull_request gate in rsr-template-repo (:127, "drop it as a gate"). +*** SSOT: docs/superpowers/specs/2026-09-02-cicd-regularisation-design.adoc. +. *M*: cicd-suite `secrets-check` and `spdx-license-check` are still wired (main-estate-audit.yml:102 and :74). They duplicate secret-scanner-reusable and the governance `licence-consistency` job. SSOT: the spec (:104, :185, :511). +. *M*: `affirmation-check` is forked. +*** standards/.github/actions/affirmation-check (84ae82df; `is-template` input; no consumers among the seven). +*** cicd-suite/actions/affirmation-check (72eaf99; signer verification). +*** SSOT: a single copy, to be chosen by the owner. The cicd-suite copy is the one consumed. +. *M*: SHA propagation is split. +*** standards scripts/propagate-workflow-pins.sh and farm scripts/sha-bump-propagate.sh + .yml (R-F3) do the same job. +*** check-workflow-staleness.sh:127-131 tracks only governance, hypatia-scan and scorecard. Secret-scanner, mirror, rust-ci and ci-pipeline pins are untracked (they range from 121 to 544 commits behind). +*** R-F1 and R-F3 exist only in the farm. +*** SSOT: standards. Record R-F* in standards docs/decisions. +. *M*: two mirror systems. +*** standards mirror-reusable has 7 forges including disroot. +*** farm farm-manifest.json has 10 forges (azure-devops, codecommit and forgejo, but not disroot), 25 repos, and was last updated 2026-02-28. +*** SSOT: an owner decision (the spec marks mirror "OWNER?"). +. *L*: three phantom-required-context detectors exist: standards check-required-contexts.sh, farm ci-deadlock-audit.sh and squabbler gate_triage.rs. SSOT: the farm verifier (spec §7.4) for estate audit; the standards script for definition. +. *L*: the cicd-suite README is stale. +*** :97 says "cicd-squabbler does not exist yet": it exists, but it has no `audit --semantic`. +*** :122 claims there is no permissions block and a tag-pinned checkout: both are fixed. +. *L*: cicd-suite rollout_estate.sh has no SPDX header and no `set -euo`, uses a hard-coded `/home/hyperpolymath/...` path, and does a verbatim copy. The spec says DROP. +. *L*: cicd-suite hygiene. +*** 24 of 26 action.yml files have no SPDX header (flag only). +*** It has no deed, Justfile or SECURITY.md. +*** It does not call governance, hypatia-scan or scorecard. +. *L*: the farm's hypatia-scan caller job id is `scan` (hypatia-scan.yml:26). The standards convention, from propagate-hypatia-caller-id.sh, is `hypatia`. +. *L* (flag only): hypatia/.claude/CLAUDE.md:301 says code SPDX is CC-BY-SA-4.0; the actual lib/*.ex headers are MPL-2.0. +. *L*: other wrong tool guidance. +*** Farm copilot-instructions.md:20 recommends TypeScript, and :80 recommends pnpm over npm. +*** gitbot-fleet robot-repo-automaton/.claude/CLAUDE.md:32 bans pnpm. +. *L*: hypatia is behind on retired rules. +*** It still ships the HYP-S009 evaluator (lib/rules/implementation_inside_canon.ex) and the HYP-S006 fixture; standards retired both on 2026-10-09 (hypatia-rules/README.adoc:44-48). +*** rule_loader.ex:11 says "HYP-S001..S009". +*** The fixture rule copies differ from standards. +. *L*: canon.lock [canon.workflows] (:313-323) omits rust-ci-reusable, ci-pipeline and elixir-ci-reusable, which siblings consume. +. *L*: standards .claude/CLAUDE.md errors. +*** :197 cites a nonexistent `.github/workflows/language-policy.yml`. +*** ReScript is listed twice (:178-179). +*** npm appears in the BANNED table although it is "not banned" (:182). +. *L*: `@main` action refs. +*** deed-ecosystem and k9-ecosystem validate-action are used `@main` in 4 siblings: rsr-template-repo (deed-validate.yml:39, k9-validate.yml:43, dogfood-gate.yml:47,96), hypatia (dogfood-gate.yml:50,128), gitbot-fleet (dogfood-gate.yml:50,112) and farm (dogfood-gate.yml:45,95). +*** The locks resolve deed-ecosystem to 44f9c9f, but cicd-suite pins f9d999b: two different deed validators are in use. +*** rsr-template-repo dogfood-gate.yml:628-634 checks out standards and hypatia without a ref. +. *L*: farm hooks/validate-sha-pins.sh and validate-codeql.sh contain fixes that were never upstreamed to standards/hooks/. SSOT: standards, after upstreaming. +. *L*: documentation-format duplicates. +*** Farm: README.md (not .adoc); CONTRIBUTING.adoc alongside CONTRIBUTING.md; llm-warmup-*.md. +*** proven: READINESS.adoc/.md and SECURITY.adoc/.md. +. *L*: no repo, standards included, has a root Mustfile, although the rule is "All repositories use Mustfile/justfile". + +''' +=== 9. IDEAL WIRING (proposal) + +The most elegant option, as the default: +* *Standards is the only place where law, rules and gate logic live.* Siblings *pin* it; they never *copy* it. +* *Each sibling holds three things only:* a deed pin, an actions.lock pin and thin callers. + +Proposed wiring: + +. *The canon identity is canon.lock.* +** Release it properly: fill `commit` and create tag `canon-v`. +** Every sibling carries `_chora.deed` with a `(canon :version :criteria-sha256 :gates-sha256 :applicability-sha256 :lifecycle-sha256 :constitution-sha256 :canon-commit)` clause. +** Each sibling's canon-lockstep job reads canon.lock *at `:canon-commit`, never `main`*, and compares all five hashes. +** The spine adopts first; hypatia and gitbot-fleet adopt next, because they consume the criteria. +. *Reusable workflows: actions.lock is the pin.* +** One standards "release SHA" per wave. Choose it only if `scripts/lock-selfcheck.sh` reports SELF-CONSISTENT. +** Publish it in canon.lock [canon.workflows] as `pin = `, and list every reusable there (add rust-ci, elixir-ci, ci-pipeline and codeql). +** Every sibling pins *all* standards reusables to that one SHA (no mixed SHAs per repo). The lock keys `hyperpolymath/standards@`, never `[]`. +** Propagate only with `scripts/propagate-workflow-pins.sh` (audit-first; a human or gitbot-fleet opens the PR). Retire farm sha-bump-propagate as a duplicate, and move R-F1/R-F3 into standards docs/decisions. +** Widen check-workflow-staleness STANDARDS_REUSABLES to every reusable. +. *Lock hygiene lives in one place.* +** Upstream the 3-clause, gawk-guarded check-lock-sync.sh to standards/scripts. +** Ship lock-sync-gate either as a reusable (preferred) or as a byte-identical template. +** Delete the sibling copies of the script. +. *Hypatia rules.* +** `standards/hypatia-rules/*.a2ml` (and later the deed or k9 form) is the rule SSOT, loaded at runtime from the scanned standards checkout. Hypatia keeps only evaluators. +** Hypatia must source its licence register and carve-out lists from standards' machine form. Regenerate `.machine_readable/licensing-policy.toml` from LICENCE-POLICY.adoc, then hypatia reads it (owner approval required, because this touches licence logic). +** Generate the `path_allow_prefixes` tables in CLAUDE.md from hypatia `@blocked_patterns`; do not hand-mirror them. +** Delete the stale criteria fixture, or pin it by canon.lock hash. +. *Policy text: one generator.* +** Each sibling's CLAUDE.md, AGENTS, .cursorrules, .windsurfrules and copilot files are *generated* from its deed plus standards LANGUAGE-POLICY (3-practice, the single copy) and LICENCE-POLICY. Each says "licence per LICENCE-POLICY classification", never "Deny AGPL". +** Delete hand-written policy copies (squabbler .cursorrules/.windsurfrules/copilot, farm copilot, gitbot 0-AI-MANIFEST licence lines) as duplicates. Archive 0-canon/rsr/LANGUAGE-POLICY.adoc or make it a redirect. +. *Rulesets.* `config/rulesets/*.json` is the SSOT. The template carries byte-identical copies verified by sha256 in CI (including immutable-tags). Applied by `apply-branch-gates.sh` and `apply-protection-floor.sh`; squabbler invokes these and keeps no rulesets of its own. +. *Roles, so nothing is duplicated:* +** standards: definition and appliers. +** cicd-squabbler: per-repo executor. It *calls* the standards appliers and lock-selfcheck, and replaces the `semantic-audit` stub's missing CLI. +** .git-private-farm: estate verifier and actuator. It keeps ci-deadlock-audit, actuate.sh and maintenance.sh; it drops the `_rsr_*` hookset, instant-sync and the Python label tools (port them to bash, Rust or Julia). +** cicd-suite: a PERIODIC library only. Drop rollout_estate.sh, secrets-check and spdx-license-check, and fold affirmation-check into one copy. +. *Mirroring.* The owner picks one system. Recommended (the elegant arm): standards mirror-reusable as the only implementation, with farm-manifest.json reduced to the forge registry it reads through `vars`. +. *Delete from siblings as duplicates:* +** inline codeql.yml (replace with a thin codeql-reusable caller) +** static-analysis-gate, workflow-linter, security, runtime, wellknown, estate-rules, guix and language-blockers workflows (all fold into governance) +** instant-sync, openssf-compliance and hookset templates +** forked hooks/validate-*.sh: upstream the farm fixes, then vendor nothing; fetch through governance diff --git a/docs/reorg/2026-10-14-tidy/workflow-audit.adoc b/docs/reorg/2026-10-14-tidy/workflow-audit.adoc new file mode 100644 index 000000000..439286e13 --- /dev/null +++ b/docs/reorg/2026-10-14-tidy/workflow-audit.adoc @@ -0,0 +1,341 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) +// Evidence snapshot compiled 2026-10-14 for docs/reorg/2026-10-14-tidy/README.adoc. +// Authority class: historical. The GitHub issues, PRs and rulings it cites remain authoritative. +// Converted mechanically from the audit notes; path quotes use canonical names (descriptiles, bot_directives). += Workflow audit: hyperpolymath/standards .github/workflows at 7d2041a2 +:toc: left +:toclevels: 2 + + +Scope: `/home/user/standards/.github/workflows/` at HEAD `7d2041a` (= main, 2026-10-14 00:24 +0100): +59 workflow files + `actions.lock`. Read-only audit. Run data was taken from the saved 60-run dump, the +Actions API per workflow (30 most recent runs each), and job logs for the failures. + +*Live required checks on `main`* (read from `GET /repos/hyperpolymath/standards/rules/branches/main`, +2026-10-14). There are three contexts, all in repo rulesets: + +[cols="1,1,1,1",options="header"] +|=== +| Context | Workflow | Ruleset | Bypass +| `governance / Actions lockfile verify` | governance.yml | Lock-Floor 24587723 | RepositoryRole 5 (admin), `always` +| `uses ⊆ actions.lock` | actions-lock-gate.yml | Lock-Floor 24587723 | admin, `always` +| `scan / gitleaks` | secret-scanner.yml | Secret-Scan-Floor 24309995 | admin, `always` +|=== + + +The richer ruleset 23787415 ("main gate…") required 20 contexts, among them CodeQL, SPARK Theatre Gate, +hypatia, rust-secrets, shell-secrets and 11 governance jobs. It has been *disabled* since 2026-10-05. +`config/rulesets/base.json` carries `required_status_checks: []`. `gates.json` derives contexts from these workflow files: +* base profile: governance.yml, secret-scanner.yml, hypatia-scan.yml and codeql.yml. +* proof profile, detected through `spark-theatre-gate.yml`: that workflow. + +`codeql.yml` is listed both in `base.gate_workflows` and in `never_required_workflows`, so gates.json contradicts itself. + +''' + +=== A. Per-workflow table + +Kind values used below: +* *SG*: self-gate. +* *RE*: reusable for the estate (`workflow_call` only). +* *BOTH*: reusable and also a self-gate. +* *HK*: housekeeping, publishing or estate operations. +* *DEAD*: disabled, never fires, or does nothing. + +Required values used below: +* *LIVE*: required in a live ruleset. +* *gates.json*: gates.json says it should be required, but it is not live. +* *no*: not required. + +Triggers: P = push, PR = pull_request, S = schedule, C = workflow_call, D = workflow_dispatch, plus other events where named. + +[cols="1,1,1,1,1,1,1,1,1,1",options="header"] +|=== +| file | display name | triggers | kind | checks / does | latest on main | required? | notes +| actions-lock-gate.yml | Actions Lockfile Gate | P(main) PR D | SG | `.githooks/validate-actions-lock.sh`: every SHA `uses:` (workflows + composite actions) keyed in actions.lock | success 10-13 | *LIVE* (`uses ⊆ actions.lock`) | 1 of 4 PR-time lock gates. It went red on #1231, and #1231 merged anyway. +| affinescript-verify.yml | AffineScript Verify | P PR | SG | builds the pinned affinescript compiler; checks changed `.affine` files (added = blocking, modified = advisory) | success 10-13 | no | Toolchain failure is advisory and skipped loudly. +| allowlist-preflight-reusable.yml | Actions Policy Preflight Reusable | C | RE | tree + live Actions-allowlist policy | n/a (0 runs) | no | *A byte-equivalent copy is inlined in governance-reusable* (jobs `allowlist-preflight`, `actions-policy-live`). It has 0 local consumers. +| apply-workflow-pins.yml | apply workflow pins | S(Sun) D | HK | audits and fixes (opens PRs) consumer pins of standards reusables | success 10-11 | no | Audit mode by default. Fix mode needs the `APP_ID` / `APP_PRIVATE_KEY` App credentials. +| boj-build.yml | BoJ Server Build Trigger | P D | HK | POSTs to `BOJ_SERVER_URL`. A no-op if unset. | success 10-13 | no | *Fail-open* (`curl … \ | \ | echo`). 1,348 runs. +| canon-spine-lockstep.yml | Canon / Spine Lockstep | P PR D (path-filtered) | SG | canon.lock ↔ rsr-template-repo lockstep; standards-map | success 10-09 | no | Watches `0-canon/rsr/rsr-criteria-v2.a2ml`, a retired format. Path-filtered, so it could never be required. +| casket-pages.yml | GitHub Pages | P D | HK | builds casket-ssg from README.adoc and deploys Pages | *cancelled 10-13* (30/30 cancelled; last success 10-01) | no | Shares concurrency group `pages` with pages-archive and pages. Pin comments say v4/v3 for v7/v5 SHAs. +| changelog-reusable.yml | (unnamed) | C | RE | git-cliff CHANGELOG.md; commit-back / pr-back modes | n/a | no | Checks standards out at `ref: main` (floating). 0 local consumers. +| changelog.yml | Changelog | P(paths CHANGELOG.md) | *DEAD* | calls changelog-reusable | startup_failure 08-24 (its only run) | no | The repo has *CHANGELOG.adoc, not .md*, so the trigger never fires. The caller grants `contents: read` but the reusable job needs `write`, so it would startup-fail anyway. +| check-suite-monitor.yml | 🟡 CHECK: Check Suite Monitor | check_suite, workflow_run | *DEAD* | logs the check-suite payload and makes no API calls ("would create an issue") | success 10-13 | no | *About 6–11 runs per push* (3,355 total). It watches `🔴 GATE: *`, but no workflow has that prefix. It lists a "Main Estate Audit" gate that does not exist here. +| ci-pipeline.yml | CI Pipeline (reusable) | C | RE | ecosystem detect; Rust / Nickel / Haskell; ReScript; V; *Deno refusal*; embedded secret-scan | n/a (via self-ci) | no | Calls `secret-scanner-reusable` and `rust-ci-reusable` *@571cc734 (2026-08-29)* instead of the local copy. ReScript job uses `bun-version: latest`. +| codeql-reusable.yml | CodeQL Security Analysis (reusable) | C | RE | CodeQL analyze for one language | n/a | no | 0 local consumers. The estate largely uses CodeQL default setup. +| codeql.yml | CodeQL Security Analysis | P PR S(monthly) | SG | CodeQL JS/TS + actions | success 10-13 | gates.json (contradictory) | Was required in the disabled "main gate" ruleset. +| debt-measure.yml | 📅 Debt measure | S(Mon) D | HK | re-measures Debtfile probes and opens or updates PR #1155 | *failure 10-12* (29/30 failing) | no | *Writes facts into `.machine_readable/Debtfile.a2ml`*, a retired format. See B. +| deed-conformance.yml | deed-conformance | P PR (paths) C | BOTH | deed linter self-test, fixtures, committed `*.deed` | success 10-13 | no | 0 local consumers. +| dependabot-lock-regen.yml | Dependabot lock regeneration | S(every 30 min) D | *DEAD* | regenerates actions.lock on Dependabot PRs | disabled_manually (last success 10-08) | no | 283 runs that warned and exited 0, because the App does not exist. +| doc-format.yml | Documentation Format Enforcement | P PR | SG | duplicate .md/.adoc; derived README.md banner | success 10-13 | no | Checks `3-practice/SECURITY.md`, which is not a path GitHub reads. Partly overlaps governance's "Check documentation" step. +| dyadt-verify.yml | DYADT Verify | P PR D | SG | DYADT + FFP conformance vectors; verifies `CLAIMS.a2ml` | success 10-13 | no | Gate input is *CLAIMS.a2ml*, a retired format. +| echidna-verify.yml | ECHIDNA Proof Verification | P(paths) PR S D | *DEAD* | type-checks the Agda/Idris corpora | startup_failure 10-13 (#1231; stale) | no | Both corpora are *evicted* (`lol/proofs`, `avow-lib/src/abi` are absent). It runs presence guards on every PR and weekly. +| elixir-ci-reusable.yml | Elixir CI (reusable) | C | RE | mix compile/test/credo/dialyzer | n/a | no | 0 local consumers. +| elixir-ci.yml | Elixir CI | P PR | SG (vacuous) | calls elixir-ci-reusable | success 10-13 | no | The repo has no `mix.exs`, so "Compile + test" is *skipped* every run. +| github-backup-mirror-reusable.yml | GitHub Backup Mirror (reusable) | C | RE | pushes to a GitHub backup org via a token | n/a (0 runs) | no | 0 consumers and no self-caller. +| governance-reusable.yml | Governance Reusable Workflow | C | RE | 16 jobs: staleness, UUID (v8), allowlist, live policy, hypatia baseline, language, Guix, security, quality, well-known, workflow lint, lock verify, trusted base, licence, exemption + debt ratchets | n/a | — | Messages still say *"allowed: AffineScript, Deno"* and "Deno (tier 2)", which contradicts the 2026-09-22 Deno ban and ci-pipeline's refusal. The Debt ratchet reads Debtfile.a2ml. +| governance.yml | Governance | P PR D | SG | calls governance-reusable (local `./`) | success 10-13 | *LIVE* (1 of 16 jobs) | +| hypatia-scan-reusable.yml | Hypatia Reusable Scan | C | RE | builds hypatia @51ab6496 and scans; SARIF | n/a | — | +| hypatia-scan.yml | Hypatia Security Scan | P(main/master/develop) PR S D | SG | calls hypatia-scan-reusable | success 10-13 | gates.json | +| ijson-jcs.yml | ijson-jcs conformance | P PR | SG | report-only JSON canonicality; the test step can fail | success 10-13 | no | `cargo install` on every run. +| instant-sync.yml | Instant Sync | P release | *DEAD* | repository_dispatch to `.git-private-farm` | disabled_manually (last failure 07-20) | no | The farm says not to restore the dispatch trigger (R-F3). +| k9-contractile.yml | K9-SVC Contractile Validation | P PR D | SG | Mustfile structure + run; contractile presence; nickel typecheck of k9 contract and fixtures | success 10-13 | no (header claims REQUIRED) | Presence check is driven by **`contractiles/INDEX.a2ml` and `*file.a2ml`**, a retired format. +| label-triage.yml | Label Triage | issues D | HK | classifies issues with jq | success 10-13 | no | Also duplicated in cicd-suite. +| labels.yml | Labels | P(paths) S(monthly) D | HK | syncs labels.json | success 10-01 | no | Also duplicated in cicd-suite. +| launcher-standard-lockstep.yml | launcher-standard lock-step | PR(paths) | SG | deed and adoc edited together | PR success 10-01 | no | Path-filtered. +| lock-selfcheck.yml | Lock Self-Check | P PR D | SG | `lock-selfcheck.sh`: the commit is safe to pin | success 10-13 | no (header: "intended REQUIRED") | Lock gate 2 of 4. +| lock-sync-gate.yml | Lock Sync Gate | P PR | SG | `check-lock-sync.sh`: both directions plus job-level reusable refs | success 10-13 | no | Lock gate 3 of 4. It has no `uses:`, which makes it the most robust of the four. +| lockfile-drift-detect.yml | Lockfile Drift Detect | S(Tue) D | HK | estate sweep that opens a tracking issue | success 10-13 | no | +| makefile-blocker.yml | Makefile Blocker | P PR (Makefile paths) | SG (dormant) | *always `exit 1` when triggered* | failure 08-24 (34/34 failures) | no | It fails even when a PR is *deleting* Makefiles. Governance language-policy already bans Makefiles. +| mirror-reusable.yml | Mirror to Git Forges (reusable) | C | RE | SSH force-push to 6 forges; Radicle | n/a | — | Radicle step is `rad sync … \ | \ | echo` (*masked*). Disroot / SourceHut / Gitea have no default fingerprint. +| mirror.yml | Mirror to Git Forges | P D | HK | calls mirror-reusable *@b935e639* (not `./`) | *failure 10-13* (30/30; last success 09-14) | never (gates.json) | See B. +| no-js-scan.yml | No-JS Scan (warn-first) | P PR | SG | JS/TS count ratchet against `.github/no-js-baseline.txt` (20) | success 10-13 | no | Header says required; it is not live. +| pages-archive.yml | GitHub Pages | P D | HK | same casket-ssg build as casket-pages (least-privilege variant) | *pending, then cancelled* 10-13; last success 10-01 | no | Run *36877198396* (10-01) has had its deploy job *queued for 13 days* and holds group `pages`. +| pages.yml | GitHub Pages (Ddraig SSG) | P D | *DEAD* | Ddraig SSG in an idris2-pack container | disabled_manually; startup_failure 07-19 (its only run) | no | Third Pages deployer. Uses `README.md`, which this repo does not have. +| propagate-hooks.yml | ⚙️ AUTO: Propagate Hook Updates | P(paths) D repository_dispatch | HK | copies `.githooks` to repos | *startup_failure 10-13*; 29 earlier failures | no | `ALL_REPOS=("hyperpolymath/standards")`: it propagates *to itself*. See B. +| provisioning-check-reusable.yml | Provisioning Check Reusable | C | RE | caller's `build/just/*` matches canon | n/a (0 runs) | no | 0 local consumers. +| readme-derive-reusable.yml | README Derive Reusable Workflow | C | RE | AsciiDoc → GFM README.md with vocab gate | n/a | — | Reads *ECOSYSTEM.a2ml* `[publishing.readme]` (retired format). *Declares a workflow-level `concurrency` group equal to its caller's*, which causes a deadlock. Clones standards@`main` (floating). +| readme-derive.yml | README Derive | P PR (README.adoc) | SG | calls readme-derive-reusable | *failure 10-13; has never succeeded (36 runs)* | never (gates.json) | Would be a no-op here even if fixed: standards declares no `[publishing.readme]`. +| rust-ci-reusable.yml | Rust CI (reusable) | C | RE | cargo check/clippy/fmt/test/audit/llvm-cov | n/a | — | `toolchain: stable` (floating). +| scorecard-enforcer.yml | OpenSSF Scorecard Enforcer | P S D | SG | *second* Scorecard run with publish; min score 5; `3-practice/SECURITY.md` exists; grep for unpinned (warn) | success 10-13 | no | Duplicates scorecard.yml. +| scorecard-reusable.yml | OSSF Scorecard Reusable Workflow | C | RE | Scorecard SARIF upload; PR variant | n/a | — | +| scorecard.yml | Scorecard | P PR S D | SG | calls scorecard-reusable | success 10-13 | never (gates.json) | +| secret-scanner-reusable.yml | Secret Scanner (reusable) | C | RE | gitleaks, rust-secrets, shell-secrets | n/a | — | +| secret-scanner.yml | Secret Scanner | P PR | SG | calls secret-scanner-reusable (local) | success 10-13 | *LIVE* (`scan / gitleaks`) | Self-CI runs the same scan again from the 571cc734 copy. +| self-ci.yml | Self-CI | P PR S | SG | calls ci-pipeline (local) | success 10-13 | no | In standards it effectively runs only *Nickel + a duplicate secret scan*. Rust is skipped (no root Cargo.toml). +| self-test.yml | Self Test | P PR D | SG | `run-shell-test-suite.sh` (all `scripts/tests/*.sh`, which includes `uuid-v8-test.sh`); KYAML ratchet; lock-gate pin freshness | success 10-13 | no | The most valuable non-required gate. +| settings-drift-detect.yml | Settings Drift Detect | S(Mon) D | HK | estate settings sweep | *failure 10-12* (4/4) | no | Missing secret (see B). +| signed-push-smoke.yml | signed-push smoke test | D | HK | end-to-end test of the signed-push action | failure 08-24 (from when it had a push trigger) | no | APP_ID / APP_PRIVATE_KEY are not held, so it cannot pass. +| spark-theatre-gate.yml | SPARK Theatre Gate | P PR C | BOTH | detects SPARK proof-claims made without a prover | success 10-13 | gates.json (proof profile) | 3 Ada files in the repo. Was required in the disabled ruleset. +| tag-ruleset-canon.yml | tag ruleset canon | S(Sun) D | HK | converges the immutable-tags ruleset estate-wide | *failure 10-11* (4/4) | no | No credential (see B). +| tailscale-connect-reusable.yml | Tailscale connect (reusable) | C | RE | joins the tailnet | n/a (0 runs) | no | Reads `TS_OAUTH_*` without declaring `secrets:`, so it needs `inherit`. 0 consumers. +| uuid-v7.yml | UUID v7 conformance | P PR | SG | *actually `check-uuid-v8.sh --strict` + `uuid-v8-test.sh`* | success 10-13 | no | Name kept "so no required context moves", but no live ruleset requires it. Duplicates governance's `UUID v7 conformance` job (also v8 strict) and self-test. +|=== + + +*Counts by kind (59 files):* +* SG: 23 (2 of them vacuous or dormant: elixir-ci, makefile-blocker) +* RE: 15 +* BOTH: 2 +* HK: 13 +* DEAD: 6 (changelog, check-suite-monitor, dependabot-lock-regen, echidna-verify, instant-sync, pages) + +Further: 3 are live-required. 14 are red, cancelled or perpetually pending on main: mirror, readme-derive, casket-pages, pages-archive, echidna-verify, propagate-hooks, debt-measure, settings-drift-detect, tag-ruleset-canon, changelog, makefile-blocker, signed-push-smoke, pages, instant-sync. + +*Things checked and found clean:* No workflow references REGISTRY.a2ml or build-registry.sh any more (#1161 removed them). No Python, `setup-python`, Nix or `deno run` remains. The only Deno references are the refusal gate and the stale governance messages listed above. + +*Stale pin comments:* `checkout@3d3c42… # v4` (the SHA is v7.0.1) appears in casket-pages, doc-format, echidna-verify, launcher-standard-lockstep, makefile-blocker, no-js-scan and readme-derive-reusable. casket-pages also carries `cache … # v4` and `upload-pages-artifact … # v3`. + +''' + +=== B. Failed or cancelled on main: root causes + +==== 1. README Derive: this repo's bug (has never succeeded in 36 runs) +* Run 38482953895 on 48e0ed9 ended in `failure` with *0 jobs* after 1 s. `gh run view` shows only "This run likely failed because of a workflow file issue". +* Cause: a concurrency deadlock. +** `readme-derive.yml` (the caller) and `readme-derive-reusable.yml` both declare a workflow-level `concurrency: group: ${{ github.workflow }}-${{ github.ref }}`. +** Inside a called workflow, `github.workflow` evaluates to the *caller's* name. Both groups therefore resolve to `README Derive-refs/heads/main`. +** GitHub detects the self-deadlock and kills the run before it creates any job. +* Evidence: +** It is the *only* caller/reusable pair in the repo with workflow-level concurrency on both sides. elixir-ci, scorecard, secret-scanner and codeql have it on the caller only, and they run. +** The caller was created on 2026-07-28 with the colliding block (be51a134, "Generated by Mistral Vibe"). +** Every run since then: 8 `startup_failure`, early ones from a permissions mismatch fixed by #652, then 28 `failure` with jobs=0. +* Fix: delete the `concurrency:` block from the reusable. A reusable should never key on `github.workflow`. +* Even fixed, it does nothing in standards. The repo has no `[publishing.readme]`, and the reusable reads the retired `ECOSYSTEM.a2ml`. + +==== 2. Mirror to Git Forges: infra / unprovisioned destinations (red since 2026-09-15; last success 09-14) +Run 38484072398 on 7d2041a: 5 of 7 jobs failed. + +[cols="1,1,1,1,1,1",options="header"] +|=== +| Job | Result | Cause | Class +| mirror-codeberg | failed | Host fingerprint verified, then push failed: "Forgejo: Push to create is not enabled". *`codeberg.org/hyperpolymath/standards` does not exist.* | unprovisioned destination +| mirror-bitbucket | failed | Push failed: "You may not have access to this repository or it no longer exists". *`hyperpolymath-dev/standards` is missing, or the key has no access.* | unprovisioned destination +| mirror-disroot | failed | `APPROVED_FINGERPRINT` is empty: var `DISROOT_SSH_FINGERPRINT` is unset, and the reusable has no default for this forge. | config (missing var) +| mirror-sourcehut | failed | Same as Disroot: `SOURCEHUT_SSH_FINGERPRINT` is unset. | config (missing var) +| mirror-gitea | failed | `GITEA_HOST` *and* `GITEA_SSH_FINGERPRINT` are unset, although `GITEA_MIRROR_ENABLED=true` and the key is present. | config (missing vars) +| mirror-gitlab | success | — | — +| mirror-radicle | "success", masked | `rad sync --announce \ | \ | echo "Radicle sync attempted"` is green by construction, after 2 m 13 s of `cargo install radicle-cli` on every push. | this repo's reusable +|=== + + +* `mirror.yml` pins the reusable at `@b935e639` (2026-10-06). The only diff from HEAD is the dtolnay pin, so the pin is not the cause. +* Classification: infra (destinations and vars). The Radicle mask is this repo's reusable. + +==== 3. GitHub Pages (casket-pages cancelled, pages-archive pending): stuck platform run plus this repo's design (no success since 2026-10-01 13:29) +* Run *36877198396* (pages-archive, 2026-10-01 14:32): `build` succeeded, but `deploy` has sat *`queued` with no runner for 13 days*. +** The group `pages` has `cancel-in-progress: false`, so this run holds the group. +** Every later Pages run queues behind it. Each new one replaces the previous pending run, which leaves 100/100 casket-pages runs `cancelled` with 0 jobs. +* Infra: the stuck job needs a manual (force-)cancel. I could not read the Pages or environment config: the proxy refuses the `/pages` API. +* Repo design: *three* Pages deployers (pages, casket-pages, pages-archive) share one group. Two are near-identical and both fire on every push. + +==== 4. Dependabot #1231 incident (9164d76e, 2026-10-13 14:44): this repo's process +* Dependabot bumped `uses:` in 13 workflows *without regenerating actions.lock*. +* On the PR, actions-lock-gate, lock-sync-gate, lock-selfcheck, governance, hypatia-scan and scorecard all *failed* (runs 38408019532 and siblings, 13:48). +* *The owner merged it anyway* (`merged_by: hyperpolymath`). This used the admin `always` bypass on Lock-Floor, the very floor that requires `uses ⊆ actions.lock`. +* Consequences on main: +** echidna-verify and propagate-hooks: `startup_failure`. +** All lock gates, governance, hypatia and scorecard: red. +* Repaired about 7 h later by #1232 (4c101fbb regenerated the lock, 21:49Z). +* echidna-verify's main record still shows startup_failure because it is path-filtered and has not re-run on main since. Its PR runs are green. +* Lock-Floor's `updated_at` is 14:43:53Z, *28 s before* the merge at 14:44:21Z. That fits the ruleset being edited, or bypassed, to let the PR through. I cannot see ruleset history. + +==== 5. propagate-hooks: infra credential plus a design bug in this repo +* 29 consecutive failures (plus the #1231 startup_failure). +* The "Identify repositories with .githooks" step fails in under 1 s after one `gh api` call made with `GH_TOKEN=${{ secrets.HYPATIA_SCAN_PAT }}`. The probe errors, so it "refuses to propagate blind". +** I could not fetch the raw log line. The proxy blocks the log-blob host, and the MCP tail only returns the harden-runner teardown. +** Cause: the credential is missing or invalid. That is infra. +* Even with a working credential, `ALL_REPOS` is hard-coded to `("hyperpolymath/standards")`. The workflow can only "propagate" standards' hooks to standards. That is this repo's design bug. + +==== 6. Debt measure: this repo's data bug (1-line fix) +* Run 38215462109: "5 holding · 1 paid-down · 2 resolved · 0 breached · *1 expired*". +* Entry `shell-scripts-missing-spdx` in `.machine_readable/Debtfile.a2ml` has `count: 0` (resolved) but still carries `accepted-until: 2026-10-01`. The runner fails on the expired acceptance even though the debt is gone. +* Fix: drop the `accepted-until` line, or set the ceiling to 0 and remove the acceptance. +* The workflow also force-pushes `chore/debt-measure` and edits PR #1155 each week. + +==== 7. Settings Drift Detect: infra (missing secret) +* Run 38217170559, step "Scan estate for settings drift": `gh api repos/…/actions/permissions` fails with the fallback `github.token`, so the step exits 2 as designed: "Set secret ESTATE_SETTINGS_READ_TOKEN". It has failed 4 of 4 weekly runs. + +==== 8. tag ruleset canon: infra (missing credential) +* Run 38115578489: both App-token steps were skipped (`RULESET_APP_ID` is unset), and `ESTATE_ADMIN_TOKEN` is empty. "Assert a credential exists" exits 3. It has failed 4 of 4. + +==== 9. Lower-signal red +* *changelog.yml*: its only run (08-24) was `startup_failure`. The caller grants `contents: read` and the reusable job requests `contents: write`. It has never fired since, because CHANGELOG.md does not exist. +* *makefile-blocker.yml*: last main failure 08-24 (34 of 34 runs failed). It triggers on any Makefile path change, including deletions, and then exits 1 unconditionally. This repo's bug. +* *signed-push-smoke.yml*: last failure 08-24, from when it had a push trigger. It is dispatch-only now, and `APP_ID` / `APP_PRIVATE_KEY` are not provisioned. Infra. +* *pages.yml* (startup_failure 07-19, disabled), *instant-sync.yml* (38 failures without FARM_DISPATCH_TOKEN, disabled 07-20) and *dependabot-lock-regen.yml* (disabled 10-09) are all disabled. + +''' + +=== C. Reusable-workflow and composite-action inventory + +Consumer counts come from `grep` across the 6 non-standards repos cloned under /home/user (cicd-squabbler, cicd-suite, gitbot-fleet, hypatia, proven-tests-and-benches, rsr-template-repo). *They are a floor, not an estate census.* No consumer is pinned at HEAD. + +[cols="1,1,1,1",options="header"] +|=== +| reusable / action | inputs | secrets / vars read | local consumers (repos) and pins +| governance-reusable.yml | hypatia-ref, runs-on | HYPATIA_SCAN_PAT (declared, optional) | 5: da2c748a ×3, 8f2ee508, 71bb615e +| hypatia-scan-reusable.yml | block-on-high, hypatia-ref | HYPATIA_SCAN_PAT, GITHUB_TOKEN | 5: da2c748a ×4, 71bb615e +| secret-scanner-reusable.yml | runs-on | GITHUB_TOKEN | 6: 571cc734 ×2, 8f2ee508, 84355587, 74d2f66f, da2c748a. Also ci-pipeline internally @571cc734. +| scorecard-reusable.yml | (none) | (none; OIDC) | 5: da2c748a ×5 +| mirror-reusable.yml | runs-on | 7 forge keys (declared) + 18 vars `*_MIRROR_ENABLED / *_ORG / *_SSH_FINGERPRINT / GITEA_HOST / MIRROR_ORG` | 5: 8f2ee508, 571cc734, 2479cf76, bd0df9ea, da2c748a. Also standards' own mirror.yml @b935e639. +| rust-ci-reusable.yml | runs-on, enable_audit, enable_coverage, coverage_floor, clippy_args, test_args, check_args, working_directory, zig_version | (none) | 2: 8f2ee508, da2c748a. Also ci-pipeline @571cc734. +| ci-pipeline.yml | runs-on, enable_coverage, coverage_floor, fail_on_no_ecosystem | (none) | 1: cicd-squabbler @ed5e3f65 +| elixir-ci-reusable.yml | runs-on, otp/elixir/rebar3 versions, github-token, enable_dialyzer, enable_credo, working_directory, postgres-image, arangodb-image | GITHUB_TOKEN | 0 +| codeql-reusable.yml | language, build-mode, runs-on | (none) | 0 +| changelog-reusable.yml | mode, runs-on, git-cliff-version | (none) | 0 +| readme-derive-reusable.yml | runs-on, threshold, standards-ref | (none) | 0 +| allowlist-preflight-reusable.yml | (none) | HYPATIA_SCAN_PAT (declared) | 0 (inlined in governance-reusable) +| github-backup-mirror-reusable.yml | runs-on, destination-branch | BACKUP_MIRROR_TOKEN (declared); vars BACKUP_MIRROR_ENABLED / ORG / AUTOCREATE, MIRROR_ORG | 0 +| provisioning-check-reusable.yml | (none) | (none) | 0 +| tailscale-connect-reusable.yml | tags, ping, version, require | TS_OAUTH_CLIENT_ID / SECRET (*undeclared*, needs `secrets: inherit`) | 0 +| spark-theatre-gate.yml (both) | paths, enforce_zero_contract | (none) | 0 locally (header cites ambientops) +| deed-conformance.yml (both) | require-files | (none) | 0 +| .github/actions/signed-push | app-id, private-key, branch | (inputs) | 0 external; signed-push-smoke.yml only +| .github/actions/affirmation-check | is-template, required | (inputs) | *0*. cicd-suite carries its own *diverged* copy (`cicd-suite/actions/affirmation-check`), and that copy is what `main-estate-audit.yml` uses. +|=== + + +The pins are spread widely. Five distinct SHAs exist just for secret-scanner, and no local consumer is on HEAD. That is the population `apply-workflow-pins.yml` (audit-only today) exists to converge. + +''' + +=== D. Overlap and duplication, with the survivor + +. *Four PR-time lock gates over one file:* +** actions-lock-gate (`validate-actions-lock.sh`, *required*) +** lock-sync-gate (`check-lock-sync.sh`, both directions plus job-level refs, no `uses:`) +** lock-selfcheck (`lock-selfcheck.sh`, "safe to pin") +** governance / Actions lockfile verify (`check-actions-lock-gate.sh` → `gh actions-lock --verify-local`, *required*) + +self-test adds lock-gate pin freshness. All four failed together on #1231, and it merged anyway. +*Survive:* one standalone script and gate holding the union of the three standalone checks, run by `actions-lock-gate.yml` (its context is the live required one). Delete lock-sync-gate.yml and lock-selfcheck.yml once their predicates are inside that script. Keep governance's job as the consumer-facing gate. The bypass, not a missing gate, is the real hole. +. *governance.yml vs self-ci.yml vs ci-pipeline.yml:* not duplicates in purpose. Governance is policy; ci-pipeline is ecosystem build/lint; self-ci dogfoods ci-pipeline. The real overlaps: +** ci-pipeline embeds secret scanning, so standards runs gitleaks, rust-secrets and shell-secrets *twice* per event. The second run comes from a 6-week-old pin. +** The Deno, ReScript and V policy is enforced in ci-pipeline (refusal) *and* in governance language-policy, and governance still tells users Deno is allowed. + +*Survive:* all three files. Remove `secret-scan` from ci-pipeline (secret-scanner.yml is the required base gate). Make ci-pipeline call its siblings by `./` (or the `job.workflow_sha` pattern) instead of @571cc734. Make governance own the language policy alone and fix its Deno text. +. *codeql.yml vs codeql-reusable.yml:* a caller/reusable pair, not a duplicate. Keep both, but fix gates.json, which lists codeql.yml as both a gate and never-required. +. *mirror.yml / mirror-reusable vs github-backup-mirror-reusable vs instant-sync (farm dispatch):* three mirroring paths. +*Survive:* mirror-reusable, the only one with consumers. Delete github-backup-mirror-reusable (0 consumers, never run) or fold a GitHub-backup job into mirror-reusable. Delete instant-sync (disabled; R-F3 supersedes the farm dispatch). Point mirror.yml at `./`, as governance and secret-scanner already do. +. *changelog.yml vs changelog-reusable.yml:* the caller is dead (wrong filename, insufficient grant). Delete changelog.yml. Keep the reusable only if an estate code search finds a consumer; none exist locally. +. *uuid-v7.yml vs ADR-008 (v8):* uuid-v7.yml already runs the *v8 strict* checker. It duplicates governance's `UUID v7 conformance` job (also v8 strict) and self-test's `uuid-v8-test.sh`, and no live ruleset requires it. +*Survive:* governance's job. Delete uuid-v7.yml now. Rename the governance context to "UUID v8 conformance" only together with the gates.json derivation (context freeze). `scripts/check-uuid-v7.sh` and `estate-uuid-v7-audit.sh` then become dead-script candidates. +. *pages.yml vs pages-archive.yml vs casket-pages.yml:* three Pages deployers in one concurrency group. pages.yml is disabled (Ddraig); the other two are the same casket-ssg build. +*Survive:* one file. Use pages-archive's body (job-level least privilege, correct pin comments) under the name `pages.yml`, and delete the other two. First decide whether standards needs a Pages site at all: the build concatenates raw AsciiDoc into Markdown, and `www/` is unused by it. +. *scorecard.yml vs scorecard-enforcer.yml:* both run `ossf/scorecard-action` with publish on every main push. +*Survive:* scorecard.yml. Move the min-score check into scorecard-reusable as an input. Drop the `3-practice/SECURITY.md` and grep-pin checks, which governance and the lock gates cover. Delete the enforcer. +. *allowlist-preflight-reusable.yml vs governance-reusable `allowlist-preflight` + `actions-policy-live`:* identical copies. +*Survive:* governance's inline jobs, since they are what consumers run. Delete the reusable, or have governance `uses:` it; one copy either way. +. *doc-format.yml vs governance "Check documentation":* partial overlap on README and duplicate formats. Low priority. Consider folding doc-format's README-derived-banner rule into governance. +. *makefile-blocker.yml vs governance language-policy (bans Makefiles):* the governance version is correct; the blocker fails even on removals. Delete the blocker. +. *labels.yml and label-triage.yml are duplicated in cicd-suite; affirmation-check is duplicated (and diverged) in cicd-suite:* pick one home. cicd-suite is the live consumer for affirmation-check, so delete standards' copy. + +''' + +=== E. `.github/` hygiene + +* *FUNDING.yml and funding.yml:* +** `FUNDING.yml` (SPDX, github/ko_fi/liberapay: hyperpolymath) is the file GitHub reads. +** `funding.yml` (no SPDX, `github: metadatastician`) came in with 0ced540e, "estate-wide security compliance", 2026-07-26. It names the wrong owner for this repo, and on case-insensitive checkouts (macOS, Windows) the two collide. +** *Delete funding.yml.* +* *.github/ISSUES/ (7 files, 2026-06-05):* a roadmap plus 001–006, committed in #413 (2026-06-22). +** *None were filed.* 0 title matches among all 424 standards issues, open and closed. +** 006 is about `verisimdb#114`, a different repo. +** Several recommendations are now contradicted by doctrine. 003 proposes path filters, and required gates deliberately carry none. +** They also bypass the intake rule (`blank_issues_enabled: false`; Intake Spec rule 4). +** *Delete the directory.* Re-file any still-live item through the `campaign` template. +* *copilot/coding-agent.yml:* an MCP config running `npx -y @hyperpolymath/boj-server@latest` with `BOJ_URL: http://localhost:7700`. +** It uses npx (Bun/bunx is the estate default), an *unpinned `@latest`*, and plain HTTP. +** I could not confirm that GitHub reads this path. Copilot coding-agent MCP config is normally set in repository settings. +** Added 2026-06-01 (c8fb89bd) and untouched since. *Delete it*, or move it to settings with a pinned version and bunx. +* *label-classifier.json vs labels.json:* not duplicates, and they are consistent. labels.json holds 39 label definitions (for labels.yml). label-classifier.json holds the title→label rules (for label-triage.yml plus `.github/scripts/classify-issue.jq`). Every classifier label exists, and the `frozen` lists are identical. +** Both say "regenerate with `scripts/gen-*-json.py`" *in .git-private-farm*. That generator is Python (banned) and lives outside this repo. +** `frozen` still lists `gitar-approved` (gitar retired 2026-09-21) and `nix`. +** *Keep both.* Port the generator to jq or bash, and prune the dead frozen labels. +* *No PULL_REQUEST_TEMPLATE:* confirmed. Optional. If added, keep it short: Testing, contexts affected, and "actions.lock regenerated?", which is exactly the #1231 failure mode. +* *CODEOWNERS:* +** `3-practice/SECURITY.md` exists, but GitHub only recognises SECURITY.md at the root, `.github/` or `docs/`. The root `SECURITY.md` (1,304 B) also exists and is only covered by `*`. Two SECURITY.md files is doc duplication. +** The `Makefile` line names a banned file type that is absent. +** `.github/` comes *after* `.github/workflows/`, and the last match wins, so the workflows line is dead (harmless, since the owners are the same). +** The header rationale says "Base ruleset sets `require_code_owner_review: true`", but `config/rulesets/base.json` says `false`, and no live ruleset has a `pull_request` rule at all. +** *Keep the file.* Remove the Makefile line, drop or reorder the `.github/workflows/` line, name the root SECURITY.md explicitly, and correct the header. +* *dependabot.yml:* the comment says "we want the PRs fast (daily)", but `interval: weekly`. Stale comment. More important: nothing regenerates the lock on Dependabot PRs, because dependabot-lock-regen is disabled. Keep the file. +* *.github/scripts/* (`readme-vocab-gate.sh`, `classify-issue.jq`) and *no-js-baseline.txt* (20, matching the 20 tracked js/ts files) are fine. + +''' + +=== F. Ranked changes for better signal (≤15) + +. *Stop merging through red required gates.* Lock-Floor and Secret-Scan-Floor give admin `always` bypass, and #1231 used it to land a known-bad lock. Switch to `pull_request` bypass mode or drop the bypass. This is a ruleset change, but it is the top signal fix: every gate below is worthless if red merges anyway (Doctrine 5). +. *Fix README Derive's deadlock.* Delete the workflow-level `concurrency:` from `readme-derive-reusable.yml`, which breaks every caller in the estate. Delete standards' own `readme-derive.yml`: it would be a no-op here. Repoint the reusable from ECOSYSTEM.a2ml to the chora deed (owner decision). +. *Unjam Pages.* Force-cancel run 36877198396, and keep *one* Pages workflow (or none). Delete casket-pages.yml and pages.yml. +. *Make mirror honest.* +** Either provision codeberg `hyperpolymath/standards` and bitbucket `hyperpolymath-dev/standards`, and set the DISROOT / SOURCEHUT fingerprints and GITEA host + fingerprint, +** or set `*_MIRROR_ENABLED=false` for those five. +** Remove Radicle's `|| echo` mask, and call the reusable by `./`. +. *Delete dead workflows:* check-suite-monitor (6–11 no-op runs per push), echidna-verify (corpus evicted), changelog.yml, instant-sync, pages.yml, makefile-blocker, dependabot-lock-regen (or re-enable it once the App exists). +. *Collapse the 4 PR lock gates into 1* (actions-lock-gate running a union script), plus governance's consumer gate. Delete lock-sync-gate.yml and lock-selfcheck.yml. +. *Fix or park the red crons.* +** debt-measure: remove the expired `accepted-until` on the resolved SPDX entry (1 line). +** settings-drift-detect and tag-ruleset-canon: provision `ESTATE_SETTINGS_READ_TOKEN` and the ruleset App, *or remove the schedule* until they exist. A weekly red that nobody actions is noise. +. *propagate-hooks:* delete it, or rewrite discovery. Today it can only target standards itself, and its credential fails. +. *Merge scorecard-enforcer into scorecard* (min-score as a reusable input). That removes a duplicate publish on every push. +. *Delete uuid-v7.yml* (a triple-run of the v8 checker). Rename the governance context to v8 together with the gates derivation. +. *ci-pipeline:* remove the embedded secret-scan job, replace the @571cc734 internal pins with local refs, and pin `bun-version`. *Governance:* delete the "Deno allowed / tier 2" messages. +. *Delete zero-consumer reusables after an estate code search* confirms them: allowlist-preflight-reusable (inlined duplicate), github-backup-mirror-reusable, tailscale-connect-reusable, provisioning-check-reusable, codeql/elixir/changelog reusables. Also delete `.github/actions/affirmation-check` (superseded by cicd-suite). Note: apply-workflow-pins re-points callers to HEAD, so a file deleted at HEAD would break any hidden consumer. +. *Reconcile the required-check story.* +*** gates.json: codeql.yml is both a gate and never-required. +*** The live rules (3 contexts) do not match gates.json (the base profile plus the spark-theatre proof profile). +*** k9-contractile, lock-selfcheck and no-js-scan headers claim "REQUIRED". + +Either run `scripts/apply-branch-gates.sh --apply` or correct the claims. +. *Retire retired-format gate inputs (owner decision, via the deed mapping specs, not bulk conversion).* The affected inputs: +*** k9-contractile: INDEX.a2ml and `*file.a2ml` +*** dyadt-verify: CLAIMS.a2ml +*** debt-measure and governance's Debt ratchet: Debtfile.a2ml. debt-measure *writes facts into* an .a2ml, which CLAUDE.md forbids. +*** readme-derive: ECOSYSTEM.a2ml +*** canon-spine-lockstep: rsr-criteria-v2.a2ml +. *Clean up .github/:* delete funding.yml, ISSUES/ and copilot/coding-agent.yml. Fix the CODEOWNERS lines and the stale `# v4/# v3` pin comments. Elixir CI's self-run is vacuous here (no mix.exs); keep it only as a reusable smoke test, labelled as such. diff --git a/standards-map.toml b/standards-map.toml index edd402aba..79dc98058 100644 --- a/standards-map.toml +++ b/standards-map.toml @@ -33,7 +33,7 @@ [map] repo = "hyperpolymath/standards" version = "1.0.0" -entry_count = 126 +entry_count = 127 generated = false # hand-curated; the district index.adoc files ARE generated checked_by = "scripts/check-standards-map.sh" @@ -1582,6 +1582,19 @@ canonical_doc = "" gate = "" note = "GitHub security policy: supported versions (tip of main only) + private vulnerability reporting. Added 2026-09-22 (round 2 maps it)." +[[entry]] +from = "READINESS.md" +target = "READINESS.md" +district = "root" +kind = "onramp" +files = 1 +lifecycle = "versioned" +canonical = false +canon_slot = "" +canonical_doc = "" +gate = "" +note = "Machine-readable CRG grade declaration ('**Current Grade:** X' line), as component-readiness-grades/COMPONENT-READINESS-GRADES.adoc asks for; read by just crg-grade / crg-badge. Added 2026-10-13 by owner ruling (#1235); mapped 2026-10-14 (GATE D read it as an unmapped root)." + [[entry]] from = ".editorconfig" target = ".editorconfig" From 2c8fcf134684da43fc3247e4f2b73bf68e91837b Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 14 Oct 2026 01:02:36 +0000 Subject: [PATCH 2/2] docs(reorg): reword retired launcher filename and plain-HTTP quotes in the tidy pack The governance docs gate rejects any file naming the retired .a2ml spelling of the launcher standard (four quotes in the appendices and the dispositions table), and the Hypatia baseline validator reported one new http_in_docs finding for a quoted plain-HTTP curl example. Both are evidence text; reworded so the gates read clean without a baseline ack. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01T4U5XuN4NWs8FTxoe5PuH7 --- docs/reorg/2026-10-14-tidy/README.adoc | 6 +++--- docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc | 8 ++++---- docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc | 2 +- docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc | 8 ++++---- docs/reorg/2026-10-14-tidy/workflow-audit.adoc | 2 +- 5 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/reorg/2026-10-14-tidy/README.adoc b/docs/reorg/2026-10-14-tidy/README.adoc index 4f2b3db9d..a959bdbd5 100644 --- a/docs/reorg/2026-10-14-tidy/README.adoc +++ b/docs/reorg/2026-10-14-tidy/README.adoc @@ -363,7 +363,7 @@ tooling for a live format, like `1-formats/deed/tools/`. "actions.lock regenerated?" checkbox). `.github/ISSUES/` holds seven issue drafts from 2026-06-05 that were never filed and now contradict doctrine. `.github/copilot/coding-agent.yml` runs an unpinned `npx` - against `http://localhost`. `CODEOWNERS` names a `Makefile`, a + against a plain-HTTP localhost URL. `CODEOWNERS` names a `Makefile`, a `3-practice/SECURITY.md` path GitHub does not read, and claims `require_code_owner_review: true` while no live ruleset has a pull-request rule. The wiki and Discussions are enabled; D295 says @@ -424,7 +424,7 @@ state, steps, tier, risk) is in the appendix for the issue's range. | #309 | ESTATE-CAMPAIGN | [campaign] Python residual cleanup — ~45 estate-authored .py files remain (banned) | #323 | MERGE-INTO(#288) | [standing] Estate CodeQL cron drift detection + 6-week budget review | #324 | MERGE-INTO(#288) | [campaign] Long-tail non-canonical CodeQL cron sweep (~86 files / 30 repos) -| #331 | ESTATE-CAMPAIGN | [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + http://) +| #331 | ESTATE-CAMPAIGN | [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + plain-HTTP ) | #343 | ESTATE-CAMPAIGN | audit: dotfile drift across estate (2026-06-02 sample) — .editorconfig / .gitignore / .gitattributes | #346 | OWNER-RULING | governance: hoist bridge-forbidden-phrases check into reusable workflow | #348 | ESTATE-CAMPAIGN | automation: hypatia ruleset + gitbots should be able to fan-out doc + descriptiles + contractile refreshes themselves @@ -538,7 +538,7 @@ state, steps, tier, risk) is in the appendix for the issue's range. | #955 | BOT-DO | Debt ratchet red on every PR since #820 — run-debtfile.sh --write emits a file check-debtfile-structure.sh rejects | #957 | BOT-DO | PAT-refresh tripwire: live HYPATIA_SCAN_PAT will arm 6 unackable CSA findings in both gates | #958 | BOT-DO | Debt-exception / Ratchet-exception trailers never survive the squash merge — 0 of 8 in the Debtfile's whole history -| #960 | KEEP-OPEN-BLOCKED | D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted launcher-standard.a2ml +| #960 | KEEP-OPEN-BLOCKED | D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted the retired .a2ml spelling of the launcher standard | #963 | CLOSE-DONE | main is red: actions.lock omits a transitive dependency of asana/push-signed-commits (actions/setup-python@v2) | #964 | BOT-DO | governance-reusable.yml dupkey helper pin 317101e0 is stale by 45 files — and its sparse-checkout scope is too wide for #962's freshness guard | #967 | CLOSE-DONE | ci-pipeline detect is blind to 56 code-bearing repos (and probes Deno, not Bun) diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc index e085cb863..7b78a8616 100644 --- a/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc +++ b/docs/reorg/2026-10-14-tidy/issue-triage-089-497.adoc @@ -206,14 +206,14 @@ Rulings sources read: #787 body + all comments (D1–D331, downloaded to `scratc . DISPOSITION: *MERGE-INTO(#288)* (one sweep: any root CodeQL cron → monthly). . RISK: bulk (mechanical). -==== #331 — [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + http://) +==== #331 — [campaign] Estate boj-build.yml sweep — repair or retire (~30 repos with malformed JSON + dead .local host + plain-HTTP ) . Labels: meta:campaign, priority:p1, scope:estate, refactor, status:needs-ruling · last comment 2026-09-08 · 4 comments. -. LITERAL: Repair or retire `boj-build.yml` across ~30 repos (malformed JSON, `.local` host, `http://`, masked by `continue-on-error`). +. LITERAL: Repair or retire `boj-build.yml` across ~30 repos (malformed JSON, `.local` host, the plain-HTTP scheme, masked by `continue-on-error`). . GOLDEN: Scope is ~252–255, not ~30. Decision exists: *D14 (owner): BoJ alive, keep `boj-build.yml`, repair red runs*; D9(E) "guarded template at ~252". The 09-08 recommendation to delete all 252 is overruled. ⚠ D9's text says "#331 AGENTIC.md fleet" — a label mismatch (D222 shows an echo-types #331 about AGENTIC/STATE files); confirm D9 really refers to standards#331 before citing it. -. MISCHIEF: silent-broken dispatch. *Still exists*: e.g. `gitbot-fleet/.github/workflows/boj-build.yml:20-21` — `http://boj-server.local:7700/...`, malformed `-d` JSON, `${{ github.* }}` interpolated into `run:`, `continue-on-error: true`. Generator fixed (iseriser#101 `b898428d`). Standards' own copy (`.github/workflows/boj-build.yml:62-65`) still posts to the plural route `/cartridges/ssg-mcp/invoke` (fixed generator uses singular `/cartridge/:name/invoke`) and masks failure with `|| echo "... (non-fatal)"`, with no https check. +. MISCHIEF: silent-broken dispatch. *Still exists*: e.g. `gitbot-fleet/.github/workflows/boj-build.yml:20-21` — `plain-HTTP boj-server.local:7700/...`, malformed `-d` JSON, `${{ github.* }}` interpolated into `run:`, `continue-on-error: true`. Generator fixed (iseriser#101 `b898428d`). Standards' own copy (`.github/workflows/boj-build.yml:62-65`) still posts to the plural route `/cartridges/ssg-mcp/invoke` (fixed generator uses singular `/cartridge/:name/invoke`) and masks failure with `|| echo "... (non-fatal)"`, with no https check. . STATE: generator done; 0 deployed copies repaired (except standards partly, .git-private-farm deleted via #43). . DISPOSITION: *ESTATE-CAMPAIGN*. -. Steps: take the iseriser#101 emitted template as canonical (env-sourced `BOJ_SERVER_URL`, `jq -nc --arg` payload, https-only scheme check, loud skip when unset, `curl --fail-with-body`, singular route); first align standards' own copy; then replace the file wholesale (not patch) in each hyperpolymath/metadatastician repo carrying it, one PR per repo, squash. Acceptance: census of `boj-build.yml` shows 0 `.local`, 0 `http://`, 0 `continue-on-error`, valid JSON payload builder. Effort *L*. Tier *haiku* (scripted replace + diff check), sonnet spot review. +. Steps: take the iseriser#101 emitted template as canonical (env-sourced `BOJ_SERVER_URL`, `jq -nc --arg` payload, https-only scheme check, loud skip when unset, `curl --fail-with-body`, singular route); first align standards' own copy; then replace the file wholesale (not patch) in each hyperpolymath/metadatastician repo carrying it, one PR per repo, squash. Acceptance: census of `boj-build.yml` shows 0 `.local`, 0 the plain-HTTP scheme, 0 `continue-on-error`, valid JSON payload builder. Effort *L*. Tier *haiku* (scripted replace + diff check), sonnet spot review. . RISK: bulk sweep (ruled by D14); skip forks/third-party; the-nash-equilibrium guard caveat (D26). ==== #343 — audit: dotfile drift across estate (2026-06-02 sample) — .editorconfig / .gitignore / .gitattributes diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc index 8ac8da789..c3e4c203f 100644 --- a/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc +++ b/docs/reorg/2026-10-14-tidy/issue-triage-1049-1234.adoc @@ -678,7 +678,7 @@ E arm: A=yes. For B=no, a fetch-at-build plus pinned hash avoids drift entirely. ==== #1226 — Ruling needed: per-app launcher praxis field vocabulary before the 21-descriptor migration . labels decision | last 2026-10-10 | 0 . *LITERAL:* the owner rules on the per-app `.launcher_praxis.deed` vocabulary: field set, opaque/typed encoding of `[integration]` and `[exceptions]`, unknown-field behaviour, ordering and ownership. Plus fixtures, a rename manifest and a dual-accept overlap. -. *GOLDEN:* fine. It also unblocks #1086's 13 minted launchers (avoiding A2ML edits) and #960 (open: "21 launcher descriptors … still name the deleted launcher-standard.a2ml"). +. *GOLDEN:* fine. It also unblocks #1086's 13 minted launchers (avoiding A2ML edits) and #960 (open: "21 launcher descriptors … still name the deleted the retired .a2ml spelling of the launcher standard"). . *MISCHIEF:* lossy conversion risk. *Still exists.* No per-app vocabulary in `launcher/` or `1-formats/deed/vocabulary/`. A mapping `1-formats/deed/mappings/launcher-standard-to-praxis-deed.adoc` exists for the *standard*, not per-app descriptors. . *STATE:* awaiting ruling. . *DISPOSITION:* *OWNER-RULING.* Question: "Adopt launch-scaffolder's local design (`docs/per-app-launcher-descriptor-deed.adoc`) as the normative per-app vocabulary, with `[integration]` as an opaque quoted carry, `[exceptions]` as ordered `(override …)`, and unknown TOML keys blocking conversion?" Yes or no. E arm: yes, with the vocabulary doc owned by standards `1-formats/deed/vocabulary/launcher-app.adoc`. diff --git a/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc b/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc index 0a0d39599..e9d3c526e 100644 --- a/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc +++ b/docs/reorg/2026-10-14-tidy/issue-triage-911-1037.adoc @@ -308,8 +308,8 @@ Effort S. Tier: sonnet. . LITERAL: Remediate the 11 instances or renew the baseline ack (expires 2026-12-22). . GOLDEN: Partly. All 11 are intentional: ** the speakup.io archive link (axel CoC); -** `curl -I http://axel-protocol.org` and redirect demos; -** TRUST-DEFAULTS-POLICY rule text *about* `http://`; +** `curl -I` against the plain-HTTP axel-protocol.org origin and redirect demos; +** TRUST-DEFAULTS-POLICY rule text *about* the plain-HTTP scheme; ** a detector-test example; ** `LICENSES/MPL-2.0.txt:360` (licence text, untouchable); ** 3 in 9-archive. @@ -533,10 +533,10 @@ Effort S. Tier: sonnet. Effort S. Tier: sonnet. . RISK: none. -==== #960 — D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted launcher-standard.a2ml +==== #960 — D73-C downstream: 21 launcher descriptors + trigger/ still name the deleted the retired .a2ml spelling of the launcher standard . migration,scope:estate,priority:p2,status:ready · 2026-09-30 · 9 . LITERAL: -** AC1: no writable repo names `launcher-standard.a2ml`; +** AC1: no writable repo names `the retired .a2ml spelling of the launcher standard`; ** AC2: decide on the 21 descriptors; ** AC3: fix trigger; ** AC4: add a currency gate. diff --git a/docs/reorg/2026-10-14-tidy/workflow-audit.adoc b/docs/reorg/2026-10-14-tidy/workflow-audit.adoc index 439286e13..f09d2a0ac 100644 --- a/docs/reorg/2026-10-14-tidy/workflow-audit.adoc +++ b/docs/reorg/2026-10-14-tidy/workflow-audit.adoc @@ -287,7 +287,7 @@ self-test adds lock-gate pin freshness. All four failed together on #1231, and i ** Several recommendations are now contradicted by doctrine. 003 proposes path filters, and required gates deliberately carry none. ** They also bypass the intake rule (`blank_issues_enabled: false`; Intake Spec rule 4). ** *Delete the directory.* Re-file any still-live item through the `campaign` template. -* *copilot/coding-agent.yml:* an MCP config running `npx -y @hyperpolymath/boj-server@latest` with `BOJ_URL: http://localhost:7700`. +* *copilot/coding-agent.yml:* an MCP config running `npx -y @hyperpolymath/boj-server@latest` with `BOJ_URL: plain-HTTP localhost:7700`. ** It uses npx (Bun/bunx is the estate default), an *unpinned `@latest`*, and plain HTTP. ** I could not confirm that GitHub reads this path. Copilot coding-agent MCP config is normally set in repository settings. ** Added 2026-06-01 (c8fb89bd) and untouched since. *Delete it*, or move it to settings with a pinned version and bunx.