From a48560b78f0d84240451b635fa9097ea3cc8d5ca Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 19 Oct 2026 13:02:54 +0100
Subject: [PATCH 1/3] =?UTF-8?q?ci(fork):=20governance=20lane=20=E2=80=94?=
 =?UTF-8?q?=20DEED=20syntax=20and=20the=20Hypatia=20verdict=20grid?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two reusable lanes from hyperpolymath/standards (deed-conformance at
75bd5994, hypatia-scan-reusable on feat/verdict-grid until it merges),
plus the caller-side jobs that post the grid on a pull request and
publish shields endpoints to an orphan governance-badges branch.

Adds the repo deed, the gitbot-fleet enrolment manifest and three fork
badges in the README. Fork only; nothing here is for upstream.
---
 .github/workflows/governance.yml | 154 +++++++++++++++++++++++++++++++
 MetaManifold-WebUI_chora.deed    |  29 ++++++
 README.md                        |   6 ++
 3 files changed, 189 insertions(+)
 create mode 100644 .github/workflows/governance.yml
 create mode 100644 MetaManifold-WebUI_chora.deed

diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
new file mode 100644
index 0000000..20910d5
--- /dev/null
+++ b/.github/workflows/governance.yml
@@ -0,0 +1,154 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# Fork governance lane. Two reusable lanes from hyperpolymath/standards, each
+# pinned to a commit: DEED syntax for the repo deed, and the Hypatia verdict
+# grid (Hypatia, panic-attack, pons asinorum and the gitbot-fleet report-backs
+# under .gitbot-fleet/). This workflow is the fork's; nothing in it is
+# proposed upstream, and upstream's ci.yml is untouched.
+#
+# The reusable renders the grid; the two jobs below post it on the pull
+# request and publish the badges, because a called workflow may not request
+# permissions its caller does not grant.
+name: Governance (fork)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  deed:
+    name: DEED syntax
+    uses: hyperpolymath/standards/.github/workflows/deed-conformance.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
+    permissions:
+      contents: read
+    with:
+      require-files: true
+
+  hypatia:
+    name: Hypatia verdict grid
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@feat/verdict-grid
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    secrets:
+      HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
+
+  verdict:
+    name: Post the verdict grid
+    needs: [deed, hypatia]
+    if: ${{ always() && github.event_name == 'pull_request' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write
+    steps:
+      - name: Download the verdict grid
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: verdict-grid
+          path: verdict-grid
+
+      - name: Update the compact PR verdict
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          DEED_RESULT: ${{ needs.deed.result }}
+          HYPATIA_RESULT: ${{ needs.hypatia.result }}
+          HYPATIA_VERDICT: ${{ needs.hypatia.outputs.verdict }}
+        run: |
+          set -euo pipefail
+          # The DEED lane is a conformance row: pass is green, failure red,
+          # anything else (skipped, cancelled, no result) orange. The grid
+          # itself comes from the artifact; a missing artifact is orange.
+          case "$DEED_RESULT" in
+            success) deed='🟢 conformant' ;;
+            failure) deed='🔴 failing' ;;
+            *)       deed="🟠 indeterminate ($DEED_RESULT)" ;;
+          esac
+          {
+            echo '<!-- fork-governance-verdict: regenerated on every run -->'
+            echo '# Fork governance'
+            echo
+            echo "| Lane | Status | Run |"
+            echo "|---|---|---|"
+            echo "| DEED syntax (repo deed) | $deed | [run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) |"
+            echo "| Hypatia verdict grid | ${HYPATIA_VERDICT:-orange} (job: $HYPATIA_RESULT) | same run |"
+            echo
+            if [ -s verdict-grid/report.md ]; then
+              cat verdict-grid/report.md
+            else
+              echo '🟠 indeterminate · no verdict-grid artifact was produced by the Hypatia lane; see the run.'
+            fi
+          } > "$RUNNER_TEMP/body.md"
+          # One comment per PR, updated in place; newest run wins.
+          comment_id=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
+            | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- fork-governance-verdict:")))] | last | .id // ""')
+          jq -n --rawfile body "$RUNNER_TEMP/body.md" '{body: $body}' > "$RUNNER_TEMP/comment.json"
+          if [ -n "$comment_id" ]; then
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --input "$RUNNER_TEMP/comment.json" >/dev/null
+          else
+            gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --input "$RUNNER_TEMP/comment.json" >/dev/null
+          fi
+          echo "published the governance verdict to #$PR_NUMBER"
+
+  badges:
+    name: Publish badges
+    needs: [deed, hypatia]
+    if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      actions: read
+    steps:
+      - name: Download the verdict grid
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: verdict-grid
+          path: verdict-grid
+
+      - name: Write the badge endpoints and push the governance-badges branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DEED_RESULT: ${{ needs.deed.result }}
+        run: |
+          set -euo pipefail
+          # shields.io endpoint JSON, one file per lane, on an orphan branch
+          # that holds nothing else. README badges read them through
+          # img.shields.io/endpoint. A lane without a result publishes orange.
+          mkdir -p out
+          case "$DEED_RESULT" in
+            success) msg=conformant; colour=brightgreen ;;
+            failure) msg=failing; colour=red ;;
+            *)       msg=indeterminate; colour=orange ;;
+          esac
+          jq -n --arg m "$msg" --arg c "$colour" '{schemaVersion: 1, label: "DEED syntax", message: $m, color: $c}' > out/deed.json
+          if [ -s verdict-grid/badge.json ]; then
+            cp verdict-grid/badge.json out/hypatia-grid.json
+          else
+            jq -n '{schemaVersion: 1, label: "Hypatia grid", message: "indeterminate", color: "orange"}' > out/hypatia-grid.json
+          fi
+          [ -s verdict-grid/report.json ] && cp verdict-grid/report.json out/hypatia-grid.report.json
+          cd out
+          git init -q -b governance-badges
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add -A
+          git commit -q -m "badges: $GITHUB_SHA"
+          git push -q --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" governance-badges
+          echo "published badge endpoints for $GITHUB_SHA"
diff --git a/MetaManifold-WebUI_chora.deed b/MetaManifold-WebUI_chora.deed
new file mode 100644
index 0000000..dc5f96b
--- /dev/null
+++ b/MetaManifold-WebUI_chora.deed
@@ -0,0 +1,29 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+(repo-deed
+  :schema-version "1.0.0"
+  :canonical-name "MetaManifold-WebUI"
+  :repo-uuid #u8"gv-clade-index:github.com/hyperpolymath/MetaManifold-WebUI"
+  :beholding-chora #u5"estate/chora"
+  (identity :owner "hyperpolymath" :primary-forge github :fork-of "JoshuaJewell/MetaManifold-WebUI")
+  (front-doors :human "README.md" :agent "CONTRIBUTING.md")
+  (authority
+    :licensing "LICENSE"
+    :contribution "CONTRIBUTING.md"
+    :upstream "https://github.com/JoshuaJewell/MetaManifold-WebUI")
+  (routing
+    :upstream-candidates "upstream/*"
+    :frontend "frontend/"
+    :analysis "src/analysis/"
+    :proofs "proofs/"
+    :enforcement ".github/workflows/")
+  (status
+    :evidence-source ".github/workflows/governance.yml"
+    :evidence-status "Fork governance lane only: DEED syntax and the Hypatia verdict grid with gitbot-fleet report-backs. Upstream owns the code and its CI; this deed describes the fork.")
+  (policies
+    (licensing
+      :initial-assignment "New files the fork authors carry MPL-2.0 with an SPDX header, as upstream CONTRIBUTING.md permits."
+      :existing-declarations "Manual-Only. Upstream AGPL-3.0 and CC BY-SA 4.0 headers, LICENSE and CITATION.cff are never changed on this fork.")
+    (fleet
+      :enrolment ".gitbot-fleet/enrolment.json"
+      :report-backs ".gitbot-fleet/report-backs/")))
diff --git a/README.md b/README.md
index c4307a2..998fcc1 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,12 @@
 [![CI](https://github.com/JoshuaJewell/MetaManifold-WebUI/actions/workflows/ci.yml/badge.svg)](https://github.com/JoshuaJewell/MetaManifold-WebUI/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/JoshuaJewell/MetaManifold-WebUI/graph/badge.svg?token=20F1VLF590)](https://codecov.io/gh/JoshuaJewell/MetaManifold-WebUI)
 
+Fork governance (hyperpolymath/MetaManifold-WebUI only; nothing here is part of upstream):
+[![Governance (fork)](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/workflows/governance.yml/badge.svg)](https://github.com/hyperpolymath/MetaManifold-WebUI/actions/workflows/governance.yml)
+[![DEED syntax](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fhyperpolymath%2FMetaManifold-WebUI%2Fgovernance-badges%2Fdeed.json)](MetaManifold-WebUI_chora.deed)
+[![Hypatia grid](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fhyperpolymath%2FMetaManifold-WebUI%2Fgovernance-badges%2Fhypatia-grid.json)](https://github.com/hyperpolymath/standards/blob/main/docs/VERDICT-GRID-SPEC.adoc)
+The grid grades the worst finding each reporter has (purple critical, red high, yellow medium, blue minor, green clean), with a scanner that did not run in orange and a fleet member not enrolled for this repository in grey; enrolment is in `.gitbot-fleet/enrolment.json`.
+
 MetaManifold wraps standard amplicon sequencing workflows into a single configurable Julia orchestrator: from raw paired-end Next Generation Sequencing reads through denoising, taxonomy assignment and taxonomic filtering, with interactive configuration and analysis in the browser.
 
 <p align="center">

From 5dfc9837a550dea6bfaefbfcf956cce2ce2bdf51 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 19 Oct 2026 13:10:53 +0100
Subject: [PATCH 2/3] ci(fork): track the gitbot-fleet enrolment manifest

The first commit left .gitbot-fleet/enrolment.json out, so the grid showed
no fleet rows. Force-added past the ignore rule that caught it; the grid
now renders the seven enrolled members as orange until they report back
and the two not enrolled as grey with their reasons.
---
 .gitbot-fleet/enrolment.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 .gitbot-fleet/enrolment.json

diff --git a/.gitbot-fleet/enrolment.json b/.gitbot-fleet/enrolment.json
new file mode 100644
index 0000000..4f8c684
--- /dev/null
+++ b/.gitbot-fleet/enrolment.json
@@ -0,0 +1,14 @@
+{
+  "schema": 1,
+  "reporters": {
+    "rhodibot": { "title": "rhodibot (RSR compliance)", "enrolled": true },
+    "panicbot": { "title": "panicbot (panic recovery, error handling)", "enrolled": true },
+    "echidnabot": { "title": "echidnabot (formal verification: proofs/)", "enrolled": true },
+    "seambot": { "title": "seambot (integration health: API routes)", "enrolled": true },
+    "finishingbot": { "title": "finishingbot (release readiness)", "enrolled": true },
+    "accessibilitybot": { "title": "accessibilitybot (WCAG on the React UI)", "enrolled": true },
+    "glambot": { "title": "glambot (presentation quality)", "enrolled": true },
+    "cipherbot": { "enrolled": false, "reason": "no cryptography is implemented in this repository" },
+    "sustainabot": { "enrolled": false, "reason": "fleet adapter slot reserved; no adapter exists yet (gitbot-fleet README)" }
+  }
+}

From 60d42efa7de2e875fb39acae53677e64270501c5 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 19 Oct 2026 13:11:10 +0100
Subject: [PATCH 3/3] ci(fork): un-ignore .gitbot-fleet/ so report-backs can be
 tracked

The catch-all dotfile rule hid the enrolment manifest; report-backs
written by fleet members would be hidden the same way.
---
 .gitignore | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitignore b/.gitignore
index 26faf84..b050718 100644
--- a/.gitignore
+++ b/.gitignore
@@ -338,3 +338,7 @@ proofs/agda/_build/
 
 # Occupancy proof dependencies and reproduction logs
 /_build/
+
+# Fork governance: the gitbot-fleet enrolment manifest and report-backs are tracked.
+!.gitbot-fleet/
+!.gitbot-fleet/**