[hyperpolymath]

Change and reason

Supersedes #243 after main advanced through #242 and #246. This branch is based directly on current main (d84400e) and preserves its leaf-PD regressions, existing secret-scan configuration, broader EditorConfig, and safe Scorecard triggers. The six #243 changes are retained as ordinary DCO-signed commits; no merge commit or stale-side reversion is used.

Changes

• Independent governance evidence: add a guarded, fork-local K9 conformance reusable and artifact. DEED syntax, K9 L0–L2 evidence, and advisory Hypatia remain separate. Missing semantic evidence fails closed; the empty contract corpus is explicitly not applicable rather than a semantic pass.
• Secret scanning: use checksum-verified Gitleaks 8.30.1, retain full working-tree/history coverage and the existing repository config, redact Rust/shell findings, fail closed on AsciiDoc scanner errors, apply custom shell rules to historical blobs, and test detector sensitivity with a synthetic credential. No caller secrets, advisory failure override, or privileged PR trigger is added.
• CI reliability and dependency security: preserve producer and log-writer exits in both Julia pipelines, retain main's 60-minute Julia bound, and audit high/critical frontend advisories in CI. Scorecard keeps its safe triggers and moves to the audited immutable standards source required by the expanded governance contract.
• Frontend dependencies: raise Vite to 6.4.5 and Router DOM to 6.30.6 and refresh the Bun lockfile within current major ranges. No generated assets are committed.
• R source boundaries: validate PERMANOVA metadata identifiers before R formula parsing and package names before provenance interpolates them into R source. Plain identifiers retain existing behaviour; expressions, controls, quoting, escapes, and reserved formula terms are rejected with regressions.
• Repository policy: add Dependabot, expand deployment/security guidance, and add a repository-specific AI manifest without changing the settled architecture or existing licence declarations.

Local verification

• Governance contract: 39/39 passed; all 8 weakening mutations rejected
• CI producer/logger exit combinations: 4/4 passed; K9 optional-log cases: 3/3 passed
• Scanner boundaries: working-tree and deleted-history shell credentials blocked without disclosure; Rust findings redacted; all six clean/error/finding AsciiDoc cases passed
• Actual custom shell scan: working tree and full Git history clean
• Real Gitleaks 8.30.1 with merged config: working tree and 193 reachable commits clean; synthetic AWS canary still fails with aws-access-token
• Unique-key YAML parsing passed for all workflow/Dependabot files; bash -n passed for 84 embedded run blocks and all standalone scripts
• Bun 1.3.10: frozen install, TypeScript, 72 tests / 200 assertions, production build, and high/critical audit gate passed
• Full audit reports 2 moderate React Router advisories; this is not a zero-vulnerability claim
• Sonar reliability lint, independent high-precision references, and git diff --check passed
• Julia/R execution and canonical K9 validation require the hosted toolchains; no local runtime pass is claimed

Deliberate review triage and limits

• The two remaining React Router advisories require a v7 routing/SSR migration review rather than an unreviewed major upgrade here.
• Estate TypeScript/Python language bans remain policy debt; W3C namespace URIs are identifiers, not network requests. Existing Hypatia findings are not suppressed.
• K9 has no committed contracts, so green validator/self-test evidence must not be read as substantive application-contract coverage.
• Code-scanning/Dependabot alert APIs remain inaccessible to this integration; no alerts are dismissed. Scorecard default-branch publication can only be observed after landing.
• No dependency-major migration, generated assets, history exclusions, fake conformance evidence, or external mirror configuration is added.

Scope

• Current-main ordinary commits with Signed-off-by: (DCO)
• Existing fix: complete PR #219 reconciliation and governance hardening #242/test(cladistics): cover the zero-read half of the vacated-clade tip rule #246 fixes and repository scanner config preserved
• No generated assets or vendored files committed
• Secrets, local paths, and run outputs not committed

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-23T16:57:10.411660Z We couldn’t complete this review. Comment @codex review to try again.	23bb21a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 17 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: bbc19c07-a701-452a-b244-1e2415119188

📥 Commits

Reviewing files that changed from the base of the PR and between a9fb609 and 23bb21a.

⛔ Files ignored due to path filters: 1

• frontend/bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 23

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/governance.yml
• .github/workflows/k9-conformance-reusable.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner-reusable.yml
• .github/workflows/secret-scanner.yml
• 0-AI-MANIFEST.a2ml
• MetaManifold-WebUI_chora.deed
• SECURITY.md
• docs/release-notes/2026-10-23-governance-security.md
• frontend/package.json
• scripts/check-governance-contract.sh
• scripts/ci/check-shell-secrets.sh
• scripts/tests/test-ci-logging.sh
• scripts/tests/test-governance-contract.sh
• scripts/tests/test-k9-log-copy.sh
• scripts/tests/test-scanner-boundaries.sh
• scripts/tests/test-secret-scanner.sh
• src/analysis/analysis.jl
• src/core/provenance.jl
• test/unit/test_permanova.jl
• test/unit/test_provenance.jl

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hyperpolymath]

Superseded by events: #243 was merged as a9fb609 while this replacement was being validated. The merged tree contains the substantive scanner/K9/dependency/R-boundary work. The remaining duplicate-Julia-timeout defect found independently here is already covered by focused follow-up #247. This duplicate PR is therefore being closed without merging; local validation (39 governance checks, 8 mutations, scanner boundaries, real Gitleaks history/working-tree scans, Bun tests/build/audit, and unique-key YAML) will be used as supporting evidence for the follow-up rather than recreating merged work.