From 8c5ad3ab7768a53ea3432375f7b4fbdac85f5185 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 09:35:01 +0100 Subject: [PATCH 1/2] chore(ci): delete 8 committed patch-debris files MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A patch-application sweep left `.rej` and `.orig` files committed under .github/workflows/. They are inert — GitHub only reads `.yml` there — but they are actively misleading, and one of them is dangerous to re-apply. Every rejected hunk is an OBSOLETE pin bump. They target 892497fe / 7fdc2705 / d135b05b / 81dbf2dd / c65436ee, all of which are superseded by the current governance pin; PR #177 already moves these same five workflows to the live target. Re-applying any of this would move pins BACKWARDS. scorecard.yml.rej is worse than obsolete. Its hunk rewrites the permissions block to: jobs: analysis: permissions: contents: read security-events: write which is unparseable — the same naive string-splicing permissions sweep that left scorecard.yml invalid in ten other repositories. An unparseable workflow does not fail its gate, it produces ZERO jobs and therefore no check at all, so the repo scores GREENER than a repaired one. This repo escaped only because the hunk rejected instead of applying. Verified before deleting: all 20 live workflows under .github/workflows/ parse as valid YAML, scorecard.yml included, so no live file depends on this debris and no unlanded fix is discarded by removing it. Touches only `.rej`/`.orig` paths. No overlap with the five `.yml` files open PR #177 edits, so the two cannot conflict. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/elixir-ci.yml.rej | 11 -------- .github/workflows/governance.yml.orig | 34 ----------------------- .github/workflows/governance.yml.rej | 7 ----- .github/workflows/mirror.yml.rej | 9 ------ .github/workflows/scorecard.yml.orig | 17 ------------ .github/workflows/scorecard.yml.rej | 22 --------------- .github/workflows/secret-scanner.yml.orig | 21 -------------- .github/workflows/secret-scanner.yml.rej | 9 ------ 8 files changed, 130 deletions(-) delete mode 100644 .github/workflows/elixir-ci.yml.rej delete mode 100644 .github/workflows/governance.yml.orig delete mode 100644 .github/workflows/governance.yml.rej delete mode 100644 .github/workflows/mirror.yml.rej delete mode 100644 .github/workflows/scorecard.yml.orig delete mode 100644 .github/workflows/scorecard.yml.rej delete mode 100644 .github/workflows/secret-scanner.yml.orig delete mode 100644 .github/workflows/secret-scanner.yml.rej diff --git a/.github/workflows/elixir-ci.yml.rej b/.github/workflows/elixir-ci.yml.rej deleted file mode 100644 index 8a6c1fa..0000000 --- a/.github/workflows/elixir-ci.yml.rej +++ /dev/null @@ -1,11 +0,0 @@ ---- .github/workflows/elixir-ci.yml -+++ .github/workflows/elixir-ci.yml -@@ -19,7 +19,7 @@ permissions: - - jobs: - elixir-ci: -- uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 -+ uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - with: - otp-version: "27.2.1" - elixir-version: "1.18.2" diff --git a/.github/workflows/governance.yml.orig b/.github/workflows/governance.yml.orig deleted file mode 100644 index 76a63ca..0000000 --- a/.github/workflows/governance.yml.orig +++ /dev/null @@ -1,34 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-guix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -# Estate guardrail: cancel superseded runs so re-pushes / rebased PR -# updates do not pile up queued runs against the shared account-wide -# Actions concurrency pool. Applied only to read-only check workflows -# (no publish/mutation), so cancelling a superseded run is always safe. -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 diff --git a/.github/workflows/governance.yml.rej b/.github/workflows/governance.yml.rej deleted file mode 100644 index faf27ee..0000000 --- a/.github/workflows/governance.yml.rej +++ /dev/null @@ -1,7 +0,0 @@ ---- .github/workflows/governance.yml -+++ .github/workflows/governance.yml -@@ -31,4 +31,4 @@ permissions: - - jobs: - governance: -- uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9+ uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 \ No newline at end of file diff --git a/.github/workflows/mirror.yml.rej b/.github/workflows/mirror.yml.rej deleted file mode 100644 index c4879e9..0000000 --- a/.github/workflows/mirror.yml.rej +++ /dev/null @@ -1,9 +0,0 @@ ---- .github/workflows/mirror.yml -+++ .github/workflows/mirror.yml -@@ -11,5 +11,5 @@ permissions: - - jobs: - mirror: -- uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 -+ uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit diff --git a/.github/workflows/scorecard.yml.orig b/.github/workflows/scorecard.yml.orig deleted file mode 100644 index 20a29ea..0000000 --- a/.github/workflows/scorecard.yml.orig +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Scorecards supply-chain security - -on: - branch_protection_rule: - schedule: - - cron: '23 4 * * 1' - -permissions: read-all - -jobs: - analysis: - permissions: - security-events: write - id-token: write - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 - secrets: inherit diff --git a/.github/workflows/scorecard.yml.rej b/.github/workflows/scorecard.yml.rej deleted file mode 100644 index a3c95fb..0000000 --- a/.github/workflows/scorecard.yml.rej +++ /dev/null @@ -1,22 +0,0 @@ ---- .github/workflows/scorecard.yml -+++ .github/workflows/scorecard.yml -@@ -6,12 +6,14 @@ on: - schedule: - - cron: '23 4 * * 1' - --permissions: read-all -- -+permissions: -+ contents: read -+ security-events: write -+ id-token: write - jobs: - analysis: - permissions: -- security-events: write -- id-token: write -- uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 -+ contents: read -+ security-events: write -+ id-token: write uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 - secrets: inherit \ No newline at end of file diff --git a/.github/workflows/secret-scanner.yml.orig b/.github/workflows/secret-scanner.yml.orig deleted file mode 100644 index 7ccae92..0000000 --- a/.github/workflows/secret-scanner.yml.orig +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit diff --git a/.github/workflows/secret-scanner.yml.rej b/.github/workflows/secret-scanner.yml.rej deleted file mode 100644 index 30ff515..0000000 --- a/.github/workflows/secret-scanner.yml.rej +++ /dev/null @@ -1,9 +0,0 @@ ---- .github/workflows/secret-scanner.yml -+++ .github/workflows/secret-scanner.yml -@@ -17,5 +17,5 @@ jobs: - scan: - permissions: - contents: read -- uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586 -+ uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66 - secrets: inherit \ No newline at end of file From 4ec53f598df713428f1dadabe924302d6c347513 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Sat, 12 Sep 2026 15:29:48 +0100 Subject: [PATCH 2/2] chore: Add A2ML metadata and structure ASSAIL suppressions Add SPDX, name, project, and version metadata to the ASSAIL classifications manifest, and nest its existing security suppressions under a top-level list for CI-compatible validation. Validation: `git diff --check` passes; no broader test suite was run. [View coding task](https://app.coderabbit.ai/code/tasks/985fde70-d434-43dd-9729-e1c7dd0a7a5d?source=coding_agent_github_pr_description) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- audits/assail-classifications.a2ml | 77 ++++++++++++++++-------------- 1 file changed, 41 insertions(+), 36 deletions(-) diff --git a/audits/assail-classifications.a2ml b/audits/assail-classifications.a2ml index 458a29a..e805c50 100644 --- a/audits/assail-classifications.a2ml +++ b/audits/assail-classifications.a2ml @@ -1,37 +1,42 @@ %A2ML -- suppression: - file: 'assets/js/hooks/prompt_radar_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'assets/js/hooks/evidence_graph_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'assets/js/hooks/timeline_hook.js' - rule: 'DynamicCodeExecution' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'config/test.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'config/dev.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'test/evidence_graph/accounts_test.exs' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/zotero/client.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/accounts.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' -- suppression: - file: 'lib/evidence_graph/lithoglyph/client.ex' - rule: 'HardcodedSecret' - justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' +# SPDX-License-Identifier: MPL-2.0 +name: 'assail-classifications' +project: 'bofig' +version: '1.0.0' +suppressions: + - suppression: + file: 'assets/js/hooks/prompt_radar_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'assets/js/hooks/evidence_graph_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'assets/js/hooks/timeline_hook.js' + rule: 'DynamicCodeExecution' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'config/test.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'config/dev.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'test/evidence_graph/accounts_test.exs' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/zotero/client.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/accounts.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).' + - suppression: + file: 'lib/evidence_graph/lithoglyph/client.ex' + rule: 'HardcodedSecret' + justification: 'Automated estate triage: reviewed as safe within its architectural boundary (e.g. local tooling, bounded reads, expected metaprogramming).'