[hyperpolymath]

Re-points this repo's hyperpolymath/standards reusable-workflow pins at the standards default-branch HEAD, 8f2ee50841e216cd8c192eeb68953118190f105c.

Why this is not a routine version bump. uses: org/repo/.github/workflows/x.yml@<ref> is resolved at workflow startup, so a bad ref is not a failing job — it is no job at all. This campaign repairs three kinds of drift and does not assume which one this repo had:

• an unreachable sha kills the run before any job is created, so GitHub reports no check at all rather than a failing one: the gate does not go red, it disappears, and gh pr checks simply lists fewer rows. A repo in this state looks greener than one with working gates;
• a floating ref such as @main runs, but unpinned — the supply-chain property the estate pins for is absent;
• a stale but reachable sha runs the reusable as it was, silently reintroducing every bug fixed since it.

The refs this repo was actually pinned to, before this PR: fad242d35291de1898242d6737ba02b74a59a2f2.

Expect this PR to surface failures that main does not show. Those failures are revealed, not introduced — they are the gates resuming work after being silently absent. The honest comparison is the set of check names emitted here versus on main, not pass/fail counts. On the canary (hyperpolymath/empty-linter#79) the governance suite was absent on main and emitted 25 checks once repaired.

The target is default-branch HEAD resolved at sweep time, never a sha copied from a plan: a reachable but non-HEAD sha silently reintroduces every bug fixed since it.

Engine: .git-private-farm/scripts/smtp-notify-sweep.sh --campaign campaigns/pin-repair.sh. Verification for this repo: files=6 pins=6 perms=0 permlines=0 from=fad242d35291de1898242d6737ba02b74a59a2f2 target=8f2ee508 sig=G f34cf3f canon=a7325fbdc356 base=main

🤖 Generated with Claude Code

https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b2725dca-2be0-4780-94f9-ab0786fcfcb7

📥 Commits

Reviewing files that changed from the base of the PR and between 0e88b93 and f34cf3f.

📒 Files selected for processing (6)

• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (22)

• GitHub Check: rust-ci / Cargo check + clippy + fmt
• GitHub Check: rust-ci / llvm-cov line coverage
• GitHub Check: rust-ci / Cargo audit (security)
• GitHub Check: scan / shell-secrets
• GitHub Check: scan / rust-secrets
• GitHub Check: governance / Exemption ratchet
• GitHub Check: governance / Debt ratchet
• GitHub Check: scan / gitleaks
• GitHub Check: governance / Licence consistency
• GitHub Check: governance / Actions lockfile verify
• GitHub Check: governance / Trusted-base reduction policy
• GitHub Check: governance / Check Workflow Staleness
• GitHub Check: governance / Well-Known (RFC 9116 + RSR)
• GitHub Check: governance / Workflow security linter
• GitHub Check: governance / Allowlist Preflight
• GitHub Check: governance / Language / package anti-pattern policy
• GitHub Check: governance / Code quality + docs
• GitHub Check: scan / Hypatia Neurosymbolic Analysis
• GitHub Check: analyze (actions, none)
• GitHub Check: Check
• GitHub Check: Clippy
• GitHub Check: Test

⚠️ CI failures not shown inline (6)

GitHub Actions: Dogfood Gate / 1_Groove manifest check.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / Groove manifest check: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run # Check for static or dynamic Groove endpoints
 �[36;1m# Check for static or dynamic Groove endpoints�[0m
 �[36;1mHAS_MANIFEST="false"�[0m
 �[36;1mHAS_GROOVE_CODE="false"�[0m
 �[36;1m�[0m
 �[36;1mif [ -f ".well-known/groove/manifest.json" ]; then�[0m
 �[36;1m  HAS_MANIFEST="true"�[0m
 �[36;1m  # Validate the manifest JSON�[0m
 �[36;1m  if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then�[0m
 �[36;1m    echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest"�[0m

---

GitHub Actions: Dogfood Gate / 2_Empty-linter (invisible characters).txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
 �[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
 �[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
 �[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
 �[36;1mset +e�[0m
 �[36;1mPATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}'�[0m
 �[36;1mfind "$GITHUB_WORKSPACE" \�[0m
 �[36;1m  -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
 �[36;1m  -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
 �[36;1m  -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
 �[36;1m  -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
 �[36;1m  -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
 �[36;1m    -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
 �[36;1m    -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
 �[36;1m    -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
 �[36;1m    -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
 �[36;1m  -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
 �[36;1mEL_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
 �[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
 �[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
 �[36;1m# estate files carry it as legitimate typography in prose.�[0m
 �[36;1mblocking=0�[0m
 �[36;1mwhile IFS= read -r bf; do�[0m
 �...

---

GitHub Actions: Dogfood Gate / Empty-linter (invisible characters): fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]Run # Inline invisible character detection (from empty-linter's core patterns).
 �[36;1m# Inline invisible character detection (from empty-linter's core patterns).�[0m
 �[36;1m# Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens,�[0m
 �[36;1m# non-breaking spaces, null bytes, and other invisible Unicode in source files.�[0m
 �[36;1mset +e�[0m
 �[36;1mPATTERNS='\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]|\x{a0}|\x{ad}|\x{200b}|\x{200c}|\x{200d}|\x{200e}|\x{200f}|\x{202a}|\x{202b}|\x{202c}|\x{202d}|\x{202e}|\x{2060}|\x{feff}'�[0m
 �[36;1mfind "$GITHUB_WORKSPACE" \�[0m
 �[36;1m  -not -path '*/.git/*' -not -path '*/node_modules/*' \�[0m
 �[36;1m  -not -path '*/.deno/*' -not -path '*/target/*' \�[0m
 �[36;1m  -not -path '*/_build/*' -not -path '*/deps/*' \�[0m
 �[36;1m  -not -path '*/external_corpora/*' -not -path '*/.lake/*' \�[0m
 �[36;1m  -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \�[0m
 �[36;1m    -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \�[0m
 �[36;1m    -o -name '*.yml' -o -name '*.yaml' -o -name '*.md' -o -name '*.adoc' \�[0m
 �[36;1m    -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \�[0m
 �[36;1m    -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \�[0m
 �[36;1m  -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null�[0m
 �[36;1mEL_EXIT=$?�[0m
 �[36;1mset -e�[0m
 �[36;1m�[0m
 �[36;1mFINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0)�[0m
 �[36;1mecho "findings=$FINDINGS" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"�[0m
 �[36;1mecho "ready=true" >> "$GITHUB_OUTPUT"�[0m
 �[36;1m�[0m
 �[36;1m# Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).�[0m
 �[36;1m# Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100�[0m
 �[36;1m# estate files carry it as legitimate typography in prose.�[0m
 �[36;1mblocking=0�[0m
 �[36;1mwhile IFS= read -r bf; do�[0m
 �...

---

GitHub Actions: Dogfood Gate / 4_Validate A2ML manifests.txt: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 23 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./audits/assail-classifications.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[error]Missing required identity field (agent-id, name, or project)

---

GitHub Actions: Dogfood Gate / Validate A2ML manifests: fix(ci): pin standards reusables to default-branch HEAD

Conclusion: failure

View job details

##[group]A2ML Manifest Validation
 Scanning . for .a2ml files...
 Found 23 .a2ml file(s)
   Validating: ./.machine_readable/6a2/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/AGENTIC.a2ml
   Validating: ./.machine_readable/6a2/ECOSYSTEM.a2ml
   Validating: ./.machine_readable/6a2/META.a2ml
   Validating: ./.machine_readable/6a2/NEUROSYM.a2ml
   Validating: ./.machine_readable/6a2/PLAYBOOK.a2ml
   Validating: ./.machine_readable/6a2/STATE.a2ml
   Validating: ./.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/6a2/anchor/ANCHOR.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./.machine_readable/CLADE.a2ml
   Validating: ./.machine_readable/bot_directives/coverage.a2ml
   Validating: ./.machine_readable/bot_directives/debt.a2ml
   Validating: ./.machine_readable/bot_directives/methodology.a2ml
   Validating: ./.machine_readable/contractiles/Adjustfile.a2ml
   Validating: ./.machine_readable/contractiles/Intentfile.a2ml
   Validating: ./.machine_readable/contractiles/Mustfile.a2ml
   Validating: ./.machine_readable/contractiles/Trustfile.a2ml
   Validating: ./.machine_readable/integrations/feedback-o-tron.a2ml
   Validating: ./.machine_readable/integrations/proven.a2ml
   Validating: ./.machine_readable/integrations/verisimdb.a2ml
   Validating: ./.machine_readable/integrations/vexometer.a2ml
   Validating: ./0-AI-MANIFEST.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
   Validating: ./audits/assail-classifications.a2ml
 ##[warning]Missing SPDX-License-Identifier in first 10 lines
 ##[error]Missing required identity field (agent-id, name, or project)

🔇 Additional comments (6)

.github/workflows/governance.yml (1)

17-17: LGTM!

.github/workflows/hypatia-scan.yml (1)

20-20: LGTM!

.github/workflows/mirror.yml (1)

12-12: LGTM!

.github/workflows/rust-ci.yml (1)

14-14: LGTM!

.github/workflows/scorecard.yml (1)

15-15: LGTM!

.github/workflows/secret-scanner.yml (1)

16-16: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores

  • Updated the project’s automated governance, mirroring, Rust validation, security scanning, and scorecard checks.
  • These maintenance updates ensure the workflows continue using their current validated configurations.

• Tests

  • Refreshed continuous integration and security verification workflow references without changing the checks performed or the project’s user-facing functionality.

Walkthrough

Six GitHub Actions workflows now reference their reusable workflows at commit 8f2ee50841e216cd8c192eeb68953118190f105c instead of the previous pinned commit.

Changes

Reusable workflow pin updates

Layer / File(s)	Summary
Update reusable workflow pins .github/workflows/governance.yml, .github/workflows/hypatia-scan.yml, .github/workflows/mirror.yml, .github/workflows/rust-ci.yml, .github/workflows/scorecard.yml, .github/workflows/secret-scanner.yml	The workflow references use the new pinned commit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f34cf

Six GitHub Actions reusable workflows are updated to a new immutable standards commit without changing workflow paths, permissions, inputs, or secret settings. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the six reusable-workflow pin updates, the previous and target commits, and the reason for the change.
Title check	✅ Passed	The title clearly and concisely summarises the main change: pinning CI reusable workflows to the standards default-branch HEAD.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🛠️ Fix failing CI checks

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each workflow line
Six pins now point to one design
Governance hops, scanners run
Rust and mirrors join the fun
Scorecards shine beneath the sun}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Coding Agent task started: View task and status

The task will inspect the CI failures, validate its fix, and open a stacked fix pull request automatically.

Note: Fixing CI failures is a beta feature and may encounter errors. Expect some limitations and changes as we gather feedback and continue to improve it.

⏭️ 4 check(s) skipped — already failing on `main` (not caused by this PR)

• GitHub Actions: Rust CI / 1_rust-ci _ Cargo check + clippy + fmt.txt
• GitHub Actions: Rust CI / 2_rust-ci _ llvm-cov line coverage.txt
• GitHub Actions: Dogfood Gate / 2_Empty-linter (invisible characters).txt
• GitHub Actions: Rust CI / 3_rust-ci _ Cargo audit (security).txt