From fdc26e233cfbcaee23cb874dd53840523bfc686f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 9 Sep 2026 02:20:15 +0100 Subject: [PATCH 1/3] fix(ci): pin standards reusables to main HEAD 8f2ee508 This repo's standards reusable pins are re-pointed at the standards default-branch HEAD, resolved live at sweep time. The prior refs are recorded in the verification line below. Three kinds of drift are repaired together and the body does not claim which one this repo had: an UNREACHABLE sha kills the run at workflow STARTUP, so GitHub reports no check at all rather than a failing one and the gate disappears instead of going red; a FLOATING ref (@main) is unpinned supply chain; a merely STALE but reachable sha silently reintroduces every bug fixed since it. files=4 pins=4 perms=0 permlines=0 from=092dedada188f56c5915f74a5fd40aac093742c3,bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 target=8f2ee508 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_0178nN4Nm3neFRy5K9StZKnB --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/secret-scanner.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 31bca97..80ad396 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -14,4 +14,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index ba71b60..f3ee0db 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -17,4 +17,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 27b7b96..0d547a5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -12,7 +12,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@092dedada188f56c5915f74a5fd40aac093742c3 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c permissions: contents: read security-events: write diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index a17019b..834ee1f 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -19,5 +19,5 @@ permissions: contents: read jobs: scan: - uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 + uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@8f2ee50841e216cd8c192eeb68953118190f105c secrets: inherit From 963efd3f94e62e164881097fc45b4c6de06f5a7c Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 17:21:18 +0000 Subject: [PATCH 2/3] fix(k9): make policy files valid Nickel components --- .../self-validating/methodology-guard.k9.ncl | 7 ++ container/deploy.k9.ncl | 8 +- coordination.k9 | 81 ++++++++++--------- session/custom-checks.k9 | 56 ++++++++++--- 4 files changed, 99 insertions(+), 53 deletions(-) diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index 1cf4fcb..aba0be0 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # @@ -8,6 +9,12 @@ # Usage: k9 validate methodology-guard let methodology_guard = { + pedigree = { + schema_version = "1.0.0", + name = "methodology-guard", + leash = 'Yard, + }, + name = "methodology-guard", version = "1.0.0", description = "Validates that agent work respects declared methodology constraints", diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl index 0ad0d04..f5a77cb 100644 --- a/container/deploy.k9.ncl +++ b/container/deploy.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) # @@ -143,7 +144,12 @@ echo "K9: Rollback complete." # Export the component { - pedigree = component_pedigree, + pedigree = component_pedigree & { + name = "{{SERVICE_NAME}}-deploy", + version = "{{VERSION}}", + leash = 'Hunt, + signature_required = true, + }, deployment = deployment, scripts = scripts, diff --git a/coordination.k9 b/coordination.k9 index ba31125..213da6c 100644 --- a/coordination.k9 +++ b/coordination.k9 @@ -1,43 +1,44 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 # Thin coordination bindings for central session-management standards -session_management: - source_of_truth: "standards/session-management-standards" - canonical_commands: - - "intake repo " - - "checkpoint change " - - "verify maintenance " - - "verify substantial " - - "verify release " - - "close planned " - - "close urgent " - - "recover repo " - - "handover full " - - "handover split " - - "handover model " - - "handover human " +{ + pedigree = { + schema_version = "1.0.0", + name = "session-coordination", + leash = 'Kennel, + }, -signals: - - name: "session.intake" - command: "intake repo " - - name: "session.checkpoint" - command: "checkpoint change " - - name: "session.verify.maintenance" - command: "verify maintenance " - - name: "session.verify.substantial" - command: "verify substantial " - - name: "session.verify.release" - command: "verify release " - - name: "session.close.planned" - command: "close planned " - - name: "session.close.urgent" - command: "close urgent " - - name: "session.recover" - command: "recover repo " - - name: "session.handover.full" - command: "handover full " - - name: "session.handover.split" - command: "handover split " - - name: "session.handover.model" - command: "handover model " - - name: "session.handover.human" - command: "handover human " + session_management = { + source_of_truth = "standards/session-management-standards", + canonical_commands = [ + "intake repo ", + "checkpoint change ", + "verify maintenance ", + "verify substantial ", + "verify release ", + "close planned ", + "close urgent ", + "recover repo ", + "handover full ", + "handover split ", + "handover model ", + "handover human ", + ], + }, + + signals = [ + { name = "session.intake", command = "intake repo " }, + { name = "session.checkpoint", command = "checkpoint change " }, + { name = "session.verify.maintenance", command = "verify maintenance " }, + { name = "session.verify.substantial", command = "verify substantial " }, + { name = "session.verify.release", command = "verify release " }, + { name = "session.close.planned", command = "close planned " }, + { name = "session.close.urgent", command = "close urgent " }, + { name = "session.recover", command = "recover repo " }, + { name = "session.handover.full", command = "handover full " }, + { name = "session.handover.split", command = "handover split " }, + { name = "session.handover.model", command = "handover model " }, + { name = "session.handover.human", command = "handover human " }, + ], +} diff --git a/session/custom-checks.k9 b/session/custom-checks.k9 index bd932fa..e616477 100644 --- a/session/custom-checks.k9 +++ b/session/custom-checks.k9 @@ -1,15 +1,47 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 # Local repository session checks (thin policy layer) -version: "0.1" -checks: - - id: "session-state-has-next-action" - applies_to: ["close planned", "close urgent", "handover full", "handover split", "handover model", "handover human"] - requirement: "LAST-CANONICAL-COMMAND.md contains next intended action" +{ + pedigree = { + schema_version = "1.0.0", + name = "session-custom-checks", + leash = 'Kennel, + }, - - id: "session-state-has-residual-risks" - applies_to: ["verify maintenance", "verify substantial", "verify release", "recover repo"] - requirement: "Residual risks field is not left blank" - - - id: "session-state-has-recommended-next-protocol" - applies_to: ["intake repo", "checkpoint change", "recover repo", "handover full"] - requirement: "Recommended next protocol is set" + version = "0.1", + checks = [ + { + id = "session-state-has-next-action", + applies_to = [ + "close planned", + "close urgent", + "handover full", + "handover split", + "handover model", + "handover human", + ], + requirement = "LAST-CANONICAL-COMMAND.md contains next intended action", + }, + { + id = "session-state-has-residual-risks", + applies_to = [ + "verify maintenance", + "verify substantial", + "verify release", + "recover repo", + ], + requirement = "Residual risks field is not left blank", + }, + { + id = "session-state-has-recommended-next-protocol", + applies_to = [ + "intake repo", + "checkpoint change", + "recover repo", + "handover full", + ], + requirement = "Recommended next protocol is set", + }, + ], +} From fe5f85a6439bda7b0a7ea649253d4fdc5baeccc5 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:36:00 +0100 Subject: [PATCH 3/3] Convert K9 policies to valid Nickel syntax (#76) Rewrites the coordination and session-check policies as K9 Nickel records, adds required K9 headers and pedigree metadata, and completes deployment and methodology-guard pedigree fields so CI validation can parse all four policies. Validation: `git diff --check` passes. [View coding task](https://app.coderabbit.ai/code/tasks/68cfdae4-2681-40d1-a6d8-9eeb7b891137?source=coding_agent_github_pr_description) Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>