hyperpolymath · Jun 22, 2026 · Jun 22, 2026 · Jun 22, 2026
@@ -5,7 +5,7 @@
 # It is a no-op if BOJ_SERVER_URL is not set or the server is unreachable.
 # To enable: set BOJ_SERVER_URL as a repository secret or variable.
 # To disable: delete this file or leave BOJ_SERVER_URL unset.
-name: BoJ Server Build Trigger
+name: "⚙ Auto: BoJ server build trigger"
 on:
   push:
     branches: [main, master]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: CodeQL Security Analysis
+name: "🟡 Check: CodeQL security analysis"
 on:
   push:
     branches: [main, master]

@@ -34,7 +34,7 @@
 # Dependabot config via the github-actions ecosystem block, so SHA
 # bumps for dependabot/fetch-metadata flow through the same path.
 
-name: Dependabot Auto-Merge
+name: "⚙ Auto: Dependabot auto-merge"
 on:
   pull_request:
     types: [opened, reopened, synchronize]

@@ -4,7 +4,7 @@
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
 # Validates that the repo uses hyperpolymath's own formats and tools.
 # Companion to static-analysis-gate.yml (security) — this is for format compliance.
-name: Dogfood Gate
+name: "🟡 Check: RSR self-use (dogfooding)"
 
 on:
   pull_request:
@@ -261,31 +261,16 @@ jobs:
 
           echo "has_manifest=true" >> "$GITHUB_OUTPUT"
 
-          # Validate TOML structure using Python 3.11+ tomllib
-          python3 -c "
-import tomllib, sys
-with open('eclexiaiser.toml', 'rb') as f:
-    data = tomllib.load(f)
-project = data.get('project', {})
-if not project.get('name', '').strip():
-    print('ERROR: project.name is required', file=sys.stderr)
-    sys.exit(1)
-functions = data.get('functions', [])
-if not functions:
-    print('ERROR: at least one [[functions]] entry is required', file=sys.stderr)
-    sys.exit(1)
-for fn in functions:
-    if not fn.get('name', '').strip():
-        print('ERROR: function name cannot be empty', file=sys.stderr)
-        sys.exit(1)
-    if not fn.get('source', '').strip():
-        print(f'ERROR: function {fn[\"name\"]} has no source path', file=sys.stderr)
-        sys.exit(1)
-print(f'Valid: {project[\"name\"]} ({len(functions)} function(s))')
-" || {
-            echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml — see step output for details"
-            exit 1
-          }
+          # Validate eclexiaiser.toml structure (bash + grep; no Python — estate no-Python rule).
+          ok=1
+          grep -qE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || { echo "::error::project.name is required"; ok=0; }
+          nfun=$(grep -cE '^[[:space:]]*\[\[functions\]\]' eclexiaiser.toml || true)
+          [ "${nfun:-0}" -ge 1 ] || { echo "::error::at least one [[functions]] entry is required"; ok=0; }
+          nname=$(grep -cE '^[[:space:]]*name[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || true)
+          nsrc=$(grep -cE '^[[:space:]]*source[[:space:]]*=[[:space:]]*"[^"]+"' eclexiaiser.toml || true)
+          [ "${nname:-0}" -ge "$(( ${nfun:-0} + 1 ))" ] || { echo "::error::a function has an empty or missing name"; ok=0; }
+          [ "${nsrc:-0}" -ge "${nfun:-0}" ] || { echo "::error::a function has an empty or missing source"; ok=0; }
+          if [ "$ok" = 1 ]; then echo "Valid: eclexiaiser.toml (${nfun:-0} function(s))"; else echo "::error file=eclexiaiser.toml::Invalid eclexiaiser.toml"; exit 1; fi
 
       - name: Write summary
         run: |

@@ -12,7 +12,7 @@
 # INSTRUCTIONS: Uncomment and customise the section matching your stack.
 # Delete sections that don't apply. See examples in each job.
 
-name: E2E + Aspect + Bench
+name: "🟡 Check: E2E + aspect + bench"
 on:
   push:
     branches: [main, master, develop]

@@ -9,7 +9,7 @@
 # Each rule is enforced by an executable check script under scripts/. Failures
 # are surfaced as workflow errors so the rule can't silently regress.
 
-name: Estate Rules
+name: "🟡 Check: Estate rules"
 on:
   push:
     branches: [main]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-name: Governance
+name: "🟡 Check: Governance metadata"
 
 on:
   push:

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Guix/Nix Package Policy
+name: "🔴 Gate: Guix-only package policy"
 on:
   push:
     branches: [main, master]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-name: Hypatia Security Scan
+name: "🟡 Check: Hypatia baseline security scan"
 
 on:
   push:

@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # Instant Forge Sync - Triggers propagation to all forges on push/release
-name: Instant Sync
+name: "⚙ Auto: Instant sync"
 on:
   push:
     branches: [main, master]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Mirror to Git Forges
+name: "⚙ Auto: Mirror to forges"
 on:
   push:
     branches: [main]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: NPM/Bun Blocker
+name: "🔴 Gate: No-npm/bun policy"
 on:
   push:
     branches: [main, master]

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # OpenSSF Best Practices compliance gate — blocks PRs and pushes that lack
 # required files or still contain unfilled placeholder tokens.
-name: OpenSSF Compliance
+name: "🟡 Check: OpenSSF best-practices"
 on:
   push:
     branches: [main]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Code Quality
+name: "🔴 Gate: Code quality (fmt/lint/test)"
 on:
   push:
     branches: [main, master]

@@ -4,7 +4,7 @@
 # Release workflow — triggered by version tags (v*).
 # Builds artifacts, generates changelog via git-cliff, creates a GitHub Release,
 # and produces SLSA provenance attestations.
-name: Release
+name: "⚙ Auto: Release"
 on:
   push:
     tags:

@@ -10,7 +10,7 @@
 #
 # Runs weekly and on Hypatia scan completion.
 
-name: "\U0001F916 Rhodibot — RSR Auto-Fix"
+name: "⚙ Auto: Rhodibot RSR auto-fix"
 on:
   schedule:
     - cron: '0 6 * * 1' # Every Monday at 06:00 UTC

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # RSR Anti-Pattern Check - Uses reusable workflow from standards
 
-name: RSR Anti-Pattern Check
+name: "🔴 Gate: RSR anti-pattern scan"
 on:
   push:
     branches: [main, master, develop]

@@ -2,7 +2,7 @@
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
 # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
-name: Rust CI
+name: "🟡 Check: Rust CI (build/test)"
 on:
   push:
     branches: [main, master]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: PMPL-1.0-or-later
-name: OSSF Scorecard
+name: "⚪ Advisory: OpenSSF Scorecard (score)"
 
 on:
   push:

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Secret Scanner
+name: "🔴 Gate: Secret scan"
 on:
   pull_request:
   push:

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Security Policy
+name: "🔴 Gate: Security policy present"
 on:
   push:
     branches: [main, master]

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # Static Analysis Gate — Required by branch protection rules.
 # Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning.
-name: Static Analysis Gate
+name: "🔴 Gate: Static analysis"
 on:
   pull_request:
     branches: ['**']

@@ -2,7 +2,7 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # Haec: every example lowers to a well-formed Trope IR document (bash + jq, no Python).
-name: trope-check
+name: "🔴 Gate: Trope conformance"
 on:
   push:
     paths: ['design/**', 'examples/**', 'tests/**', '.github/workflows/trope-check.yml']

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: TypeScript/JavaScript Blocker
+name: "🔴 Gate: No-TypeScript policy"
 on:
   push:
     branches: [main, master]

@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: MPL-2.0
-name: Well-Known Standards (RFC 9116 + RSR)
+name: "🔴 Gate: .well-known / RFC 9116"
 on:
   push:
     branches: [main, master]

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: MPL-2.0
 # workflow-linter.yml - Validates GitHub workflows against RSR security standards
 # This workflow can be copied to other repos for consistent enforcement
-name: Workflow Security Linter
+name: "🟡 Check: Workflow security lint"
 
 on:
   push:

@@ -0,0 +1,52 @@
+# SPDX-FileCopyrightText: © 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+# SPDX-License-Identifier: MPL-2.0
+#
+# CI criticality tiers — the source of truth for what blocks a merge (pilot).
+# Workflow name: fields carry the same glyph so the GitHub checks list is self-sorting.
+#   🔴 Gate (must)     — pass-or-die; merge-blocking; SET THESE AS BRANCH-PROTECTION REQUIRED CHECKS.
+#   🟡 Check (should)  — important; reviewed; waivable on purpose.
+#   ⚪ Advisory (could)— a score / deep / experimental pass; skippable in a rush.
+#   ⚙ Auto            — not a gate; a side-effecting job.
+
+[meta]
+scheme = "Gate / Check / Advisory / Auto  (must / should / could / automation)"
+pilot = true
+note = "Pilot in the three trope repos; promote to standards + rsr-template once proven."
+
+# 🔴 Gate — must pass (branch-protection required checks)
+[gate]
+"guix-nix-policy" = "Guix-only package policy — Nix banned; Guix only"
+"npm-bun-blocker" = "No-npm/bun policy — banned toolchain = do not ship"
+"quality" = "Code quality (fmt/lint/test) — formatting/lint/tests must pass"
+"rsr-antipattern" = "RSR anti-pattern scan — structural anti-patterns block merge"
+"secret-scanner" = "Secret scan — leaked secret = do not ship"
+"security-policy" = "Security policy present — SECURITY.md must exist"
+"static-analysis-gate" = "Static analysis — static-analysis gate must pass"
+"trope-check" = "Trope conformance — IR schema + verified core + conformance"
+"ts-blocker" = "No-TypeScript policy — banned language = do not ship"
+"wellknown-enforcement" = ".well-known / RFC 9116 — security.txt + RSR well-known"
+
+# 🟡 Check — should pass
+[check]
+"codeql" = "CodeQL security analysis — findings reviewed, not auto-blocking"
+"dogfood-gate" = "RSR self-use (dogfooding) — repo uses its own RSR tooling"
+"e2e" = "E2E + aspect + bench — integration; may be skipped in a rush"
+"estate-rules" = "Estate rules — estate conventions"
+"governance" = "Governance metadata — governance docs present"
+"hypatia-scan" = "Hypatia baseline security scan — baseline scan (deep neurosymbolic = advisory, in standards)"
+"openssf-compliance" = "OpenSSF best-practices — should pass; waivable on review"
+"rust-ci" = "Rust CI (build/test) — Rust build + test"
+"workflow-linter" = "Workflow security lint — workflow hygiene"
+
+# ⚪ Advisory — could skip in a rush
+[advisory]
+"scorecard" = "OpenSSF Scorecard (score) — a score, not a gate"
+
+# ⚙ Auto — not a gate
+[automation]
+"boj-build" = "BoJ server build trigger — side-effect: triggers a build"
+"dependabot-automerge" = "Dependabot auto-merge — side-effect: merges dep PRs"
+"instant-sync" = "Instant sync — side-effect: sync"
+"mirror" = "Mirror to forges — side-effect: pushes mirrors"
+"release" = "Release — side-effect: cuts releases"
+"rhodibot" = "Rhodibot RSR auto-fix — side-effect: auto-fix bot"