From 5ccf83c9e8ff4d308e79755ff22168d621b96618 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 21 Sep 2026 22:45:51 +0000 Subject: [PATCH 1/5] fix(ci): changelog caller gets actions:read + pr-back (main was red) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both changelog runs on main (900c141, e6d02db) startup_failed with zero jobs and no log. Root cause, confirmed by standards' own caller comment: our caller declared top-level `permissions:` without `actions: read` while the reusable requests it — GitHub rejects the run at startup ("requesting 'actions: read', but is only allowed 'actions: none'"). The pin itself was exonerated (b77c53c is on standards@main and byte-identical to the current reusable). Same commit switches commit-back to pr-back: main is guarded by the Optimus-Branch ruleset (PR-required, signed commits, zero bypass actors), which would reject the direct push on every run. Merge the changelog PRs it opens (squash keeps required_signatures satisfied). STATE gains the incident record, the main-health entry, and the optimus-branch-ruleset landmine the caller header references. --- .github/workflows/changelog.yml | 24 +++++++++++++------ .machine_readable/6a2/STATE.a2ml | 7 ++++-- .../contractiles/Intentfile.a2ml | 2 +- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml index 58fd258..f041b67 100644 --- a/.github/workflows/changelog.yml +++ b/.github/workflows/changelog.yml @@ -1,11 +1,17 @@ # SPDX-License-Identifier: MPL-2.0 # CHANGELOG automation (issue #100): regenerates CHANGELOG.md from -# conventional commits on every push to main and commits it straight back -# (commit-back). Main has no branch protection (verified 2026-09-21), so no -# PR round-trip is needed; if protection is ever enabled, switch `mode` to -# `pr-back`. Uses the canonical cliff.toml from standards (no local -# cliff.toml by design — one config for the estate). CHANGELOG.adoc is -# retained as a frozen pointer to the generated CHANGELOG.md. +# conventional commits on every push to main and opens a PR with the result +# (pr-back). Two hard lessons baked in: (1) main is guarded by the +# Optimus-Branch ruleset (PR-required, signed commits, zero bypass actors — +# see the optimus-branch-ruleset landmine in STATE.a2ml), which rejects a +# commit-back direct push; (2) the reusable requests `actions: read`, so the +# caller MUST declare top-level `actions: read` — omitting it makes GitHub +# reject the run at startup_failure with zero jobs and no log (both main +# runs did exactly that on 2026-09-21). Merge the changelog PRs it opens +# (squash keeps required_signatures satisfied — GitHub signs the squash +# commit). Uses the canonical cliff.toml from standards (no local cliff.toml +# by design — one config for the estate). CHANGELOG.adoc is retained as a +# frozen pointer. name: changelog on: push: @@ -14,13 +20,17 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: changelog: permissions: contents: write + # REQUIRED for pr-back: the reusable opens the changelog PR via the + # API. (Review T1 on #185 asked to drop this; that was correct for + # commit-back and wrong for pr-back — see the header.) pull-requests: write # Pinned to standards@main as of 2026-09-21 (commits/changelog: #886). uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@b77c53c85e5734756a793497845735485c9dc933 with: - mode: commit-back + mode: pr-back diff --git a/.machine_readable/6a2/STATE.a2ml b/.machine_readable/6a2/STATE.a2ml index 34bca5c..5254c7f 100644 --- a/.machine_readable/6a2/STATE.a2ml +++ b/.machine_readable/6a2/STATE.a2ml @@ -89,8 +89,9 @@ pr-145 = "removed the stray worktree gitlink breaking every recursive checkout issue-124 = "Aletheia CLI rebuilt on the RSR v2 SSOT (standards rsr-criteria-v2.a2ml v2.1.0-draft): 26-check offline subset, TOML config, human/JSON/SARIF/HTML/badge/quiet/verbose output, exit codes 0-4; 66 unit + 45 integration green" issue-125 = "Clippy findings wired away (no allow(dead_code)); `clippy --all-targets -- -D warnings` blocks in rust-ci.yml + `just lint`" issue-102 = "Root Justfile declared canonical; contractiles/Justfile stub (fake gates) replaced by a forwarding shim; repaired crg-grade/crg-badge (Make-style $$ broke every run)" -issue-100 = "changelog.yml adopted (commit-back); CHANGELOG.md seeded; CHANGELOG.adoc frozen as pointer" +issue-100 = "changelog.yml adopted (pr-back; commit-back blocked by Optimus-Branch ruleset); CHANGELOG.md seeded; CHANGELOG.adoc frozen as pointer" issue-98 = ".hypatia-ignore pruned to a comments-only audit record (all 10 entries verified dead); upstream residue in absolute-zero#77" +main-health-red-to-green = "2026-09-21: changelog caller fixed (top-level actions:read — the reusable requests it — plus pr-back for the ruleset-guarded main); actions.lock reconciled to codeql-action v4.38.1 (#187 fallout); U+200B removed from CHANGELOG.md (empty-linter); root CONTRIBUTING.adoc added (docs-gate cutoff passed)" rust-ci-restore = "Root rust-ci.yml restored re-pointed at aletheia/ (5 jobs mirroring `just check`); pin check taught the estate tags+actions.lock mechanism; Bun lockfile carve-out for no-node-runtime" [incidents] @@ -99,6 +100,7 @@ clobber-is-a-policy-violation = "absolute-zero/.claude/CLAUDE.md lists PMPL-1.0 stray-worktree-gitlink = ".claude/worktrees/maa-ci-repair was committed as a gitlink (mode 160000) with NO .gitmodules entry. Git refuses: 'fatal: No url found for submodule path ... in .gitmodules'. This broke OSSF Scorecard AT CHECKOUT, before a single probe ran, and breaks any recursive clone. Fixed in #145; .claude/worktrees/ now gitignored." gitlink-shape-is-a-repeat = "639f389 (2026-02-21) left aletheia as a gitlink with no .gitmodules entry. A gitlink WITHOUT its mapping resolves to a silently-empty directory — git's quietest failure — and went unnoticed for over a month." dead-sha-pin-check = "aletheia's own Silver-level 'GitHub Actions SHA pinning' check used `line.contains(\"@v\") && !line.contains(\"@\")`, which is UNSATISFIABLE — every repo passed unconditionally, including this one while it carried the unpinned @master action that had broken Governance and CodeQL. Fixed with 3 tests in #144." +changelog-startup-failure = "2026-09-21: both changelog runs on main (900c141, e6d02db) startup_failed with zero jobs and no log — the caller declared top-level permissions without actions:read while the reusable requests it (standards own caller documents this exact trap). Fixed same-day with actions:read + pr-back." [open-questions] # These need a human ruling; they are not research tasks. @@ -115,7 +117,7 @@ proof-debt = "See [proof-state]. Note the older figure in docs/proof-debt.md (80 resolve-rsr-source-of-truth = "RESOLVED 2026-09-21: oracle normative, criteria in standards SSOT, aletheia takes the offline subset (see [open-questions].rsr-source-of-truth)" empty-merged-prs = "#146 (ci(codeql) cron weekly->monthly) and #147 (Worktree maa ci repair) are BOTH EMPTY — git diff between parent and merge is blank. #146 stated change was already present. A merged PR title is not evidence the change happened; check git diff --stat." soundness-axioms = "Fix or delete prob_nonneg, prob_normalized, shannon_entropy_maximum while they are still unused" -changelog-automation = "RESOLVED 2026-09-21 (#100): changelog.yml adopted (commit-back), CHANGELOG.md seeded with the exact reusable recipe, CHANGELOG.adoc frozen as a pointer" +changelog-automation = "RESOLVED 2026-09-21 (#100): changelog.yml adopted (pr-back — commit-back rejected by the Optimus-Branch ruleset, zero bypass actors; caller also needed top-level actions:read after both main runs startup_failed), CHANGELOG.md seeded with the exact reusable recipe, CHANGELOG.adoc frozen as a pointer" hypatia-ignore-prune = "RESOLVED 2026-09-21 (#98): all 10 entries verified dead at the pinned submodule commit; .hypatia-ignore is a comments-only audit record, upstream residue in absolute-zero#77" submodule-docs = "RESOLVED 2026-09-21: clone block in QUICKSTART-DEV documents `git submodule update --init`" @@ -128,3 +130,4 @@ generic-summary-is-not-detection = "The staleness job prints 'Remove legacy scor never-commit-dash-a = "Two separate defects reached main in one `git commit -a` (#142). Never use it in this repo." never-allow-dead-code = "Do not silence #125 with #![allow(dead_code)]. The dead code is the specification of the missing feature, and rust-ci.yml's header forbids it." never-restore-aletheia-from-mirror = "The in-tree copy is AHEAD — 134 tracked files vs 108, 45 in-tree only. The mirrors' only unique asset is 62 commits of history to 2026-01-03." +optimus-branch-ruleset = "main is guarded by the Optimus-Branch RULESET (not branch protection — the legacy API 404s): PR-required, signed commits, strict CodeRabbit+governance checks, code-scanning gates, ZERO bypass actors. Direct pushes fail; workflows use pr-back, humans squash-merge." diff --git a/.machine_readable/contractiles/Intentfile.a2ml b/.machine_readable/contractiles/Intentfile.a2ml index fe82004..c7e7374 100644 --- a/.machine_readable/contractiles/Intentfile.a2ml +++ b/.machine_readable/contractiles/Intentfile.a2ml @@ -61,7 +61,7 @@ status = "declared" name = "changelog-automation" description = "Adopt changelog-reusable.yml (standards#206) so CHANGELOG.md stays in sync with conventional commits" status = "done" -notes = "Closed #100 on 2026-09-21: changelog.yml (commit-back), CHANGELOG.md seeded, CHANGELOG.adoc frozen as pointer" +notes = "Closed #100 on 2026-09-21: changelog.yml (pr-back — Optimus-Branch ruleset rejects direct pushes), CHANGELOG.md seeded, CHANGELOG.adoc frozen as pointer" [[intents]] name = "root-justfile-wiring" From 9595b54785c737599bb3e20df1bd15be199272a5 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 21 Sep 2026 22:45:58 +0000 Subject: [PATCH 2/5] fix(ci): reconcile actions.lock to codeql-action v4.38.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #187 bumped codeql.yml (init + analyze) to v4.38.1 without updating the lock, failing governance's "Check locked or SHA-pinned actions" on main. The v4.38.1 commit (1c5b6756) was read from the codeql-action repo tags; owner/repo ids carried over; format mirrors the existing entries exactly. Yes, the file says to run `gh actions-lock` instead of editing by hand — no gh here, so a mirror-format edit plus CI's --verify-local as judge. --- .github/workflows/actions.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock index 86222b1..94e9cb1 100644 --- a/.github/workflows/actions.lock +++ b/.github/workflows/actions.lock @@ -15,7 +15,7 @@ workflows: '.github/workflows/changelog.yml': [] '.github/workflows/codeql.yml': - 'actions/checkout@v7.0.1' - - 'github/codeql-action@v4.38.0' + - 'github/codeql-action@v4.38.1' '.github/workflows/dogfood-gate.yml': - 'actions/checkout@v7.0.1' '.github/workflows/governance.yml': [] @@ -68,9 +68,9 @@ dependencies: repo_id: 496012378 uses: - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f' - 'github/codeql-action@v4.38.0': - ref: 'v4.38.0' - commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63' + 'github/codeql-action@v4.38.1': + ref: 'v4.38.1' + commit: 'sha1-1c5b675653bb5c22dbe9b12b556ec555138e09fd' owner_id: 9919 repo_id: 259445878 'haskell-actions/setup@v2.12.0': From 89a5bcdcaf46be1ea9b657ea2ace5e1de255d129 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 21 Sep 2026 22:46:16 +0000 Subject: [PATCH 3/5] fix(docs): remove 206 zero-width spaces from CHANGELOG.md (empty-linter) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every `@handle` in the seeded file was written `@\u200bhandle` (mention defusing) — but all 206 sit inside `` spans, where GitHub never linkifies mentions anyway, so the defusing was pointless as well as linter-forbidden. Removal is render-neutral and durable: git pickaxe confirms no commit carries the character, so regenerating from commits cannot reintroduce it. --- CHANGELOG.md | 412 +++++++++++++++++++++++++-------------------------- 1 file changed, 206 insertions(+), 206 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f14f8c..cbd638a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -415,68 +415,68 @@ releases.

What's Changed

New Contributors

@@ -603,11 +603,11 @@ releases.

Full Changelog: .

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0