Repository navigation
k9: deploy template render, Hunt capability grant, push-time K9 lane, K9-aware layout docs - #167
Conversation
Bring every tracked `*.k9.ncl` / `*.k9` file into line with the K9
contract v1.0.0 that standards' K9-DEED conformance lane enforces:
- 98 panel-clade configs: `K9!` magic line, SPDX header, and a
`pedigree` envelope (schema_version, component_type, security.leash
'Kennel, metadata.name/version/author, side_effects). The old top-level
name/version/magic_number/author/leash keys are folded into it.
Budgets.idr is unchanged (gen-budgets --check is current).
- 4 layout presets: `K9!` envelope with an inline 'Yard pedigree; the
preset is checked against pedigree-layout.ncl's contracts.
pedigree-layout.ncl exports its contracts by explicit binding (a bare
`{ Foo, }` field declares Foo without defining it) and PaneSizesSum100
uses std.contract.from_validator. database-design's `verisim_panel`
is renamed to the schema's `verisimdb_panel`.
- svc/k9 templates and the container deploy template are renamed to
`.k9.ncl.in` (templates are not instances, per the contract); the
setup-repo example is replaced by standards' canonical one, and the
references in the READMEs, manifests and TOPOLOGY are updated.
- generated/k9iser/*.k9 are untracked: .gitignore already ignores them.
Checked with standards' k9-validate.sh --strict --layer L2 at
1fdc61c: 106 pass, 1 routed (coordination.k9), 0 fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
hyperpolymath/standards moved to metadatastician/standards. Every caller pinned under the old owner failed at startup with "workflow was not found", because actions.lock recorded the old owner. - Repin governance, hypatia-scan, scorecard, secret-scanner and mirror to metadatastician/standards@1fdc61c (standards main), and rust-ci to metadatastician/standards@412a703 (same commit, new owner). - Add fork-governance.yml per standards' fork-governance ADOPTION.adoc: the DEED, K9-DEED and Hypatia lanes plus one PR comment, all at the same standards commit as canon-ref. DEED runs with require-files: false, since PanLL has no .deed files yet (standards #837). - hypatia-scan.yml loses its pull_request trigger (ADOPTION §3); fork-governance runs the Hypatia lane on PRs. - dogfood-gate.yml drops the k9-ecosystem validate-action job, which rejected the `K9!` envelope that contract v1.0.0 requires; the K9-DEED lane replaces it. - actions.lock: standards records re-keyed to metadatastician (owner_id 297579217), nested uses recomputed over every called file at 1fdc61c, and records nothing references any more are pruned. Verified with standards' check-actions-lock-gate.sh, validate-actions-lock.sh and update-actions-lock.sh --verify-local at 1fdc61c. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
These are k9iser output, already ignored by .gitignore. The previous commit meant to untrack them but the removal was dropped while the change was split into commits, so the K9-DEED lane still scanned them and failed (no SPDX header, not Nickel). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Top-level permissions drop to contents: read; the job gets actions: read, contents: read and security-events: write, which is what hypatia-scan-reusable declares. pull-requests: write goes: the workflow no longer runs on pull_request. Addresses the Scorecard Token-Permissions alert on this file that fork-governance's Hypatia lane grades. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
The previous commit dropped it, so the workflow did not parse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
…verage Addresses three review findings on this PR: - panel-clades/container/deploy.k9.ncl.in is now the v1.0.0-shaped template ported from rsr-template-repo (K9! envelope, pedigree with capability grant, side effects and a signature block), adapted to this layout (container/, compose.toml). `just container-init` renders it to container/deploy.k9.ncl once no placeholder is left, as rsr-template-repo does; before, nothing produced the deploy.k9.ncl the docs use. Checked: rendered with sample values via `just container-init`, it passes k9-validate --strict --layer L2. - template-hunt.k9.ncl.in grants net.fetch, fs.write and process.spawn, which its allow_* flags request (K9-S007), and carries the Ed25519 presence block a Hunt component needs (K9-S009). A copy with its TODOs filled now passes L2. - dogfood-gate.yml runs the standards K9-DEED lane on pushes to main/master, so a direct push is still checked; pull requests keep running it once, in fork-governance.yml. actions.lock records the call. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
The presets now open with the K9! envelope, which the nickel CLI cannot read. Document k9-validate.sh for conformance and evaluating the Nickel body (tail -n +2, run from layouts/ so the relative import resolves) for the pedigree-layout contracts. Checked: logic-and-proofs exports, and a preset whose pane sizes do not sum to 100 is still rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
#166 was squash-merged at 85e71b2; this branch carries the two review-fix commits that landed after it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3 # Conflicts: # .github/workflows/actions.lock # .github/workflows/dogfood-gate.yml # panel-clades/container/README.adoc # panel-clades/container/deploy.k9.ncl.in
|
Caution Review failedThe pull request is closed. 📝 Summary
Merge Risk:
 |
|
|
SonarCloud Code Analysis fails: "C Security Rating on New Code (required ≥ A)". I can't see which issue causes it. A C security rating means SonarCloud found at least one vulnerability in the changed lines. Neither the check run nor the bot comment names it. sonarcloud.io is unreachable from the session that opened this PR, so I can't read the issue list. What I've ruled out from the diff:
Needed: the rule and file:line from the issue list. I'll fix it then. I haven't re-run the check, because the analysis is deterministic. Generated by Claude Code |
|
The preflight checks every The fix is one line in Generated by Claude Code |
Fork governance
Scope: the three lanes below are static checks at the named commit. A K9-DEED conformance🟢 conformant · commit
K9 live corpus (L0–L2): 1 finding(s) / scope notes
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. Hypatia verdict grid🟢 clean · commit Advisory: 2 row(s), worst 🟢 clean (0 critical, 0 high) — reported, never grading the change.
Hypatia scan: 86 finding(s)
panic-attack assail: 62 finding(s)
pons asinorum: 16 finding(s)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7ba9e319a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| DEPLOY_IN="container/deploy.k9.ncl.in" | ||
| DEPLOY_OUT="${DEPLOY_IN%.in}" | ||
| if [ -f "$DEPLOY_IN" ]; then |
There was a problem hiding this comment.
When a user follows the documented just init path in container/README.adoc, that recipe replaces every placeholder through its global substitution loop but never executes this new rendering block, which belongs only to container-init. The result is a fully populated container/deploy.k9.ncl.in but no container/deploy.k9.ncl, so the documented validation and deployment commands fail unless the user unnecessarily runs a second initializer. Invoke the rendering logic from init as well, or factor it into a shared recipe.
Useful? React with 👍 / 👎.
| elif [ -e "$DEPLOY_OUT" ]; then | ||
| echo "Kept $DEPLOY_IN: $DEPLOY_OUT already exists, so it was not overwritten." | ||
| else | ||
| mv "$DEPLOY_IN" "$DEPLOY_OUT" |
There was a problem hiding this comment.
On every successful render, this mv removes container/deploy.k9.ncl.in, but container/0-AI-MANIFEST.a2ml continues to declare that removed file as the canonical deployment location and lists it in FILE_RELATIONSHIPS (lines 33 and 93). Consequently, a freshly initialized repository immediately has incorrect machine-readable topology. Update those references during initialization, retain the template while creating the rendered file, or make the manifest describe deploy.k9.ncl.
Useful? React with 👍 / 👎.
Why
#166 was squash-merged at
85e71b2. Two follow-up commits that fix four of its Codex review findings were pushed after the merge, so they missed it. The review threads were resolved as "fixed in dc04df7 / 882dd75", butmaindoes not have those fixes. This PR lands them.The branch carries a merge of the #166 squash. Its diff against
mainis exactly those two commits: 7 files, +226/−147.What
dc04df7: deploy template, Hunt grant, push coveragepanel-clades/container/deploy.k9.ncl.incontainer/,compose.toml). It has theK9!envelope, a capability grant,side_effects, and a signature block.just container-initnow renders it tocontainer/deploy.k9.nclonce no{{…}}token is left. It never overwrites an existing file.deploy.k9.nclthat the docs use..machine_readable/svc/k9/template-hunt.k9.ncl.innet.fetch,fs.writeandprocess.spawn, which itsallow_*flags request (K9-S007).dogfood-gate.ymlmain/master, so a direct push is checked again.fork-governance.yml.actions.lockrecords the call.882dd75: layout docslayouts/README.adocvalidates presets withk9-validate.sh, and evaluates the Nickel body withtail -n +2 <preset> | nickel export, run fromlayouts/.K9!envelope is not Nickel, so the old directnickel typecheck layouts/*.k9.nclno longer works.Verification (local, standards
1fdc61c)coordination.k9), 0 fail.--strict --layer L2.just container-initwith sample values, passes L2.logic-and-proofsexports. A preset whose pane sizes do not sum to 100 is still rejected.update-actions-lock.sh --verify-localpass.gen-budgets.sh --checkreports current.Known, not in this PR
governance / Allowlist Preflightstays red until standards' allowlist gains"metadatastician/*".fork-governance-publish.ymlcaller.Generated by Claude Code