Repository navigation
fix(ci): reconcile actions.lock so the lockfile validates - #99
Merged
Merged
Conversation
…s here fail at creation with 'The lockfile could not be validated. Regenerate it by running gh actions-lock' (or 'Workflow must use a lockfile'). This runs the official extension, completes the workflows: map so every onboarded file has an entry (the shape healthy repos carry), and adds the SHA-form transitive pins reached through called reusables. Every workflow re-parses before commit; gh actions-lock --verify is rc=0.
5 tasks done
hyperpolymath
added a commit
that referenced
this pull request
Oct 5, 2026
…plate shape (#102) ## Summary First-run start point for proof-burrower: restore its identity, consume echidna's shared prove-result contract, and move part of the way toward the rsr-template-repo shape. ### Integration: `echidna.prove.result/1` - `burrower attempt` runs `echidna prove ... --output json` when the installed echidna lists `--output` in `prove --help`. It parses the single stdout object and requires it to be byte-identical to its RFC 8785 canonical form, which also rejects duplicate keys and integers beyond ±(2^53−1). Canonicalisation uses the published `serde_json_canonicalizer` crate: the estate crate `hyperpolymath/ijson-jcs` is private, so the earlier git dependency could not be fetched by CI on this public repo (that was the cause of the red Rust checks). - A `verified` result produces `Succeeded { receipt: Some(ProofReceipt) }`, and the receipt (prover, axioms, confidence, echidna version) is written to the ledger's `extra.receipt`. - Burrower falls back to the legacy text markers in two cases only: - the flag is missing from `prove --help`; - clap rejects `--output` (exit 2, `unexpected argument '--output'`). A legacy success carries no receipt, and the ledger labels it "a warrant, not a receipt". - Malformed or non-canonical output counts as a contract violation and fails the attempt. Burrower never re-reads it as text. - Tests use fake echidna binaries to cover every status, a planted non-canonical mutant, a binary that prints legacy text after advertising the flag, a legacy binary, and a binary that advertises the flag and then rejects it. - The full contract and the mapping table are in `docs/ECHIDNA-INTEGRATION.adoc`. - **Horizon:** the live e2e test (`Burrower proof safety`) uses the echidna build pinned in `proof-safety.yml`. That build predates the flag, so CI exercises the **legacy** path live and the contract path only through the fakes. The contract path is implemented and unit-tested; it has not been tested against a real echidna. - echidna corpus overlap: the recommendation is in `docs/ECHIDNA-INTEGRATION.adoc#corpus-overlap`. Burrower keeps its own indexer as the zero-dependency fallback and later gains an optional `echidna corpus near` backend, once echidna defines a JSON contract for it. That backend is not implemented here. ### Identity and template shape - `affinescript/` (616 files) is removed. A search of Cargo members, the Justfile, workflows, `crates/`, `src/`, `scripts/` and `tools/` found no reference to it. It also held the last `.machine_readable/6a2/` in the tree. - README (previously "= PseudoScript") and ARCHITECTURE (the untouched template) are rewritten. Root status and governance docs move under `docs/` and `docs/status/`, and the files that referenced them are updated. - Adds `proof-burrower_chora.deed`. It passes `deed_lint` and the deed-ecosystem validator. - `mise.toml` no longer lists banned tools and now has a lockfile. `dependabot.yml` and `settings.yml` are KYAML; `settings.yml` sets squash-only merges and turns the wiki on. - Fixes the Well-Known workflow, which failed on every scheduled run on main because it never looked in `www/.well-known/`. - Adds the wiki source in `docs/wikis/` and `scripts/sync-wiki.sh`. ### ID minting `crates/burrower-core/src/ids.rs` is the only minting module (owner policy 2026-10-05): - `new_record_id()`: UUIDv7 from the `uuid` crate API. Used for ledger record `id` through `ledger::new_id`, a thin alias. Callers: `attempt::run_playbook`, `oracle::record_to_ledger`, `ledger::record_reading`. - `content_id(value)`: UUIDv8 per RFC 9562 Appendix B.2. It takes SHA-256 over the JCS bytes, keeps the first 16 bytes and sets version 8 and variant `10`. `goal_content_id(text)` fills the new optional ledger `goal_id`, and `ProofReceipt::from_result` fills the new optional `result_id`. - `goal_hash` is unchanged, because the wasm ABI (16-byte buffer) and existing ledgers depend on it. Corpus entries carry no id yet. - Tests cover three things: the same JCS content gives the same v8 id; the version and variant bits are correct, with the rest equal to the hash prefix; and v7 ids sort in minting order over 1000 mints. - v7 is gated off `wasm32-unknown-unknown`, which has no clock or entropy. - Documented in `docs/ECHIDNA-INTEGRATION.adoc` § Identifiers. ### Stale local branches (folded or left) - `chore/dependabot-pr-caps-2026-09-08`: the github-actions cap is folded in. The other caps applied to ecosystems that no longer exist. - `codex/live-proof-stack-20260907`, `codex/postmerge-mirror-20260907`: already landed as #83 and #85. - `fix/token-permissions-id-20260911`, `chore/bump-standards-pins`, local `main` (+2): older pinning and ruleset attempts that main has superseded (#99 actions.lock). Left untouched. ### Not done in this PR (reduced increment, §5b) - Root-shape conformance is partial. These remain at the root: `0-AI-MANIFEST.a2ml` (still read by rhodibot), `Containerfile`/`container/`, `.gitlab-ci.yml`/`.pre-commit-config.yaml` (moving them needs a GitLab project setting), `contractile.just`, `coordination.k9`, `setup.sh`, `stapeln.toml`, `selur-compose.toml`, `.guix-channel`, `agents/`, `audits/`, `tools/`, `.bot_directives/`. Still missing: a generated `CLAUDE.md`, `launcher.sh`, `build/`, `ci/`. No root-shape gate runs on this repo yet. - The STATE/META/ECOSYSTEM descriptiles stay alongside the deed because `openssf-compliance.yml`, the contractiles and `validate-template.sh` still read them. - No Creusot, SNIF or Zig-adapter work: there are no NIFs or Zig I/O here, and Creusot has no estate convention yet. ## Test plan - [x] `cargo fmt --all -- --check`, `cargo clippy --all-targets --locked -- -D warnings`, `cargo test --locked --workspace` (all green locally; 25 repeated runs of the lib suite with no flakes) - [x] `gh actions-lock --no-fix` clean - [x] `kyaml-format.sh --check` on the edited YAML - [x] `docstring-scan.sh --staged --check` (100%) - [x] `deed_lint.py` OK; deed-ecosystem `validate-a2ml.sh`: 0 errors (8 pre-existing SPDX warnings) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Workflows fail at creation with
The lockfile could not be validated. Regenerate it by running gh actions-lock/Workflow must use a lockfile. This regenerates the manifest with the official extension (github/gh-actions-lock), completes theworkflows:map so every workflow file has an entry, and pins the SHA-form transitive deps reached via called reusables. Proof before push: every workflow re-parses,gh actions-lock --verifyrc=0, and everyuses:ref resolves to a pin.