[hyperpolymath]

Summary

The template still taught and enforced the 2026-08-26 "Deno is retired" rule. Your 2026-10-14 ruling replaced it, in standards LANGUAGE-POLICY.adoc §1.3–§1.4, on main since hyperpolymath/standards#1249:

• the order is Bun > Deno > pnpm > npm;
• there is one package.json;
• its bun.lock, deno.lock and pnpm-lock.yaml are all written by js-runtimes regen.

This PR is the template half of hyperpolymath/standards#1255, which promised it ("rsr-template-repo is next").

One gate contradicted the ruling outright. runtime-policy.yml failed every repository with more than one lockfile, so it failed every repository that follows the ruling:

::error::Mixed toolchains: 3 package managers have lockfiles in this repository.

Every repository minted from this template carries that gate (resource-algebra does, for example), so the fix starts here.

Changes

• .github/workflows/runtime-policy.yml:
  • bun.lock, deno.lock and pnpm-lock.yaml count as one dependency graph, locked three ways. Governance's JS runtimes — … jobs check each lock against package.json.
  • An npm package-lock.json next to them is still "mixed toolchains" and fails.
  • A deno.json / deno.jsonc is a notice (your "Notice only" answer), not a warning.
  • File detection is unchanged; the header comment is rewritten to match.
• Provisioning engine re-synced to standards ed04132e (engine 0.6.0, #1255): build/just/provision-lib.sh, provision-modes.sh and provision-check.sh.
  • provision.just was already identical.
  • Every line that only the template's copy had is an older revision of canon code, so the copy loses nothing local.
  • What changes: a package.json now provisions bun, deno and pnpm, and deno and pnpm leave the banned tools. The rest is canon's docstrings and the .mise.toml / .tool-versions / backend checks.
• The same policy in prose.
  • The arrival pack's language block (arrival-pack.ncl), with CLAUDE.md regenerated by just claude-md. Nothing in that file was hand-edited.
  • The mise.toml comment.
  • docs/SETUP.adoc rows PV-W23, PV-W30 and PV-W34, and the dev warm-up's "Languages" line, copied from the canon templates.
  • The JS runtime block in .cursorrules, .clinerules and .windsurfrules.
  • .github/copilot-instructions.md.
  • The PR template's banned-languages line.
  • Two comments: workflow-linter.yml and check-action-pinning.js.
• Re-pin ae36881 → 934b879 (66453bf) for the six standards reusables, fixing governance / Actions lockfile verify, which is red on main.
  • Why it fails: at ae36881 the gate installs gh-actions-lock v0.1.6, which cannot read this lock's format v0.0.3 ("newer than this binary supports").
  • 934b879 installs v0.2.0. This is the same change resource-algebra#8 made.
  • actions.lock was repaired with standards' own scripts, in order: complete-job-refs.sh, close-lock.sh (run offline), prune-stale.sh. The setup-deno and setup-bun records match resource-algebra main's.
• CHANGELOG.adoc: an entry under Unreleased / Changed.

Left as they are:

• docs/governance/TEMPLATE-LINEAGE-AUDIT.adoc, a dated audit record.
• The "deno" keyword in label-classifier.json, which is a migration-label keyword.
• copilot-instructions' TypeScript paragraph. It is stale against the 2026-08-27 "no TypeScript" tightening, which is a different ruling and out of scope here.
• governance / UUID v7 conformance, red on main too and not caused by this PR. See this comment.

RSR Quality Checklist

Required

• Tests pass (see Testing)
• Code is formatted
• Linter is clean (shellcheck on the new gate script; workflow validation unchanged at 4 recommendations)
• No banned language patterns
• No unsafe blocks without // SAFETY: comments
• No banned functions
• SPDX license headers present on all new/modified source files (headers unchanged; no new files)
• No secrets, credentials, or .env files included

As Applicable

• Documentation updated for user-facing changes
• CHANGELOG or release notes updated

Testing

Gate, old step against new, extracted from each workflow with yq and run in fixture directories:

Fixture	old	new
empty	rc=0 notice	rc=0 notice
bun.lock + deno.lock + pnpm-lock.yaml	rc=1 "Mixed toolchains: 3"	rc=0
bun.lock + pnpm-lock.yaml	rc=1	rc=0
package-lock.json + bun.lock	rc=1	rc=1
package-lock.json alone	rc=0 warning	rc=0 warning
deno.json + deno.lock	rc=0 warning ("being removed")	rc=0 notice
bun.lockb alone	rc=0	rc=0

Repository checks (just 1.42.4, nickel 1.17.0, mikefarah yq 4.44.3, gh-actions-lock v0.2.0):

build/just/provision-check.sh .                provision-check: 0 FAIL, 0 WARN
provision-lib.sh doctor                         same results as the old engine; only PASS wording differs
.machine_readable/arrival-pack/verify.sh        OK: CLAUDE.md arrival pack is in sync with the deed.
just validate-repo-map                          repository map: up to date
scripts/validate-template.sh .                  Validation PASSED (9 warnings; main: 9)
tests/workflows/validate_workflows_test.sh      Workflow validation PASSED (4 recommendations; main: 4)
tests/workflows/archetype_lock_merge_test.sh    PASS
scripts/check-lock-sync.sh                      OK (0 dangling edges)
934b879 check-actions-lock-gate.sh              Immutable direct and transitive lockfile coverage verified. (exit 0)
shellcheck -S warning (runtime-policy step)     clean
git diff --check                                clean

The doctor's failures here come from the sandbox (no Guix and similar), and they are the same under both engines.

SonarCloud: its quality gate reports Maintainability D and Security C on new code. This environment cannot reach sonarcloud.io, so I have not seen the findings. Most of the new code is the engine, copied byte for byte from standards, where the same change passed Sonar on #1255.

What follows. Repositories minted earlier keep the old runtime-policy.yml until it is re-synced. Any of them that adopts the three-lock layout goes red on Runtime Policy until then.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y6FD63UrriRBHqmhhEca9t

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 48 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: hyperpolymath/rsr-template-repo/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 666c0cde-9659-4132-a8dd-caf81ee0937f

📥 Commits

Reviewing files that changed from the base of the PR and between 0afa6c9 and 66453bf.

⛔ Files ignored due to path filters: 1

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing: 23

• .clinerules
• .cursorrules
• .github/copilot-instructions.md
• .github/pull_request_template.md
• .github/workflows/governance.yml
• .github/workflows/hypatia-scan.yml
• .github/workflows/mirror.yml
• .github/workflows/runtime-policy.yml
• .github/workflows/rust-ci.yml
• .github/workflows/scorecard.yml
• .github/workflows/secret-scanner.yml
• .github/workflows/workflow-linter.yml
• .machine_readable/arrival-pack/arrival-pack.ncl
• .windsurfrules
• CHANGELOG.adoc
• CLAUDE.md
• build/just/provision-check.sh
• build/just/provision-lib.sh
• build/just/provision-modes.sh
• docs/SETUP.adoc
• docs/onboarding/llm-warmup-dev.adoc
• mise.toml
• scripts/check-action-pinning.js

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

Two of the red checks here are not caused by this PR; one is fixed, one has no fix yet, and SonarCloud I could not read.

governance / UUID v7 conformance: red on main too (Governance run 38554261344 at 0afa6c9), with the same findings.

• check-uuid-v8.sh --strict flags four literals, none of which this PR adds or changes:
  • the deed's identity UUID, #u5"a5ea1382-…";
  • the same UUID in CLAUDE.md, which the arrival pack generates from the deed;
  • the two Julia package UUIDs in archetypes/julia-library/overlay/Project.toml.in.
• The template's own directive says to keep #u5 literals in deeds until the deed ABNF admits v8. The Julia UUIDs are external identifiers.
• The script fails the same way at standards main (ed04132e), so no fix exists yet. The gate needs to accept deed #u5 literals and typed external IDs (ADR-008 phase P3, in standards). I reproduced it locally rather than re-running, since it is deterministic.

governance / Actions lockfile verify: fixed in 66453bf.

• It failed because ae36881 installs gh-actions-lock v0.1.6, which cannot read this lockfile's format v0.0.3.
• The six standards reusables move to 934b879, which installs v0.2.0, the same change resource-algebra#8 made.
• actions.lock is closed at the new pin. Locally, the 934b879 gate reports "Immutable direct and transitive lockfile coverage verified" (exit 0).

SonarCloud: the quality gate fails on new code (Maintainability D, Security C). This environment cannot reach sonarcloud.io (egress policy), so I have not seen the individual findings.

• Most of the new code is the provisioning engine, copied byte for byte from standards ed04132e. provision-set realign overwrites this copy, so fixes for findings there belong in standards.
• In standards, the same engine changes passed Sonar's gate on feat(provisioning): a package.json provisions bun, deno and pnpm; deno and pnpm leave the banned list standards#1255.

---

Generated by Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE