Repository navigation
ci(k9): validate the deed and the K9 contracts through the canonical reusable lanes - #248
Merged
hyperpolymath merged 3 commits intoOct 20, 2026
Conversation
…reusable lanes WO-9 part 2 (standards#1058, D173, D312). dogfood-gate.yml's deed and K9 jobs called the deed-ecosystem and k9-ecosystem actions at @main, a second validator for each family, and the standalone k9-validate.yml and deed-validate.yml did the same again. All of it is replaced by the two canonical reusables, deed-conformance.yml and k9-conformance.yml, at one standards commit, with require-files on, so what CI accepts is what the contract says. The job ids deed-validate and k9-validate stay, so dogfood-summary's needs list is unchanged. The K9 lane asks for pull-requests: read only; the new k9-verdict job posts its grid to the pull request under the verdict-grid:k9 marker, one comment regenerated in place, and the badges job publishes badge.json to badges/k9.json on the governance-badges branch on every push to main through the contents API (GitHub-signed commits, no checkout written to). The README badge reads it through the shields endpoint. hypatia-scan.yml gets the same posting job for the Hypatia grid (artifact verdict-grid). Every hyperpolymath/standards pin moves to 764b7b38 (the k9-conformance merge), one SHA repository-wide. actions.lock is rewritten by the repair chain (relock-standards-pin, complete-job-refs, close-lock, prune-stale; check-lock-sync in sync), never by hand; the k9-ecosystem and deed-ecosystem dependency records that nothing references any more are the one thing gh actions-lock would still drop. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
…al tools validate-k9.sh and validate-deed.sh were grep validators of their own, a second validator per family that accepted files contract v1.0.0 rejects. Each is now a thin wrapper: k9-validate.sh (strict, L0–L2, or L0–L1 when nickel is not installed) and deed_lint.js under Bun, from a standards checkout named by STANDARDS_DIR (default ../standards), over the tracked files, as the CI lanes run them. Without a checkout they skip with a notice; the lanes remain the gate. The .a2ml-on-sight error stays in the deed hook. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🟢 conformant · commit
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. |
hyperpolymath
marked this pull request as ready for review
October 19, 2026 22:52
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
metadatastician/standards#1310 carries the lane's review fixes: pushes ratchet against `before`, the grid escapes Markdown and @-mentions, a malformed finding is orange rather than a jq error, and the validator is safe for dash-leading names. Every standards pin moves from 764b7b38 to its merge commit; actions.lock relocked with relock-standards-pin, complete-job-refs, close-lock and prune-stale, check-lock-sync in sync. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
|
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
hyperpolymath
merged commit Oct 20, 2026
a5e05b6
into
claude/new-session-th4e9w-k9-contractiles
41 checks passed
10 of 11 tasks
hyperpolymath
added a commit
to metadatastician/standards
that referenced
this pull request
Oct 20, 2026
…tem (#1313) ## Summary The owner asked for a proper review of the deed / K9 / contractile / descriptile system across the estate, a review of the 2026-10-19 Copilot conversation on assurance envelopes, exnovation and Panoply, and an ultraplan. This PR adds one file: `docs/ULTRAPLAN-DEED-K9-CONTRACTILES-2026-10-19.adoc` (v0.1.0, DRAFT). Nothing in it is ruled. Sections marked PROPOSED are design, written to be reviewed by a second reader. Measured with the canonical tools, not from status documents: `deed_lint.js`, `k9-validate.sh --layer L2 --strict` with the estate-pinned Nickel 1.18.0 (SHA-256 verified), the contractile CLI built from source, and the template's coaptation drift gate. | Surface | Files | Pass | |---|---|---| | Deeds, standards and template | 7 | 7 | | Deeds, hyperpolymath/panoply | 134 | 1 | | K9, standards | 15 | 14 (archive only fails) | | K9, rsr-template-repo (before hyperpolymath/rsr-template-repo#247) | 18 | 2 | | K9, contractiles | 10 | 3 | | `coordination.k9` | — | no validator exists | Root causes named in the document: 1. One word names several artefacts: `k9`, `must`, `Mustfile`, `manifest`, and two or three live meanings each for `adjust`, `dust` and `bust`. 2. Retirement by text substitution: panoply's A2ML bodies renamed to `.deed`, and its CI gate edited so it fails on every `.deed`. 3. Retired A2ML is still load-bearing: the Must gate, the weekly Debtfile rewrite, Hypatia's standards rules, and the contractile CLI, which reads only `*file.a2ml`. 4. Declarations without teeth: no coordination validator, and a CLI that finds nothing in a deed-era repo. 5. Spec documents stay DRAFT while their grammars are gated. The deed spec says "nothing deployed", and the Chora spec has dead links. 6. Version numbers without a reader rule, except K9. 7. No single home per question: facts sit in both the deed and `coordination.k9`, and templates come from four sources. On the Copilot model: the arithmetic is verified correct. The likelihoods are invented, though, and doubling two of them moves the verdict from "exnovate" to "review". Four formulas have demonstrated defects. The AffineScript-to-Panoply history contradicts Panoply's own README. The envelope shape is kept as a typed `(claims …)` clause using the constitution's six labels. The plan builds on hyperpolymath/rsr-template-repo#247 and hyperpolymath/rsr-template-repo#248 rather than redoing them. It has four phases: P0 stop the bleeding, P1 sort out and differentiate, P2 design and develop, P3 deploy. It also lists seven experiments with falsifiers, nine owner decisions (Q1–Q9), and a beyond-this-repo list. ## Testing | Check | Result | |---|---| | `.githooks/pre-commit` (with gitleaks 8.18.4 and mikefarah yq v4.44.3, both checksum-verified) | all checks passed | | `asciidoctor --failure-level WARN` | clean | | `scripts/check-canonical-names.sh origin/main` | no deprecated names reintroduced | | `scripts/link-rot-guard.sh docs` | 278 before and after; none from the new file | | Appendix code re-run under Bun | outputs match the figures quoted | ## Not done - The estate-wide extent is unmeasured. Five repositories were read; experiment X1 is the census. - No owner decision is recorded here. Q1–Q9 go through the selector, and the rulings land on #1234 under F4a. - No licence, SPDX header or `.a2ml` file is touched. --- _Generated by [Claude Code](https://claude.ai/code/session_01Rp1Fti9phnCG3qrvQJkYEh)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 20, 2026
Brings in #251 (mint a "Use this template" child correctly, at source). One conflict: .github/workflows/deed-validate.yml. This branch deletes it, because the deed lane is now the canonical deed-conformance reusable in dogfood-gate.yml (#248). Main's #251 changed one line of it, the "Copy it from the upstream template" pointer. The deletion is kept. #251 also added an assertion to tests/e2e/use_template_mint_test.sh that greps the minted child's deed-validate.yml for that pointer. With the file gone the grep has no subject and the Estate Rules "Use-this-template mint end to end" step fails, so the assertion is removed. The pointer now lives in the standards reusable, which the mint never rewrites. self_name_pass_test.sh keeps its fixture line: it tests the sed program on a string, not the file. Checked on the merged tree: - tests/e2e/use_template_mint_test.sh passes, using CI's pinned just 1.43.0 and nickel 1.17.0. With main's unedited test, the same run fails at the deed-validate assertion. - All 24 Estate Rules bash steps pass, using CI's pinned yq 4.53.3 and asciidoctor 2.0.26. - scripts/check-lock-sync.sh reports the lock in sync. Its one note, 3 unreferenced records, is the same on this branch's head. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xn9nqHVbUTRLgBdedoXAc8
hyperpolymath
added a commit
that referenced
this pull request
Oct 20, 2026
…ot components (#247) ## Summary WO-9 for metadatastician/standards#1058; the work order is in [metadatastician/standards#1308](metadatastician/standards#1308). Measured on 2026-10-19 with the canonical validator (`1-formats/k9/tools/k9-validate.sh --strict --layer L2` at standards `main`), 16 of this template's 18 K9 files failed contract v1.0.0 (D173), all six contractiles among them. Every repository instantiated from this template inherits those failures, so the template is fixed first and the per-repo wave (WO-10) follows. This PR now carries both parts of WO-9. Part 2, [#248](#248), was stacked on this branch and merged into it. It replaces `dogfood-gate.yml`'s deed and K9 jobs and `k9-validate.yml`, which used the `k9-ecosystem` action at `@main` as a second validator. In their place are the canonical reusables pinned to standards `b3ce78e1`, plus the K9 verdict-grid and badges jobs and the Hypatia verdict-grid job. ## Changes - **Six contractiles** (`.machine_readable/contractiles/<verb>/<verb>.k9.ncl`): declare `schema_version`, `component_type = "contractile:<verb>"`, `semantics` and `side_effects` explicitly (L1 reads the file, not the merged `_base.ncl`). Each is now a declaration evaluated at `'Yard`: `allow_subprocess = false`, `signature_required = false`, `tier` follows the leash, and a dated header note records why. Extension fields (`probe_scope`, `probe_kinds_*`, `authority`, `trident`, `execution`, …) are untouched. - `coapt.k9.ncl`, `claude-md.k9.ncl`, `methodology-guard.k9.ncl`, `coordination.k9.ncl`, `session/custom-checks.k9.ncl`: add `component_type`; the two drift-check records stop claiming a subprocess their `verify.sh` performs. - **Templates are not components.** `template-{kennel,yard,hunt}.k9.ncl`, `examples/setup-repo.k9.ncl` and `build/container/stapeln/deploy.k9.ncl` carry `{{PLACEHOLDER}}` values or `TODO` component types. They are renamed `*.k9.ncl.in` (MIGRATION-1058 M3, as standards did for its own). The READMEs, the deed's `(file)` entry and its `:deployment` location follow. - `.machine_readable/coaptation/receipts/latest.toml` is regenerated with `coapt.sh` (contractile hashes changed; band amber, advisory). - From #248: the CI lanes call the canonical deed and K9 reusables. The K9 and Hypatia grids are posted as one comment each, updated in place. The K9 badge is published to `governance-badges`. The local hooks wrap the canonical tools. ## Review follow-ups - The verdict-comment jobs skip fork and Dependabot pull requests, which get a read-only token. Validation still runs on them. Dependabot is identified by the pull request author, not `github.actor` (Hypatia RE008). - The stapeln deploy component stays a template: rendering it would fail contract v1.0.0 at L1. The container README says `container-init` fills it in place. Upgrading it to v1.0.0 is a separate follow-up. ## The one design call (owner) The contractiles were `'Hunt` with `allow_subprocess = true` and no signature block. Under v1.0.0 that is K9-S007/S009/S010, and a `'Hunt` record needs a verified signature (K9-C001) that no contractile carries, so the gate could never honour the claim. This PR takes the elegant arm: the record declares, the paired runner (`<verb>.ncl`, `scripts/run-*.sh`) executes, so the record is `'Yard`. The other arm is to keep `'Hunt`, grant `process.spawn`, declare `side_effects`, and sign each file with the owner-held key; say so and I will redo these six that way. ## Open blocker **SonarCloud Code Analysis** fails "C Security Rating on New Code". The issue list is not reachable from the agent session; see the PR comment. ## RSR Quality Checklist ### Required - [x] Tests pass: `bash scripts/validate-session-contracts.sh` passes; every tracked K9 file passes the canonical validator (13/13, strict, L0–L2). - [x] Code is formatted: Nickel records, no formatter changes. - [x] Linter is clean: `.github/hooks/validate-k9.sh` passes; `deed_lint.js` OK on the deed. - [x] No banned language patterns. - [x] No `unsafe` blocks without `// SAFETY:` comments. - [x] No banned functions. - [x] SPDX license headers present: no new files; renamed files keep theirs. - [x] No secrets, credentials, or `.env` files included. ### As Applicable - [x] Repo deed updated: the `deploy.k9.ncl.in` `(file)` entry and the `:deployment` location; lint OK. - [x] Documentation updated: `contractiles/README.adoc`, `self-validating/README.adoc`, `build/container/README.adoc`, `.github/workflows/README.adoc`, `README.adoc` (K9 badge). - [ ] Roadmap, TOPOLOGY, CHANGELOG, dependencies, ABI/FFI: not applicable. ## Testing ``` for f in $(git ls-files '*.k9.ncl' '*.k9'); do bash <standards>/1-formats/k9/tools/k9-validate.sh --strict --layer L2 --json --quiet "$f"; done -> 13 records, all verdict "pass", errors 0, warnings 0 (before: 16 of 18 failing) bash scripts/validate-session-contracts.sh -> both pass bun <standards>/1-formats/deed/tools/deed_lint.js rsr-template-repo_chora.deed -> OK bash .github/hooks/validate-k9.sh -> K9 validation passed bash .machine_readable/arrival-pack/verify.sh -> in sync bash .machine_readable/coaptation/verify.sh -> in sync (after coapt.sh) bash <standards>/scripts/check-lock-sync.sh -> in sync ``` In CI on 227357f, the K9 grid shows 13/13 conformant, and every check except SonarCloud is green. ## Screenshots None. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added K9 conformance status to the project README. - Added automated pull-request verdict reporting and badge publication after successful main-branch validation. - Added a reusable container deployment contract template with environment, health, rollout, validation, and rollback settings. - **Bug Fixes** - Improved DEED and K9 validation reliability through canonical standards tooling. - **Documentation** - Documented conformance checks, verdict artifacts, badges, deployment templates, and signature verification requirements. - Replaced standalone validation workflows and local validator checks with shared conformance workflows. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
WO-9, part 2 of 2 (metadatastician/standards#1058; the work order is
docs/reorg/2026-10-14-tidy/WORK-ORDERS-2026-10-19.adocin standards). Stacked on hyperpolymath/rsr-template-repo#247, which brought every K9 record up to contract v1.0.0; this PR makes CI check that with the canonical tools, at one standards commit, and retires every second validator in this tree.Before:
dogfood-gate.ymlvalidated the deed and the K9 files with thedeed-ecosystemandk9-ecosystemactions at@main, anddeed-validate.yml/k9-validate.ymldid the same again. None of them ran the canonical validator, so the 16 non-conforming files of #247 were green here for months. The pre-push hooks were a third copy, grep-based.After: the two reusable lanes of hyperpolymath/standards,
deed-conformance.ymlandk9-conformance.yml, pinned with every other standards call atb3ce78e1(the merge of hyperpolymath/standards#1310, which follows the k9-conformance merge in hyperpolymath/standards#1308),require-files: trueon both. One validator per family, pinned by the caller (standardsdocs/CONTRACTILE-DESCRIPTILE-VALIDATION.adoc).Changes
.github/workflows/dogfood-gate.yml:deed-validateandk9-validatebecome calls to the reusables (same job ids, sodogfood-summary'sneedslist is untouched). New jobs:k9-verdictposts the K9 grid to the pull request under<!-- verdict-grid:k9 regenerated on every run -->(one comment, updated in place; the reusable asks forpull-requests: readonly, so the caller posts), andbadgespublishesbadge.jsontobadges/k9.jsonon thegovernance-badgesbranch on every push tomain, through the contents API so the commit is GitHub-signed and no checkout is written to..github/workflows/hypatia-scan.yml: averdictjob that posts the Hypatia grid the same way (artifactverdict-grid)..github/workflows/k9-validate.yml,deed-validate.yml: deleted.uses: hyperpolymath/standards/…moves from75bd5994tob3ce78e1:governance,hypatia-scan,mirror,rust-ci,scorecard,secret-scannerand the two new calls..github/workflows/actions.lock: rewritten by the repair chain, not by hand:relock-standards-pin --to b3ce78e1,complete-job-refs,close-lock,prune-stale;check-lock-syncreports in sync. The standards record now carries the actions the reusables use atb3ce78e1, the same set as at764b7b38(dtolnay/rust-toolchain@683b588c,ossf/scorecard-action@fa7117dbreplace the older ones). The full chain withgh actions-lockwas also run in CI against this branch (echidna run 39336920170, since this container cannot fetch the extension): the governance gate at764b7b38returns 0 on the result andcheck-lock-syncis in sync, and the result is this lock minus exactly three dependency records. Two are the unreferencedhyperpolymath/{deed,k9}-ecosystem@mainrecords, whichgh actions-lockdrops; the third is thehyperpolymath/cicd-suite@0da816c0leaf that thecicd-suite@55556cf5record (main-estate-audit.yml) nests, whichclose-lockcannot regenerate ("cannot resolve a symbolic tag for leaf SHA") and whose absence is the dangling edge GitHub refuses runs on. This PR keeps the closed lock; the two stale records go the next time the lock is regenerated with a resolvablecicd-suiteleaf, which iscicd-suite's pin to repair, not this PR's..github/hooks/validate-k9.sh,validate-deed.sh: thin wrappers over1-formats/k9/tools/k9-validate.sh(strict, L0–L2; L0–L1 when nickel is absent) and1-formats/deed/tools/deed_lint.jsfrom a standards checkout (STANDARDS_DIR, default../standards); without one they skip with a notice and the lanes remain the gate. The.a2ml-on-sight error stays in the deed hook.pre-push's header says so.README.adoc: the K9 badge (shields endpoint ongovernance-badges)..github/workflows/README.adoc: a section on the lanes and why there is no second validator.Not in this PR:
coordination.k9.nclstays as #247 left it (it passes as a component); the deed's(contractiles …)clause needs no change (nothing renamed here). The pin was first764b7b38(the #1308 merge); the first lane run on this PR at that pin was green (13/13). It now sits atb3ce78e1, which adds #1310's fixes: push-event ratchet againstbefore, Markdown and @-mention escaping in the grid, malformed findings as orange, and dash-leading names in the validator.RSR Quality Checklist
Required
/home/user/standards(13 K9 files L0–L1 locally, 3 deeds), and both skip cleanly without a checkout.check-workflow-duplicate-keys.sh33 files clean.check-lock-sync.shin sync; the governance lock gate at764b7b38returns 0 in CI; no${{ }}insiderun:(values go throughenv).unsafeblocks without// SAFETY:comments..envfiles included: the posting jobs usegithub.token; nothing is inherited.As Applicable
.github/workflows/README.adoc, the README badge, the hook headers.Testing
On this PR the proof is the lanes themselves:
deed-validateandk9-validategreen, a 🟢 K9 grid comment fromk9-verdict.governance.ymlandhypatia-scan.ymlrun on pull requests againstmainonly, so they first run here once #247 merges and this PR retargets; thebadgesjob first runs on the merge tomain.Screenshots
None.
Generated by Claude Code
https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Generated by Claude Code