[hyperpolymath]

Summary

This is the follow-up that #247 deferred ("Upgrading it to v1.0.0 is a separate follow-up"). It is stacked on #247's branch and should merge after #247.

build/container/stapeln/deploy.k9.ncl.in was a pre-v1.0.0 component. A filled copy fails the canonical validator (standards 1-formats/k9/tools/k9-validate.sh, contract v1.0.0, D173) at L1 with K9-S002, S003, S004, S005 and S011. It also fails at L2 with K9-N001: the old export block's deployment = deployment is infinite recursion inside a recursive record, so the file never evaluated at all. This PR rewrites the component in the v1.0.0 shape, and just container-init now renders it to a real component.

Changes

• deploy.k9.ncl.in, modelled on template-hunt.k9.ncl.in:
  • top-level pedigree with schema_version = "1.0.0", component_type = "deployment", security.leash = 'Hunt and signature_required = true;
  • a capability grant that covers the three flags (net.fetch, fs.write, process.spawn), plus container.run, deploy.apply and rollback.apply, which the scripts actually perform;
  • concrete side_effects and warnings, and a pedigree.signature block. The block is presence only: it has no signature value until the owner signs the rendered file, so L3 reports 'Present_Unverified and Hunt stays unauthorised;
  • recipes moved from inside the pedigree to the top level, where K9-S011 and K9.Component read them. They now use the { description, commands } shape from the Hunt template;
  • deployment and scripts content is unchanged. Both export byte-identical to the old let bindings.
  • Dropped: security_level (the leash is the authority); pedigree.validation, whose checksum and hunt_authorized placeholders are covered by the signature block and the host's Hunt evidence (§9); the top-level required_level and warning, now pedigree.security.leash and pedigree.warnings.
  • The header comments now name build/container/stapeln/deploy.k9.ncl instead of the stale build/container/deploy.k9.ncl.
• build/just/container.just: after substitution, container-init renders the .in file to deploy.k9.ncl once no {{…}} token remains. Otherwise it keeps the .in file and names the missing tokens. It never overwrites an existing deploy.k9.ncl.
• Deed: :deployment now points at build/container/stapeln/deploy.k9.ncl, the rendered component that k9-svc and the K9 lane read. The (file) entry still names the .in source and states the render rule.
• build/container/README.adoc: the stapeln file table and the k9-svc section describe the v1.0.0 component, the render step, and the signature status.

RSR Quality Checklist

Required

• Tests pass: a rendered copy passes k9-validate.sh --strict --layer L2; see Testing.
• Code is formatted: Nickel and just, no formatter changes.
• Linter is clean: .github/hooks/validate-k9.sh passes; deed_lint.js OK.
• No banned language patterns.
• No unsafe blocks without // SAFETY: comments.
• No banned functions.
• SPDX license headers present (unchanged).
• No secrets, credentials, or .env files included.

As Applicable

• Repo deed updated: :deployment location and the deploy.k9.ncl.in (file) entry; lint OK.
• Documentation updated: build/container/README.adoc.
• Roadmap, TOPOLOGY, CHANGELOG, dependencies, ABI/FFI: not applicable.

Testing

Run locally with nickel 1.18.0 and standards main:

# render with the five tokens filled, then:
k9-validate.sh --strict --layer L2 deploy.k9.ncl      -> OK, conforming at L2 (errors 0, warnings 0, skipped 0)
k9-validate.sh --layer L3 deploy.k9.ncl               -> K9-C001 SKIPPED ('Present_Unverified), as intended
old file, same render, same command                   -> K9-S002 S003 S004 S005 S011 + K9-N001 (reproduced)

# mutation checks on the rendered file: each mutation trips the rule it targets
drop "process.spawn"          -> K9-S007
drop pedigree.signature       -> K9-S009
signature_required = false    -> K9-S008
leash 'Yard (recipes kept)    -> K9-S011
schema_version = "1.0"        -> K9-N001
type error in deployment      -> K9-N001

# payload preserved
nickel export --field deployment / scripts, old let-bindings vs new -> identical

# container-init, end to end (just 1.59.0, scratch copy of the tree)
before repo-init  -> "Kept …deploy.k9.ncl.in: unfilled tokens {{PROJECT_NAME}} {{VERSION}} remain."
after PROJECT_NAME/VERSION filled -> "Rendered build/container/stapeln/deploy.k9.ncl"
re-run            -> no-op
.github/hooks/validate-k9.sh on that tree -> 14 files, 0 failing (rendered component included, L2)

# this branch
bun 1-formats/deed/tools/deed_lint.js rsr-template-repo_chora.deed -> OK
bash .github/hooks/validate-k9.sh                                  -> 13 files, 0 failing, K9 validation passed
bash .machine_readable/arrival-pack/verify.sh                      -> in sync
bash .machine_readable/coaptation/verify.sh                        -> in sync
bash scripts/validate-session-contracts.sh                         -> both pass

standards/scripts/check-lock-sync.sh fails locally with awk: line 65: syntax error under mawk. It fails the same way on #247's head without this change, so it is a local-environment problem, not this diff.

Screenshots

None.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: hyperpolymath/rsr-template-repo/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e166b59-30e7-4390-a6ab-dcb92cb58612

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🟢 conformant · commit 472be6d9797e · run 39413977040 · validator hyperpolymath/standards@b3ce78e1a8cb

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
K9 contract typecheck	🟢 conformant	1	0	0	0	— no comparable baseline
K9 validator self-test	🟢 conformant	37	0	0	0	— no comparable baseline
K9 live corpus (L0–L2)	🟢 conformant	13	0	0	0	— no comparable baseline

Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T12:15:07.461194Z	472be6d	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 472be6d979

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Render the K9 component during repo-init

When users take the documented full-bootstrap path (just repo-init), that recipe substitutes all five deployment placeholders but never invokes this new rendering block, because it exists only in container-init. The generated repository therefore retains deploy.k9.ncl.in and never creates deploy.k9.ncl, even though the deed and deployment commands now point to the latter and the K9 hook only scans *.k9.ncl; consequently the upgraded deployment component is silently absent from validation and deployment unless users run a redundant second initializer. Share this render step with repo-init or perform the rename after its substitution pass.

Useful? React with 👍 / 👎.