Repository navigation
chore(sanctify-php): resync vendored copy from upstream main fa9bd386 - #1185
Merged
Merged
Conversation
The vendored copy under rhodium-standard-repositories/.../cccp/satellites/ sanctify-php was 37 files and far behind upstream hyperpolymath/sanctify-php (182 files). Since #1181 the Haskell job builds every tracked package, and this copy cannot resolve: its .cabal pins base ^>=4.17 (GHC 9.4) while the job's GHC ships base-4.22. Upstream has since relaxed that to base >=4.17. Scoped resync, source = upstream origin/main fa9bd386 (read via git show, not a working tree): In: - every path the copy already tracked, made identical to upstream - deleted where upstream deleted them: 5 ISSUE_TEMPLATEs, comprehensive-quality.yml, LICENSE.txt (upstream ships LICENSE) - what the .cabal needs to build: src/, app/, bench/, test/*.hs, LICENSE Kept at the old vendored version, because upstream's copy fails one of this repo's own gates and editing vendored content to pass it is not ours to do. Neither plays any part in the build: - .github/dependabot.yml: upstream's has no SPDX header (validate-spdx) - .claude/CLAUDE.md: upstream's still names the retired 6a2/ path (check-canonical-names, AGENTS.md section 2a) Out, deliberately: - .machine_readable/ (holds a retired 6a2/ dir; and K9 contractiles that would enter standards' own K9 gates) - upstream's 13 newer workflows and .github/hooks - test/fixtures and test-plugins (deliberately vulnerable PHP) - www/, docs/ Local gates on this tree: Debtfile todo-fixme holds at 84, vendored-mirror-unpinned-actions falls 42 -> 40; check-lock-sync and check-allowed-actions pass. (gate-scripts-without-tests and the expired shell-scripts-missing-spdx acceptance are red on main too.) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 43 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (45)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37531108532 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autopilot |
|
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 21:08
hyperpolymath
disabled auto-merge
October 6, 2026 21:09
hyperpolymath
enabled auto-merge (squash)
October 6, 2026 21:09
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37531626123 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
This was referenced Oct 6, 2026
hyperpolymath
added a commit
to hyperpolymath/sanctify-php
that referenced
this pull request
Oct 6, 2026
…107) ## Summary Fixes a one-line defect that stops `sanctify-php` from compiling at all. Line 6 of `src/Sanctify/Parser.hs` was `//! verified alternatives.`, a Rust-style doc comment inside the Haskell header comment. GHC reads it as code, so the module header never parses: ``` Sanctify/Parser.hs:6:1: error: [GHC-58481] parse error on input ‘//!’ ``` Under cabal this shows up as `File name does not match module name: Saw ‘Main’, Expected ‘Sanctify.Parser’` (GHC-28623). That is how it failed when hyperpolymath/standards built its vendored copy of this repo (hyperpolymath/standards#1185, run 37531109754). The line becomes `-- verified alternatives.`, which continues the comment's sentence. Closes # (no issue filed. Found while building the standards vendored copy.) ## Type of change - [x] 🐛 Bug fix (non-breaking change that fixes an issue) - [ ] ✨ New feature: none. - [ ] 💥 Breaking change: no. One comment line changes. - [ ] 🕳️ Soundness fix: not a checker false-negative. - [ ] 📖 Documentation: no docs change. The fix is to a source comment. - [ ] 🧹 Refactor: no. - [ ] ⚡ Performance: no. - [ ] 🔧 Build / CI / tooling: no CI files change. ## 📌 New pins Head SHA: **`4317025d5b0a01924ad0457ff3498ddffa8d0844`**. No pins are added or changed. ## How has this been verified? These checks used local GHC 9.6.6 with the library stanza's flags: `-XGHC2021 -XOverloadedStrings -XLambdaCase -XDerivingStrategies -XDeriveGeneric -XDeriveAnyClass`. - **Before** (`main` `fa9bd38`): `ghc -fno-code Sanctify/Parser.hs` → `Sanctify/Parser.hs:6:1: error: [GHC-58481] parse error on input ‘//!’`. - **After** (this branch), the same command: - `Sanctify.AST` typechecks. - `Sanctify.Parser` parses and stops only at `Could not find module ‘Text.Megaparsec’`. That package is not installed on the machine that ran the check. - `git grep -nE '^\s*(//|/\*)' -- '*.hs'` on `main` finds this line and no other. **Horizon of this check:** it shows that the header and the whole of `Parser.hs` parse. It does **not** show that the package builds. No full `cabal build` ran locally, because neither cabal nor the dependencies were available. This repo's CI has **no Haskell build job** either: its checks on this PR are governance, scanning and lint only. So nothing has compiled the package end to end yet. ## Checklist - [x] My commits are **signed** (`git commit -S`). `git log --format=%G?` → `G`. - [ ] I ran the project's own checks/tests locally and they pass: no. There is no local cabal, so the tests could not run. Only the GHC parse check above was run. - [ ] New files carry the correct `SPDX-License-Identifier`: no new files. The file keeps its `MPL-2.0` header. - [x] Docs are updated, and no public claim now overstates what the code does. No docs make claims about this. - [x] I have not introduced a soundness hole: one comment line changes. ## Deferred red checks Both reds already fail on `main` (`fa9bd38`). This PR does not touch either one: - `governance / Actions lockfile verify`: deferred to #108 (3 stale `actions.lock` entries). - `governance / Licence consistency`: deferred to #109 (`LICENSE` MPL-2.0 vs `.cabal` PMPL). This needs an owner decision. ## Notes for reviewers When this lands, hyperpolymath/standards can re-sync its vendored copy under `rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/`. Since standards#1184, standards' own CI does not build that copy, because nested-only Haskell is reported as unsupported. So nothing there is red in the meantime. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 6, 2026
## Summary Corrects the Haskell build step's comment, and its guard's error text, in `.github/workflows/ci-pipeline.yml`. Since #1184 both describe a detect probe that no longer exists. #1181 and #1184 merged opposite answers to #1161: - #1181 made the build step generate a `cabal.project` for every tracked package, because detect counted `*.cabal` at any depth. - #1184, merged after it, narrowed detect to a root `cabal.project` or a root `*.cabal`. It reports nested-only Haskell as **unsupported**. On 2026-10-06 the owner ruled that #1184's root-only detect stands. This PR brings the build step's text into line with that ruling. Two pieces of text were false on `main`: - **The comment.** It said the probe "counts `*.cabal` at ANY depth" and that narrowing it "would have hidden nested Haskell instead". - **The `::error::` text.** It said "detected (*.hs or stack.yaml)". Detect no longer counts either. Closes # (none. This follows up #1161, #1181 and #1184.) ## Type of change - [ ] 🐛 Bug fix: no behaviour changes. - [ ] ✨ New feature: none. - [ ] 💥 Breaking change: no. Comment and message text only. - [ ] 🕳️ Soundness fix: no checker logic changes. The text it corrects did misdescribe a gate. - [x] 📖 Documentation (in-workflow comment and error text) - [ ] 🧹 Refactor: nothing is restructured. - [ ] ⚡ Performance: not affected. - [x] 🔧 Build / CI / tooling (the file is the shared CI pipeline) ## 📌 New pins Head SHA: **`949302ecfb4568295c36e6a7dfe9317f0a821ba1`**. No pins are added or changed: no `uses:`, `actions.lock`, lockfile or digest edits. ## How has this been verified? - `git diff --stat origin/main` → 1 file, comment and `::error::` text only. The second commit (`949302ec`) takes CodeRabbit's point: a root `cabal.project` listing only nested packages also turns the job on, so the step does not always have a root package. Every changed line is a `#` comment or the quoted `::error::` string. - `ruby -e 'YAML.load_file(...)'` on the edited workflow parses with rc 0. - `bash scripts/check-lock-sync.sh` → `actions.lock is in sync`. `bash scripts/check-allowed-actions.sh` → rc 0. - I read the new text against `main`'s detect step: - L159 is `N_HASKELL=$(count 'cabal.project' ':(glob)*.cabal')`. - L232–238 probe nested Haskell as unsupported only when `N_HASKELL` is 0. - So the `else` branch runs only with a root `*.cabal`. It then lists `.` plus each nested package directory, which is what the new comment says. ## Checklist - [x] My commits are **signed** (`git commit -S`). `git log --format=%G?` → `G`. - [x] I ran the project's own checks/tests locally and they pass: lock-sync and allowed-actions. The commit-msg hook accepted the message with one length warning. - [ ] New files carry the correct `SPDX-License-Identifier`: no new files. The existing header is unchanged. - [x] Docs are updated, and no public claim now overstates what the code does. That is the whole point of this PR. - [x] I have not introduced a soundness hole: the logic is untouched. ## Deferred red checks Both reds already fail on `main` (`7d51f30f`). This PR does not touch either one: - `Registry + topology in sync`: deferred to #1161 (registry drift on main). - `Repo self-tests`: deferred to #1161. The failing suite is `build-registry-test.sh`, which reports `FAIL: repository ledger drifted`. That is the same drift. ## Notes for reviewers - On `main`, standards' own Haskell is now skipped and listed as unsupported. So the vendored sanctify-php (#1185) is not built here. - Upstream sanctify-php `main` also does not compile: `src/Sanctify/Parser.hs` line 6 is `//! verified alternatives.`. A separate one-line upstream fix PR is being opened. Re-syncing this copy afterwards is a later step. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
7 of 13 tasks
hyperpolymath
added a commit
that referenced
this pull request
Oct 7, 2026
<!-- SPDX-License-Identifier: CC-BY-SA-4.0 Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk> --> ## Summary `Repo self-tests` is red on `main` at 9f68971. Exactly 1 of the 80 test files fails. - **Decisive log lines** (run 37541637242, job 112536053286): - `FAIL: repository ledger drifted (exit 1)` - `❌ stale ledger entry rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/comprehensive-quality.yml:2 — no inline Python left; delete the line` - Then `##[error]scripts/tests/check-inline-python-test.sh failed (exit 1)` and `ERROR: 1 of 80 test file(s) failed.` - **Cause.** #1185 (7d51f30) resynced the vendored sanctify-php copy from upstream fa9bd386. That removed the 2 inline-Python lines from its `comprehensive-quality.yml`. `.machine_readable/inline-python-allow.txt` is a shrink-only ledger, and it treats a count that has fallen as stale. Its header says: "Fixing debt therefore means lowering or deleting its line in the same change." - **Fix.** Delete that one ledger line. The ledger gets smaller. Nothing is added and no count goes up. No issue is filed for this. It is the follow-up #1185 needed. ## Type of change - [ ] 🐛 Bug fix (non-breaking change that fixes an issue). Not ticked: no code changes, only one ledger line. - [ ] ✨ New feature: no. - [ ] 💥 Breaking change: no. - [ ] 🕳️ Soundness fix: no. - [ ] 📖 Documentation: no. - [x] 🧹 Refactor / tech debt (behaviour-preserving): records debt that #1185 already paid off. - [ ] ⚡ Performance: no. - [x] 🔧 Build / CI / tooling: makes `Repo self-tests` pass again. ## 📌 New pins - Head SHA: **353ba5d5621ef2e2a255079e5be3e3bc459814fd** - None. No `uses:` ref, `actions.lock` entry, lockfile record or container digest is added or changed. ## How has this been verified? Each command was run locally in the worktree. - **Before the change, at 9f68971.** `bash scripts/tests/check-inline-python-test.sh` reproduced the CI failure: `FAIL: repository ledger drifted (exit 1)`, the same stale-entry line, then `check-inline-python: 23 passed, 1 failed`. - **After the change.** The same command printed `PASS: repository ledger is exact — ✅ inline-python: 14 ledgered line(s) across 10 file(s), none new, none grown, none stale.` and `check-inline-python: 24 passed, 0 failed`. - **The gate on its own.** `bash scripts/check-inline-python.sh` printed the same ✅ line and returned rc=0. - **Positive control.** The "before" run is the control: with the line present, the gate fails. The test file also kills its own mutants (`mutant killed (no-stale-check)` and `mutant killed (no-dash-c)`), and both passed in the run above. - **Debt ratchet.** `bash scripts/check-debt-ratchet.sh origin/main` printed all 8 entries `unchanged` and `Debt ratchet: OK.`, rc=0. - **Exemption ratchet.** `bash scripts/check-exemption-ratchet.sh origin/main` printed its 5 watched ledgers `unchanged` and `Exemption ratchet: OK.`, rc=0. `inline-python-allow.txt` is not one of those ledgers. Its own gate is shrink-only, and a deletion is what that gate asks for. No `Ratchet-exception` line is needed. - **Pre-commit hook.** The repo's hook passed during `git commit`. - **Full suite, the command the check runs.** `bash scripts/run-shell-test-suite.sh` (from `self-test.yml`) at 353ba5d printed `All 80 test file(s) passed.`, rc=0. - **Not yet verified:** the CI run on this branch. ## Checklist - [x] My commits are **signed** (`git commit -S`): `%G?` = `G`. - [x] I ran the project's own checks/tests locally and they pass: the full 80-file suite (`scripts/run-shell-test-suite.sh`) and both ratchets, as above. - [x] New files carry the correct `SPDX-License-Identifier`: this PR adds no new files. - [x] Docs are updated, and no public claim now overstates what the code does: no docs are affected. - [x] I have not introduced a soundness hole: the ledger only shrinks. ## Notes for reviewers - Any future resync of a vendored satellite that removes inline Python will trip the same test. The ledger line has to be deleted in the same PR as the resync. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This resyncs the vendored
sanctify-phpcopy (rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/) from upstreamhyperpolymath/sanctify-phpmainfa9bd386.Since #1181 the shared Haskell job builds every package that
detectcounts, so this copy now gets compiled. It cannot even resolve. It held 37 of upstream's 182 files, and its.cabalpinsbase ^>=4.17(GHC 9.4) while the job's GHC shipsbase-4.22. Upstream has since relaxed that bound tobase >=4.17. Owner ruling (2026-10-06, in session): resync from upstream, rather than excluding the package or leaving it red.The resync is scoped; nothing upstream was copied wholesale:
comprehensive-quality.yml, andLICENSE.txt(upstream shipsLICENSE). Also added is what the.cabalneeds to build:src/,app/,bench/,test/*.hsandLICENSE..github/dependabot.yml: no SPDX header upstream (validate-spdx)..claude/CLAUDE.md: upstream still names the retired6a2/path (check-canonical-names)..machine_readable/: it holds a retired6a2/dir, plus K9 contractiles that would enter this repo's K9 gates..github/hooks.test/fixturesandtest-plugins: deliberately vulnerable PHP.www/anddocs/.The vendored
.hsand.cabalfiles are upstream code, not written here. So any docstring-coverage score on them describes upstream.Type of change
Call CI Pipeline / Haskellon main.📌 New pins
092806946ca6e87875b032968e0cc3295977cc11uses:refs, itsactions.lock, lockfiles or container digests.uses:in them is a 40-hex SHA. Debtfilevendored-mirror-unpinned-actionsfalls from 42 to 40.How has this been verified?
scripts/run-debtfile.sh:todo-fixme-markersholds at 84;vendored-mirror-unpinned-actionsis paid down from 42 to 40;gate-scripts-without-tests(33 > 32) and the expiredshell-scripts-missing-spdxacceptance are red identically onorigin/mainebfcd98b, measured in a detached worktree, so they are not introduced here.scripts/check-lock-sync.shandscripts/check-allowed-actions.sh: rc=0, both on this tree and on main.Call CI Pipeline / Haskellrun is the build test. Upstream's own Haskell CI is no predictor: its last 30 runs were 25 failures, 3 cancellations and 2 startup failures. Its last run that actually built (564bcde3) failed on a module-name mismatch, which is fixed atfa9bd386; upstream main itself has never been built in CI.Checklist
git commit -S)..hsfile carries upstream's own header, unchanged; no licence text or header was edited.Notes for reviewers
dev-notes/inbox/findings.md, not decided here.Deferred red checks
Filled in once this PR's own run completes.
🤖 Generated with Claude Code
https://claude.ai/code/session_012kgrMQRhSmZMBbF9Ui1zBw