Repository navigation
feat(json): JSON-POLICY (D306) + report-only ijson-jcs gate - #1189
Merged
Merged
Conversation
Adds 3-practice/JSON-POLICY.adoc: J-1 (I-JSON + JCS for .json), J-2 (one canonical record per line for .jsonl), the tool-demanded JSONC carve-out, and the measured conformance of ijson-jcs@0fdeea71 (RFC 8785 Appendix B numbers: 23/24). scripts/check-ijson-jcs.sh reports non-canonical/invalid files and exits 0; --enforce exits 1; a missing tool or path exits 2. scripts/tests/check-ijson-jcs-test.sh (28 controls) proves it can fail; three mutants (line compare, final newline, .jsonl dispatch) each turn it red. Wired as .github/workflows/ijson-jcs.yml with a hand-added actions.lock entry (checkout only). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 56 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (5)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37584463836 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
ijson-jcs check accepts a .json with no final newline, so the gate let one pass that J-1 rejects. classify_json now checks the tail byte. Two new controls (no newline, two newlines); a mutant that disables the tail check turns exactly the first one red. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37584740324 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
7 of 17 tasks
The shared suite runs every scripts/tests/*.sh fail-closed, and the new ijson-jcs test exits 2 without the binary, so Repo self-tests went red. Install it at the same pin as ijson-jcs.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL
Contributor
K9 contract conformancerun https://github.com/hyperpolymath/standards/actions/runs/37585352810 K9 normative contract typecheckK9 contract self-testK9 conformance fixturesK9 corpus conformance (L2) |
|
hyperpolymath
added a commit
to hyperpolymath/rsr-template-repo
that referenced
this pull request
Oct 7, 2026
…230) ## Summary Brings the template in line with three owner rulings recorded on `hyperpolymath/standards#787`: - **Deno is retired** (2026-08-26, standards#655); - **JSON is I-JSON + JCS** (D306); - **UUIDv8, KYAML `.kyaml`, descriptiles as deed clauses, contractiles as k9 verb directories** (D305, D307, D312). The template scaffolds every new repo, so text here that contradicts a ruling gets copied into every repo made from it. ## 📌 New pins Head SHA: **`0509dbfec1c8e60aff47b3de1b06406dda18fd57`**. No action, lockfile or container pin is added or changed. `oven-sh/setup-bun@v2.2.0` appears only inside **commented-out** blocks of `e2e.yml.template`. Its comment says `actions.lock` resolves it when the template is instantiated. It is not a live `uses:`. ## Changes **Deno** - `release.yml`: removed the `deno.json` branch, and removed `deno.json` from the "Expected one of" message. - `e2e.yml.template`: the DENO/E2E block and the Playwright block now use Bun (`bun install --frozen-lockfile`, `bun test`, `bunx playwright`). - `runtime-policy.yml`, `workflow-linter.yml` and `scripts/check-action-pinning.js` ordering comments now read "Bun > pnpm > npm; Deno retired". - The runtime-policy **Deno detector is kept**: it is what flags Deno. - Raising its `::warning` to an error is logged as a finding, not done here. - `.clinerules`, `.cursorrules`, `.windsurfrules`: "Deno grandfathered" and "TypeScript IS PERMITTED" are replaced by "Deno retired, migrate to Bun; TypeScript and ReScript migrate to AffineScript". - `.machine_readable/arrival-pack/arrival-pack.ncl`: the language-policy source of CLAUDE.md, corrected the same way. CLAUDE.md was regenerated with `generate.sh`. - `.github/pull_request_template.md`: the "banned language" checkbox read "(no , no npm/bun, no Go/Python)": a word was missing and it banned Bun. It now names the banned set. The SPDX header is untouched. **JSON (D306)** - Canonicalised with `ijson-jcs fix` (pinned `0fdeea71`), the four template-owned files only: - `.github/rulesets/Immutable-Tags.json` - `www/.well-known/aibdp.json` - `www/tests/controls/aibdp-bad-status.control.json` - `www/tests/controls/aibdp-enforce-430.control.json` - Deliberately **not** touched: - `base.json`, `branch-floor.json`, `require-linear-history.json`, `require-signed-commits.json`: byte-identical copies of `standards/config/rulesets`, said to be sourced verbatim. Canonicalise upstream first. - `www/schemas/aibdp-schema-v0.2.json`: vendored unmodified from consent-aware-web. - `.github/labels.json`, `.github/label-classifier.json`: generated ("do not edit") by generators in another repo. Logged as a finding. - the two `devcontainer.json` files: tool-demanded JSONC whose comments carry SPDX headers. **CLAUDE.md and the deed** - In the hand-authored block below the generated region (owner marker kept): - UUIDv7 → **UUIDv8** (ADR-008, D305). Deed literals stay `#u5`, and existing IDs are not rewritten. - KYAML: `.kyaml` for estate config, `.yml` only where a tool demands it. Workflows wait for the lock-coverage shim (D280, D307). - JSON cites `standards/3-practice/JSON-POLICY.adoc`. That file lands with hyperpolymath/standards#1189 and does not exist on standards `main` until that PR merges. - The required-templates list (Intentfile, Mustfile, …) is replaced by descriptiles-as-deed-clauses and contractiles-as-k9-verb-directories (D312). - `rsr-template-repo_chora.deed` `:contractiles_required` now lists the retired names' real directories: `("Mustfile" "Trustfile" "Intentfile")` → `.machine_readable/contractiles/{must,trust,intend}/`. - The deed has **no `(contractiles …)` attestation clause yet**. CLAUDE.md names it as the D312 target and does not claim it exists. **Left as it is, on purpose:** `.github/copilot-instructions.md` keeps the narrow TypeScript carve-out that `standards/3-practice/LANGUAGE-POLICY.adoc` §1.2 still states. Reconciling it with the Bun-only ruling is pending in standards. ## RSR Quality Checklist ### Required - [x] Tests pass. `www/tests/check-aibdp.sh` gives rc=0, and its output is byte-identical before and after the JSON change; both planted controls are still rejected. - [x] Formatted. The canonicalised files pass `ijson-jcs check` (rc=0 on all four), and `jq -S` shows the same data before and after. - [x] Linter is clean, no new warnings. `actionlint` on the three edited workflows reports two shellcheck warnings (`release.yml` SC2046, `workflow-linter.yml` SC2034). Both are present on `main` unchanged; this PR adds none. - [x] No banned language patterns. This PR removes them. - [ ] `unsafe` blocks: not applicable, no Rust touched. - [ ] Banned functions: not applicable, no proof or ML code touched. - [x] SPDX headers present. No new files; every modified file keeps its existing header. - [x] No secrets, credentials or `.env` files. ### As Applicable - [ ] Deed `(status)`/`(maturity)`: no project state change. Only `:contractiles_required` changed, as above. - [ ] Deed `(ecosystem)`: no integration change. - [ ] Deed `(meta)` / `docs/decisions/`: no new decision. This applies rulings already recorded on standards#787. - [ ] ROADMAP: no milestone change. - [x] Documentation updated: CLAUDE.md, the rules files, and the PR template. - [ ] TOPOLOGY.md: no architecture change. - [ ] CHANGELOG: not updated; the template has no release cut pending. - [ ] Dependencies: none added. - [ ] ABI/FFI: not touched. ## Testing - `bash .machine_readable/arrival-pack/verify.sh` → `OK: CLAUDE.md arrival pack is in sync with the deed.` Run before the change (baseline) and after regeneration. Run with nickel 1.16.0. - `bash scripts/validate-template.sh` → `Validation PASSED`, 0 errors. The 7 warnings are placeholders and SPDX headers on files this PR does not touch. - `ijson-jcs check` → rc=0 on the four canonicalised files. - `standards/.githooks/docstring-scan.sh --worktree` → no functions touched. - A grep for `deno` in `release.yml` returns nothing. - Not run locally: `deed-validate` runs a remote action (`deed-ecosystem/validate-action`). CI is the check for the deed edit, which reuses the multi-line string-list form already used by `:machine_readable_required`. ## Screenshots Not applicable. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Updated runtime guidance to prioritize Bun, allow pnpm when required by tooling, and retain npm as a last resort. Existing Deno projects are directed to migrate to Bun. * TypeScript and ReScript are no longer permitted; projects using them are directed to migrate to AffineScript. Use plain JavaScript where JavaScript is needed. * Clarified file-format and identifier rules, including exceptions for formats required by tools. * **Build and workflow support** * Deno-based builds are no longer recognized. Updated workflow examples use Bun for setup, installation, and tests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements owner ruling D306 (standards#787): every estate
.json/.jsonlis I-JSON (RFC 7493) + JCS (RFC 8785) canonical, extensions unchanged. This is task 3b, authorised by D314.3-practice/JSON-POLICY.adoc:.json) and Rule J-2 (.jsonl, one canonical record per line).devcontainer.json,.vscode/*.json, whose comments carry SPDX).hyperpolymath/ijson-jcsitself.scripts/check-ijson-jcs.sh: a report-only gate. It lists non-canonical and invalid files plus a summary, then exits 0.--enforceexits 1 on any finding. A missing tool or path exits 2, so a gate that cannot look does not pass.scripts/tests/check-ijson-jcs-test.sh: 31 controls proving the gate can fail..github/workflows/ijson-jcs.yml: installsijson-jcsat a pinned commit, runs the test, then the scan..github/workflows/self-test.yml: installs the same pinnedijson-jcs. The shared "Repo self-tests" job runs everyscripts/tests/*.shfail-closed, and on8c981268the new test exited 2 there for want of the binary (every control red). The tool is installed rather than the test skipped: a skip is not a pass.No issue: D306 is the authorising ruling.
Type of change
3-practice/JSON-POLICY.adoc📌 New pins
Head SHA:
cdcfbb1d3e3304cf23e952ba859d0b3b61fcffcdactions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1(v7.0.1). This pin is already used estate-wide. It gets a newactions.lockentry under.github/workflows/ijson-jcs.yml, added by hand, becausegh actions-lockfix mode corrupts local refs.hyperpolymath/ijson-jcsat0fdeea716fd558e9807362acf6f8202d56d8d88f, installed withcargo install --git … --rev … --locked, since the tool has no releases. ItsCargo.lockis committed at that rev. The same pin is used inself-test.yml; arun:step adds nouses:, soactions.lockis unchanged by that commit.How has this been verified?
bash scripts/tests/check-ijson-jcs-test.shreported passed 31, failed 0. It covers canonical, unsorted, pretty-printed, no-final-newline, two-final-newlines, duplicate-key and truncated.json; canonical, second-line-unsorted, whitespace, no-final-newline, blank-line and unparseable.jsonl; the JSONC carve-out; nested directories;node_modules/.gitexclusion; an empty tree; and exit 2 for a missing path or binary.sedmutants of the checker, eachbash -n-clean and different from the original, all turned the suite red:.jsonldispatch broken: 3 FAIL;.jsonfinal-newline tail check disabled: 2 FAIL (exactly the two new controls). It exists becauseijson-jcs checkitself accepts a.jsonwith no final newline.scripts/check-ijson-jcs.sh .on this branch reported62 file(s) checked, 0 canonical, 62 not canonical, 0 invalidwith rc=0. 62 equalsgit ls-files '*.json' '*.jsonl' | wc -l.bash .githooks/validate-actions-lock.sh: ✅.scripts/check-lock-sync.sh: "actions.lock is in sync".actionlint .github/workflows/ijson-jcs.yml: rc=0.scripts/check-allowed-actions.sh: 0 not covered.scripts/check-workflow-duplicate-keys.sh: 60 clean.gh actions-lock --no-fix: the only finding naming the new workflow is thesha-as-refwarning every SHA pin in this repo carries. Its one error (signed-push-smoke.yml,local-action) is already onmain.scripts/check-inline-python.shexits 1 onmaintoo: a stale ledger line forrhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.../comprehensive-quality.yml. That is unrelated to this PR and was not touched..githooks/docstring-scan.sh --worktree: 7/7 functions documented (100%); 1/1 after the second commit.ijson-jcs@0fdeea71:cargo testpasses, 38 + 11 + 3;43143ff3c1cb0959: the expected output is1424953923781206.2, the tool emits…206.3. Both strings round-trip; ECMAScript breaks the tie toward the exact value.NaN,Infinityand1e400exit 2.[1e+23]vs[1e23]) was correctly reported as a mismatch.Horizon: one repository (standards at
9f68971bplus this commit), one tool build (0fdeea71), and 24 Appendix B vectors. The estate-wide conformance count was not measured.Checklist
git log --format=%G?reportsGon83abfa4a,8c981268andcdcfbb1d.check-inline-python.sh, whose pre-existing failure onmainis described above.MPL-2.0; the policy prose isCC-BY-SA-4.0. No existing file was relicensed.Notes for reviewers
AGENTS.md§2a, files are converted per repo after checking their consumers, not swept.ijson-jcsAppendix B failure and a suggested--linesmode are appended todev-notes/inbox/findings.md, together with the tool's missing-newline acceptance (D273: findings, not issues). That file is local; the dev-notes vault push is currently blocked.🤖 Generated with Claude Code
https://claude.ai/code/session_01D6JVLvmCeSFGcY6jSNesbL