Skip to content

fix(ledger): drop the stale sanctify-php inline-python entry - #1191

Merged
hyperpolymath merged 2 commits into
mainfrom
fix/redci-wave2
Oct 7, 2026
Merged

hyperpolymath merged 2 commits into
mainfrom
fix/redci-wave2

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Repo self-tests is red on main at 9f68971. Exactly 1 of the 80 test files fails.

  • Decisive log lines (run 37541637242, job 112536053286):
    • FAIL: repository ledger drifted (exit 1)
    • ❌ stale ledger entry rhodium-standard-repositories/satellites/cccp/satellites/sanctify-php/.github/workflows/comprehensive-quality.yml:2 — no inline Python left; delete the line
    • Then ##[error]scripts/tests/check-inline-python-test.sh failed (exit 1) and ERROR: 1 of 80 test file(s) failed.
  • Cause. chore(sanctify-php): resync vendored copy from upstream main fa9bd386 #1185 (7d51f30) resynced the vendored sanctify-php copy from upstream fa9bd386. That removed the 2 inline-Python lines from its comprehensive-quality.yml. .machine_readable/inline-python-allow.txt is a shrink-only ledger, and it treats a count that has fallen as stale. Its header says: "Fixing debt therefore means lowering or deleting its line in the same change."
  • Fix. Delete that one ledger line. The ledger gets smaller. Nothing is added and no count goes up.

No issue is filed for this. It is the follow-up #1185 needed.

Type of change

  • 🐛 Bug fix (non-breaking change that fixes an issue). Not ticked: no code changes, only one ledger line.
  • ✨ New feature: no.
  • 💥 Breaking change: no.
  • 🕳️ Soundness fix: no.
  • 📖 Documentation: no.
  • 🧹 Refactor / tech debt (behaviour-preserving): records debt that chore(sanctify-php): resync vendored copy from upstream main fa9bd386 #1185 already paid off.
  • ⚡ Performance: no.
  • 🔧 Build / CI / tooling: makes Repo self-tests pass again.

📌 New pins

  • Head SHA: 353ba5d
  • None. No uses: ref, actions.lock entry, lockfile record or container digest is added or changed.

How has this been verified?

Each command was run locally in the worktree.

  • Before the change, at 9f68971. bash scripts/tests/check-inline-python-test.sh reproduced the CI failure: FAIL: repository ledger drifted (exit 1), the same stale-entry line, then check-inline-python: 23 passed, 1 failed.
  • After the change. The same command printed PASS: repository ledger is exact — ✅ inline-python: 14 ledgered line(s) across 10 file(s), none new, none grown, none stale. and check-inline-python: 24 passed, 0 failed.
  • The gate on its own. bash scripts/check-inline-python.sh printed the same ✅ line and returned rc=0.
  • Positive control. The "before" run is the control: with the line present, the gate fails. The test file also kills its own mutants (mutant killed (no-stale-check) and mutant killed (no-dash-c)), and both passed in the run above.
  • Debt ratchet. bash scripts/check-debt-ratchet.sh origin/main printed all 8 entries unchanged and Debt ratchet: OK., rc=0.
  • Exemption ratchet. bash scripts/check-exemption-ratchet.sh origin/main printed its 5 watched ledgers unchanged and Exemption ratchet: OK., rc=0. inline-python-allow.txt is not one of those ledgers. Its own gate is shrink-only, and a deletion is what that gate asks for. No Ratchet-exception line is needed.
  • Pre-commit hook. The repo's hook passed during git commit.
  • Full suite, the command the check runs. bash scripts/run-shell-test-suite.sh (from self-test.yml) at 353ba5d printed All 80 test file(s) passed., rc=0.
  • Not yet verified: the CI run on this branch.

Checklist

  • My commits are signed (git commit -S): %G? = G.
  • I ran the project's own checks/tests locally and they pass: the full 80-file suite (scripts/run-shell-test-suite.sh) and both ratchets, as above.
  • New files carry the correct SPDX-License-Identifier: this PR adds no new files.
  • Docs are updated, and no public claim now overstates what the code does: no docs are affected.
  • I have not introduced a soundness hole: the ledger only shrinks.

Notes for reviewers

  • Any future resync of a vendored satellite that removes inline Python will trip the same test. The ledger line has to be deleted in the same PR as the resync.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm

#1185 resynced the vendored sanctify-php copy from upstream fa9bd386,
which removed the two inline-Python lines from its
comprehensive-quality.yml. The inline-python ledger is shrink-only and
treats a fallen count as stale, so "this repository matches its ledger"
in scripts/tests/check-inline-python-test.sh failed and turned Repo
self-tests red on main (9f68971). Delete the line, as the ledger's own
header instructs. This shrinks the ledger; it adds nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X3hgXxWm6umMgZkjYyHnnm
@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 6bf194e6-8c47-4353-9b76-2478cb6ab475
📥 Commits

Reviewing files that changed from the base of the PR and between d7b85ca and 9e48b13.

📒 Files selected for processing (1)
  • .machine_readable/inline-python-allow.txt
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

K9 contract conformance

run https://github.com/hyperpolymath/standards/actions/runs/37587299928

K9 normative contract typecheck

k9_contract.ncl typechecks

K9 contract self-test

== the bash mirrors cannot drift from the normative contract ==
ok   leash_levels mirrors k9_contract.ncl
ok   core_capabilities mirrors k9_contract.ncl
ok   contract_version mirrors k9_contract.ncl
ok   schema_major mirrors k9_contract.ncl
== capability arithmetic (§8) ==
ok   capability_ok fs.read accepted
ok   capability_ok rollback.apply accepted
ok   capability_ok x-acme.gpu.alloc accepted
ok   capability_ok x-acme rejected
ok   capability_ok x-.gpu rejected
ok   capability_ok fs.delete rejected
ok   capability_ok  rejected
== the extractor ==
ok   extracts pedigree.security.leash
ok   extracts pedigree.component_type
ok   extracts pedigree.metadata.name
ok   pedigree leash is not reported as top-level leash
ok   required_capabilities for a quiet component
ok   required_capabilities follows allow_network
== the envelope strip keeps line numbers (§3.6) ==
ok   line 1 becomes a comment
ok   line count is preserved
ok   schema_version stays on line 5
== L3: signature presence is not verification (§10) ==
ok   no verifier -> K9-C001 is SKIPPED, never a pass
ok   the skip states presence does not authorise 'Hunt
ok   verifier accepts -> verdict 'Verified, no K9-C001 finding
ok   verifier refuses -> K9-C001 error, verdict 'Rejected
== the fixture runner's attribution cannot be fooled by a filename ==
ok   every extracted finding is well-formed rule+layer
ok   the rule that really fired is attributed
ok   a rule named only in the filename is NOT attributed
ok   K9-C001 is present as a skipped finding
ok   and that same finding is NOT extractable as a rejection
== no Nickel reserved word is used as an identifier ==
ok   the contract and all 27 fixtures avoid Nickel's reserved words

self-test: all assertions passed

K9 conformance fixtures

== positive controls (must pass) ==
ok   extension-capability.k9.ncl
ok   extension-fields.k9.ncl
ok   hunt-fully-granted.k9.ncl
ok   kennel-data.k9.ncl
ok   library-base.ncl
ok   yard-typed-config.k9.ncl

== negative controls (must fail, by the named rule) ==
ok   L0-K9-E001-bad-magic.k9.ncl (rejected by K9-E001 at L0)
ok   L0-K9-E002-nul-byte.k9.ncl (rejected by K9-E002 at L0)
ok   L0-K9-E003-crlf.k9.ncl (rejected by K9-E003 at L0)
ok   L0-K9-E004-no-spdx.k9.ncl (rejected by K9-E004 at L0)
ok   L0-K9-E005-unclaimed-body.k9.ncl (rejected by K9-E005 at L0)
ok   L0-K9-S012-library-with-pedigree.ncl (rejected by K9-S012 at L0)
ok   L0-K9-S014-stray-leash.ncl (rejected by K9-S014 at L0)
ok   L1-K9-S001-no-pedigree.k9.ncl (rejected by K9-S001 at L1)
ok   L1-K9-S002-wrong-major.k9.ncl (rejected by K9-S002 at L1)
ok   L1-K9-S003-todo-component-type.k9.ncl (rejected by K9-S003 at L1)
ok   L1-K9-S004-unknown-leash.k9.ncl (rejected by K9-S004 at L1)
ok   L1-K9-S005-missing-name.k9.ncl (rejected by K9-S005 at L1)
ok   L1-K9-S006-unknown-capability.k9.ncl (rejected by K9-S006 at L1)
ok   L1-K9-S007-ungranted-flag.k9.ncl (rejected by K9-S007 at L1)
ok   L1-K9-S008-hunt-signature-not-required.k9.ncl (rejected by K9-S008 at L1)
ok   L1-K9-S009-hunt-no-signature-block.k9.ncl (rejected by K9-S009 at L1)
ok   L1-K9-S010-hunt-empty-side-effects.k9.ncl (rejected by K9-S010 at L1)
ok   L1-K9-S011-recipes-at-yard.k9.ncl (rejected by K9-S011 at L1)
ok   L1-K9-S013-dangling-import.k9.ncl (rejected by K9-S013 at L1)
ok   L2-K9-N001-two-segment-version.k9.ncl (rejected by K9-N001 at L2)
ok   L2-K9-N001-wrong-field-type.k9.ncl (rejected by K9-N001 at L2)

fixtures: 6 positive, 21 negative (0 needing nickel), 0 failure(s)

K9 corpus conformance (L2)

[validate-k9] debt rhodium-standard-repositories/rsr-compliance-checklist.k9.ncl (fail) — K9-N001 K9-S004 K9-S005 K9-S014 (grandfathered; touching it makes it blocking)
[validate-k9] 14 conforming, 1 grandfathered (layer all, contract v1.0.0)

@hyperpolymath
hyperpolymath enabled auto-merge (squash) October 7, 2026 07:31
@github-actions

github-actions Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

K9 contract conformance

run https://github.com/hyperpolymath/standards/actions/runs/37587882428

K9 normative contract typecheck

k9_contract.ncl typechecks

K9 contract self-test

== the bash mirrors cannot drift from the normative contract ==
ok   leash_levels mirrors k9_contract.ncl
ok   core_capabilities mirrors k9_contract.ncl
ok   contract_version mirrors k9_contract.ncl
ok   schema_major mirrors k9_contract.ncl
== capability arithmetic (§8) ==
ok   capability_ok fs.read accepted
ok   capability_ok rollback.apply accepted
ok   capability_ok x-acme.gpu.alloc accepted
ok   capability_ok x-acme rejected
ok   capability_ok x-.gpu rejected
ok   capability_ok fs.delete rejected
ok   capability_ok  rejected
== the extractor ==
ok   extracts pedigree.security.leash
ok   extracts pedigree.component_type
ok   extracts pedigree.metadata.name
ok   pedigree leash is not reported as top-level leash
ok   required_capabilities for a quiet component
ok   required_capabilities follows allow_network
== the envelope strip keeps line numbers (§3.6) ==
ok   line 1 becomes a comment
ok   line count is preserved
ok   schema_version stays on line 5
== L3: signature presence is not verification (§10) ==
ok   no verifier -> K9-C001 is SKIPPED, never a pass
ok   the skip states presence does not authorise 'Hunt
ok   verifier accepts -> verdict 'Verified, no K9-C001 finding
ok   verifier refuses -> K9-C001 error, verdict 'Rejected
== the fixture runner's attribution cannot be fooled by a filename ==
ok   every extracted finding is well-formed rule+layer
ok   the rule that really fired is attributed
ok   a rule named only in the filename is NOT attributed
ok   K9-C001 is present as a skipped finding
ok   and that same finding is NOT extractable as a rejection
== no Nickel reserved word is used as an identifier ==
ok   the contract and all 27 fixtures avoid Nickel's reserved words

self-test: all assertions passed

K9 conformance fixtures

== positive controls (must pass) ==
ok   extension-capability.k9.ncl
ok   extension-fields.k9.ncl
ok   hunt-fully-granted.k9.ncl
ok   kennel-data.k9.ncl
ok   library-base.ncl
ok   yard-typed-config.k9.ncl

== negative controls (must fail, by the named rule) ==
ok   L0-K9-E001-bad-magic.k9.ncl (rejected by K9-E001 at L0)
ok   L0-K9-E002-nul-byte.k9.ncl (rejected by K9-E002 at L0)
ok   L0-K9-E003-crlf.k9.ncl (rejected by K9-E003 at L0)
ok   L0-K9-E004-no-spdx.k9.ncl (rejected by K9-E004 at L0)
ok   L0-K9-E005-unclaimed-body.k9.ncl (rejected by K9-E005 at L0)
ok   L0-K9-S012-library-with-pedigree.ncl (rejected by K9-S012 at L0)
ok   L0-K9-S014-stray-leash.ncl (rejected by K9-S014 at L0)
ok   L1-K9-S001-no-pedigree.k9.ncl (rejected by K9-S001 at L1)
ok   L1-K9-S002-wrong-major.k9.ncl (rejected by K9-S002 at L1)
ok   L1-K9-S003-todo-component-type.k9.ncl (rejected by K9-S003 at L1)
ok   L1-K9-S004-unknown-leash.k9.ncl (rejected by K9-S004 at L1)
ok   L1-K9-S005-missing-name.k9.ncl (rejected by K9-S005 at L1)
ok   L1-K9-S006-unknown-capability.k9.ncl (rejected by K9-S006 at L1)
ok   L1-K9-S007-ungranted-flag.k9.ncl (rejected by K9-S007 at L1)
ok   L1-K9-S008-hunt-signature-not-required.k9.ncl (rejected by K9-S008 at L1)
ok   L1-K9-S009-hunt-no-signature-block.k9.ncl (rejected by K9-S009 at L1)
ok   L1-K9-S010-hunt-empty-side-effects.k9.ncl (rejected by K9-S010 at L1)
ok   L1-K9-S011-recipes-at-yard.k9.ncl (rejected by K9-S011 at L1)
ok   L1-K9-S013-dangling-import.k9.ncl (rejected by K9-S013 at L1)
ok   L2-K9-N001-two-segment-version.k9.ncl (rejected by K9-N001 at L2)
ok   L2-K9-N001-wrong-field-type.k9.ncl (rejected by K9-N001 at L2)

fixtures: 6 positive, 21 negative (0 needing nickel), 0 failure(s)

K9 corpus conformance (L2)

[validate-k9] debt rhodium-standard-repositories/rsr-compliance-checklist.k9.ncl (fail) — K9-N001 K9-S004 K9-S005 K9-S014 (grandfathered; touching it makes it blocking)
[validate-k9] 14 conforming, 1 grandfathered (layer all, contract v1.0.0)

@sonarqubecloud

sonarqubecloud Bot commented Oct 7, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit 8453510 into main Oct 7, 2026
68 checks passed
@hyperpolymath
hyperpolymath deleted the fix/redci-wave2 branch October 7, 2026 07:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant