test(baseline): use [[ ]] in the invalid_actions_lock ledger guard

[hyperpolymath]

Summary

Follow-up to #1239. SonarCloud's quality gate passed on #1239 but reported 1 new issue. The session that wrote #1239 could not open the finding, because its proxy blocks sonarcloud.io.

The only conditional #1239 added is if [ "$got" = "0" ] in scripts/tests/apply-baseline-test.sh, the guard that keeps an invalid_actions_lock ack out of the shipped baseline. #1291 answered the same Sonar rule elsewhere in this repo with Bash [[ ... ]], so this PR does the same to this one line:

-  if [ "$got" = "0" ]; then
+  if [[ "$got" == "0" ]]; then

The rest of the file is unchanged.

Testing

Check	Result
bash scripts/tests/apply-baseline-test.sh	52 passed, 0 failed
Mutation: an invalid_actions_lock ack restored to a copy of .hypatia-baseline.json	2 FAIL, exit 1. The guard still fails on its target.
.githooks/pre-commit and commit-msg	passed, including gitleaks, SPDX and validate-actions-lock

Unconfirmed: I could not read the Sonar finding itself, so this PR's Sonar run is the confirmation. If Sonar still reports a new issue here, it was something else and I'll follow up.

---

Generated by Claude Code

[github-actions]

🟢 conformant · commit a5e826eeafd1 · run 39293900481

Category	Status	Pass	Fail	Indeterminate	N/A	Since previous revision
DEED syntax	🟢 conformant	4	0	0	0	↔ unchanged
K9 contract typecheck	🟢 conformant	1	0	0	0	↔ unchanged
K9 validator self-test	🟢 conformant	34	0	0	0	↔ unchanged
K9 positive/negative controls	🟢 conformant	27	0	0	0	↔ unchanged
K9 live corpus (L0–L2)	🟢 conformant	12	0	0	2	↔ unchanged

K9 live corpus (L0–L2): 2 finding(s) / scope notes

• 2-protocols/k9-coordination/examples/minimal.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.
• coordination.k9 — not_applicable: Routed to another dialect; not validated as a K9 contract.

Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 11915707-1148-484c-8f36-90d51809fd3f

📥 Commits

Reviewing files that changed from the base of the PR and between c314ddf and a5e826e.

📒 Files selected for processing: 1

• scripts/tests/apply-baseline-test.sh

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hyperpolymath]

scan / Hypatia Neurosymbolic Analysis is red here, but the failure is not this PR's. governance / Validate Hypatia Baseline will most likely go red for the same reason.

• What fails: the blocking gate keeps two high invalid_actions_lock findings on .github/workflows/actions.lock, one from workflow_audit and one from workflow_hardening: {:line, 4, {:unsupported_version, "v0.0.3"}}.
• Why it isn't this PR's: the same two findings, byte for byte, make main red at every commit since e926751 (chore(deps): bump the actions group with 3 updates #1300). That Dependabot bump regenerated the lock in gh actions-lock format v0.0.3. Hypatia's lib/rules/actions_lock.ex accepts only v0.0.2, at the CI pin 51ab6496 and on hypatia main (fd7db07). This PR changes one line in scripts/tests/apply-baseline-test.sh.
• Fix: none has merged yet. Three are open upstream: fix(rules): accept gh actions-lock format v0.0.3 (adds optional dependency hostname) hypatia#927, language-policy.scm v2.0.0 has no wired regression test (needs a decision on guile in CI) #928 and validate-lint-format.sh: Rust and Nickel arms ask a different question than their tool #932. Once one merges, the hypatia-ref defaults in hypatia-scan-reusable.yml and governance-reusable.yml need to move past it, as docs(reorg): work orders v1.4.3 after the reviews on #1298 and #1303 #1303 and the owner comment on fix(lock): complete-job-refs dedupes owner/repo case-insensitively #1294 record. There's nothing to port into this PR until then.
• Not acknowledging it in the baseline, on purpose. Since ci(hypatia): retire the cured invalid_actions_lock ack (#963) #1239 the baseline holds no invalid_actions_lock entry, and apply-baseline-test.sh (the file this PR edits) fails if one is added. This red is that guard working: the old **actions.lock entry would have muted this format break without a trace.

No re-run: the failure is deterministic and already reproduces on main. I'm keeping this PR watched until the upstream fix lands.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T17:29:43.899698Z	a5e826e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Add Carrot credits or activate Agent usage billing to use Autofix