Repository navigation
docs(ultraplan): record the four owner rulings of 2026-10-19 (v0.2.0) - #1309
hyperpolymath wants to merge 9 commits into
Conversation
Ruled through the selector: Wave 1 is pons-native (the elegant arm, departing from the recommended hybrid); the paid neural reviewers are restricted and measured; VeriSimDB's first instance is a stapeln bundle on owned hardware; the fleet's policy interpreter comes before any script leaves exit 78 (the elegant arm, departing from the recommended allowlist). The two departures are written into the waves as consequences rather than absorbed: Wave 1 becomes a two-quarter build with a stated rule order and E4 as its monthly check; the ten idempotent scripts become the interpreter's first work orders; Wave 2 starts from E1 and the ESN schema fix while retraining waits for true outcomes. The Fly.io intent in the verisimdb Intentfile is noted as superseded for the owner to retire there. Validation unchanged: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 37 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
Status: Read from the job log of run 39333517870 on head Cause and fix are as Generated by Claude Code |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9ee47d3d5c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex's review of #1309 found six places where v0.2.0 recorded a ruling in one passage and left the pre-ruling text standing in another. All six are closed: - Wave 0 and E2 name the stapeln bundle on owned hardware as the ruled deployment target instead of presenting Fly.io as an open choice. - The Wave 1 heading says two quarters, matching the summary and ruling. - The Wave 1 deliverables follow the pons-native ruling: the commodity rows are pons rules over new grammars in the ruled order; cicd-suite gains no new checks, only SARIF output and the normaliser for what already runs. - Paid-reviewer retention is conditional on each monthly E4 result. - The k9 work-order contract and its evaluator are a Wave 1 deliverable (the ruled prerequisite for any fleet mutation); Wave 5 moves only their emission to the office, so Wave 2's dependency is satisfied in order. - Wave 3's CNO/OND certificates target the interpreter's first work orders, not the allowlist the ruling declined. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d5e5b56114
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…e ruling Codex's second pass on #1309 found the "estate home" column of the formulaic-checks table still assigning Containerfile to cicd-suite and hadolint, Guix sanity to the governance reusable, formatting to the cicd-suite composite and commit/PR shape to a Danger-style cicd-suite rule set. Under the ruled arm A those are pons rules over new grammars; the four rows now say so, with the existing cicd-suite composite and governance probe named only as what they remain until pons covers them. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f6647c3048
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Guix row: pons owns the syntactic checks; package-name resolution is a `guix build --dry-run` oracle step, orange where Guix is absent, since a parse cannot know the catalogue. - Grammar list: YAML (tree-sitter-yaml; KYAML is a subset) and JSON (tree-sitter-json) added, so the KYAML/JSON shape rules have a parser. - CodeRabbit config: one `reviews.tools.<tool>.enabled: false` per bundled tool (no wildcard exists) and the fully qualified `reviews.pre_merge_checks.docstrings.mode` path the estate file already uses. - Wave 1 deliverables: `formatting` added as a pons rule; secrets and SCA removed from the pons list and the ruling paragraph, since the table already homes them in the secret-scanner reusable and Hypatia supply_chain, so disabling the vendors' bundled linters uncovers nothing. - E4 cutoff judged per reviewer, so an ineffective CodeRabbit or Codex is ended independently. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 972d81ea57
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Config row: canonical-form probes (I-JSON/JCS, KYAML format) stay in the governance reusable; shape rules are pons work over the YAML and JSON grammars; one owner per concern. - Option A records its one exception: an exact tool invoked as a yes/no oracle inside a pons rule (formatter --check, guix build --dry-run) is not a wrapper of another tool's findings; its absence is orange. - Commit and PR rules get parsers: tree-sitter-gitcommit and tree-sitter-markdown pinned. - K2 estimate: two to three quarters, since rescan-verified outcomes arrive only once the Wave 1 evaluator admits its first work orders; E1's replay gives a provisional reading but does not claim the rung. - Codex scoping: AGENTS.md review guidance and an explicit-trigger policy, not repo-settings path filters, which Codex does not have. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e1425dc4b9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…rd oracle Codex's fifth pass on #1309: a grammar can extract a URL but cannot know whether it resolves, so the external link-rot row needed an oracle like the formatter and Guix rows. The table row, option A's exception and the Wave 1 deliverable now name an HTTP reachability probe pons runs itself (HEAD, then GET on 405; cached; rate-limited), orange when the network is absent, with lychee only as a falsifier oracle in the corpus. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8fc6b6eab8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…usive month Codex's sixth pass on #1309: - No universal `--check` exists (`mix format` uses `--check-formatted`, biome formats unless `--write`, as provision-lib.sh already encodes). The formatting row carries the per-formatter mapping; option A's exception and the Wave 1 deliverable say "non-mutating check mode". - A month in which a reviewer was invoked on fewer than 20 sampled PRs is inconclusive for that reviewer and extends retention by a month instead of ending it; the cutoff applies only to a conclusive month. Because Codex is explicit-trigger only, E4 must schedule its invocations deliberately or Codex could never reach a conclusive month. Gates: asciidoctor --failure-level WARN clean; Debtfile todo-fixme-markers 84; link-rot-guard docs/ 278 before and after; git diff --check clean. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PpQVLrCbURpoXtrdvy8V3B
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a9501fcddb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| |Split (ruled 2026-10-19): the *canonical-form* probes (I-JSON/JCS, KYAML | ||
| format) stay in the governance reusable, which already has them and is | ||
| exact; the *shape* rules (required keys, enum values, sequencing of | ||
| sections, cross-file agreement) are pons rules over the YAML and JSON | ||
| grammars; `deed_lint.js` and `k9-validate.sh` keep deed and k9 |
There was a problem hiding this comment.
The row still promises coverage for Nickel configuration errors, but this new ownership split assigns only KYAML/JSON, deed, and k9, leaving Nickel without an estate home or status. This repository already runs a dedicated Nickel format/typecheck lane in .github/workflows/ci-pipeline.yml:343-422; explicitly retain that lane (or assign Nickel elsewhere) so implementers following the table do not omit it from Wave 1's every-row goal.
Useful? React with 👍 / 👎.
| |pons for internal with evidence class; for external, the third oracle: an | ||
| HTTP reachability probe pons runs itself (HEAD, then GET on 405; cached; | ||
| rate-limited), `orange` when the network is absent; `lychee` only as a |
There was a problem hiding this comment.
For an external URL that serves GET successfully but rejects or mishandles HEAD with a status such as 403, 501, or even 404, this algorithm never performs the GET fallback and will report a live link as rotten; 405 is not the only failure used by otherwise reachable servers. Fall back to the rate-limited GET whenever HEAD does not establish reachability, while preserving truly unavailable results as findings.
Useful? React with 👍 / 👎.
| stronger. Codex has no path filter: it is scoped by its documented | ||
| mechanisms instead, a review-guidance section in the repo's `AGENTS.md` | ||
| saying what to review and what to leave to the estate checks, and the | ||
| trigger policy set to explicit `@codex review` only, not automatic | ||
| review on ready-for-review. |
There was a problem hiding this comment.
This now fixes Codex to explicit @codex review, but the implementation checklist at line 1117 still says to “decide Codex's trigger policy,” leaving the selected trigger looking unresolved to whoever executes the cross-repository work. Fresh evidence in the current tree is that stale checklist entry; update it to apply the explicit trigger chosen here rather than reopening the decision.
Useful? React with 👍 / 👎.
| probe for external links) are the exception option A records above. Secrets | ||
| and SCA are not pons rules: they stay with the secret-scanner reusable | ||
| and Hypatia `supply_chain` as the table says. |
There was a problem hiding this comment.
Retaining this reusable does not satisfy Wave 1's stated requirement that every take-back row produce SARIF for the grid: the current .github/workflows/secret-scanner-reusable.yml:311-341 explicitly emits the main Gitleaks findings only to logs with no artifact, and the history pass at lines 385-391 does the same. Fresh evidence beyond the prior retention fix is the retained workflow's actual output path; add SARIF generation and ingestion for these passes, or the secret findings remain absent from the grid after the vendor linters are disabled.
Useful? React with 👍 / 👎.
| |pons `formatting` rule invoking each formatter's non-mutating check mode | ||
| and reporting the diff hunks as findings with evidence class (ruled | ||
| 2026-10-19); the existing cicd-suite `formatting-check` only gains SARIF | ||
| output until then | ||
| |the formatters themselves, each in its own check mode: `rustfmt --check`, | ||
| `mix format --check-formatted`, `zig fmt --check`, `biome format` without | ||
| `--write`, `kyaml-format.sh --check`; the rule carries this mapping, there |
There was a problem hiding this comment.
The promised hunk-level findings cannot be produced uniformly from this command mapping. Fresh evidence after the prior formatter-command fix is scripts/kyaml-format.sh:88-90, where --check emits only a file-level annotation and never outputs the formatted text or a diff, so pons has no hunk data to convert into the stated SARIF findings. Specify a non-mutating temp-copy format-and-diff path for such tools, or explicitly permit file-level findings instead.
Useful? React with 👍 / 👎.
| |pons for internal with evidence class; for external, the third oracle: an | ||
| HTTP reachability probe pons runs itself (HEAD, then GET on 405; cached; | ||
| rate-limited), `orange` when the network is absent; `lychee` only as a | ||
| falsifier oracle in the corpus |
There was a problem hiding this comment.
When pons scans a PR on a runner that can reach private or link-local services, an author-controlled document link can target loopback, RFC 1918/ULA addresses, or a cloud metadata endpoint, and this specified HEAD/GET probe will request it without any address restriction. That turns the lint rule into an SSRF primitive; require HTTP(S)-only URLs, reject private/link-local/loopback resolutions (including every redirect hop), and cap redirects and response bodies before enabling this oracle.
Useful? React with 👍 / 👎.
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9028b65d8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| |pons `.scm` queries over the parsed manifest; package-name resolution is | ||
| a `guix build --dry-run` oracle step the rule shells out to, because a | ||
| parse cannot know the catalogue (that step is `orange` where Guix is absent) |
There was a problem hiding this comment.
Fresh evidence after the resolution-oracle fix is that the named command has no manifest or package operand. The official Guix manual documents the syntax as guix build options package-or-derivation... and requires --manifest=manifest to build entries from a manifest, so guix build --dry-run cannot validate the package names in the repository's guix.scm and may merely fail or inspect nothing. Pass the file with -m guix.scm (or -f guix.scm when it is a package definition) so the promised resolution check actually occurs.
Useful? React with 👍 / 👎.
| complexity; `pons catalogue`; grammars pinned: Elixir, Zig, Julia, | ||
| Idris2, AsciiDoc, Dockerfile, Scheme, YAML (`tree-sitter-yaml`, KYAML is | ||
| a subset), JSON (`tree-sitter-json`), git commit messages | ||
| (`tree-sitter-gitcommit`) and Markdown (`tree-sitter-markdown`, for PR | ||
| titles and bodies); `--diff-base` scoping. The three oracle steps |
There was a problem hiding this comment.
For shell files, the promised missing-doc-comment rule has no parser path: the take-back table includes shell header blocks, while the inventory says pons currently parses only Python, JS/TS/TSX, and Rust, and this exhaustive new grammar list adds every other documented language but not shell. Once CodeRabbit's docstring check is disabled, shell coverage therefore remains unavailable; pin a Bash/shell grammar or specify a non-grammar parser for that part of the rule.
Useful? React with 👍 / 👎.
| pons, resolution via the Guix oracle step), KYAML/JSON shape, external | ||
| link rot, commit-message and PR-convention shape, duplication and | ||
| complexity; `pons catalogue`; grammars pinned: Elixir, Zig, Julia, |
There was a problem hiding this comment.
For non-Python repositories, this implements only two of the four checks in the table's “duplication, dead code, unused imports, complexity” row. The same row says pons currently has only Python dead-store support and relies on clippy/Credo/mix xref elsewhere, but option A disables the vendor tools, rejects wrappers of their findings, and adds no SARIF path for those retained analyzers. Dead-code and unused-import coverage therefore remains absent for languages such as Rust and Elixir despite the every-row Wave 1 goal; add native pons rules or explicitly retain and normalize those analyzer results.
Useful? React with 👍 / 👎.
| `fix-tmp-paths`, `fix-shell-quoting`) become the *first work orders the | ||
| interpreter evaluates*, in `review` tier (draft PRs), rescan-verified, | ||
| licence refusal gate untouched. Consequence of the ruling: true outcome |
There was a problem hiding this comment.
When these first work orders begin running in Wave 1, the rewritten path preserves only the licence gate and drops the previous requirement that every script remain behind Kin. That makes the evaluator's existence the sole condition for leaving exit 78, even though the canonical executor path later in this document is explicitly work order → Kin gate → robot-repo-automaton → rescan; the post-mutation rescan cannot prevent an unsafe action that Kin would have refused. Keep the Kin gate between successful work-order evaluation and every review-tier execution.
Useful? React with 👍 / 👎.
This branch has not been deployed
2 participants
Summary
Follow-up to #1307, which merged the Kautz-ladder ultraplan at v0.1.0 with its four decisions still open. This PR records the rulings the owner gave through the selector on 2026-10-19 and bumps the document to v0.2.0. One file,
docs/ULTRAPLAN-KAUTZ-LADDER-2026-10-19.adoc; 42 insertions, 20 deletions.The two departures from the recommended arm are written into the waves as consequences rather than absorbed (ADR-007, elegance by default: label the departure):
persistent-server-flyintent in verisimdb's Intentfile is noted as superseded, for the owner to retire there (this PR touches no other repo).Branch restarted from
origin/mainafter #1307's squash-merge; this is the one commit beyond it.Testing
asciidoctor --failure-level WARNbash scripts/run-debtfile.sh …/Debtfile.a2mltodo-fixme-markers84 (unchanged);deno-residueis the knownmainbreach WO-8 retiresbash scripts/link-rot-guard.sh docsbefore / aftergit diff --check origin/mainNot done
scan / Hypatia Neurosymbolic Analysis,governance / Validate Hypatia Baseline) is expected red for the reason recorded on docs(ultraplan): Kautz-ladder programme — market inventory, estate rung audit, waves #1307:invalid_actions_lockon.github/workflows/actions.lock(v0.0.3), pre-existing onmainsince chore(deps): bump the actions group with 3 updates #1300, not acknowledged in the baseline per the work-orders file.Generated by Claude Code