Repository navigation
docs(ultraplan): review and plan for the deed, K9 and contractile system - #1313
hyperpolymath wants to merge 1 commit into
Conversation
Measures the machine-readable system across standards, rsr-template-repo, contractiles, contractiles-a2-lab and panoply with the canonical tools (deed_lint.js, k9-validate.sh at L2 with the pinned Nickel 1.18.0, the contractile CLI, the coaptation drift gate), names seven root causes, reviews the 2026-10-19 Copilot conversation on assurance envelopes, exnovation and Panoply, and lays out a four-phase plan with experiments and owner decisions. Headline findings: one word names several artefacts (k9, must, Mustfile, manifest, adjust, dust, bust); panoply holds 134 .deed files of which one lints, renamed rather than translated, and its own gate rejects every .deed; the contractile CLI reads only retired *file.a2ml declarations; coordination.k9 has no validator; deed versions have no reader rule. Design sections are marked PROPOSED. Nothing here is ruled, and no licence, SPDX header or .a2ml file is touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Rp1Fti9phnCG3qrvQJkYEh
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 59 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Add Carrot credits or activate Agent usage billing to use Autofix |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 950ca38fb0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Mustfile", "point the Trustfile at real keys" and so on, so a reader looks for | ||
| files that were deliberately removed. Two further gaps make it look incomplete: | ||
|
|
||
| * the deed has no `(contractiles …)` clause, which D312 requires; and |
There was a problem hiding this comment.
D312 only rules that descriptiles become clauses of <repo>_chora.deed; it does not require a (contractiles …) clause. The repository's D339 entry separately leaves the contractile attestation/layout to an owner ruling, yet P0.3 treats this claimed requirement as approved work rather than an owner-dependent decision. Correct the attribution or gate the template schema change on an explicit ruling.
Useful? React with 👍 / 👎.
| . *P0.2 A gate for renamed files.* A Hypatia rule (standards `hypatia-rules/` | ||
| form pending P2.4, so first as a `governance-reusable` step) that fails any | ||
| `.deed` that does not lint. _Accept:_ fires on panoply's 133, silent on the 7 |
There was a problem hiding this comment.
Adding this check to governance-reusable does not deploy it estate-wide: the repository's measured census says 357 callers pin that workflow to a SHA, 121 do not call it, and only three follow @main. Consequently this P0 step will not fire on affected repositories such as Panoply until consumers are enrolled or repinned, while the only wave is deferred until after P2.1/P2.5. Add an immediate caller rollout or use a mechanism that already reaches those repositories.
Useful? React with 👍 / 👎.
| |K9 files in standards | ||
| |15 |14 | ||
| |The frozen archive copy only. |
There was a problem hiding this comment.
The 15-file standards corpus includes both coordination.k9 and 2-protocols/k9-coordination/examples/minimal.k9; k9-validate.sh returns verdict: routed for each and does not validate their contents, as the later coordination row acknowledges. Counting both among the 14 passes therefore overstates coverage; assuming the other measurements are unchanged, this should distinguish 12 validated passes, two routed files, and the archived failure.
Useful? React with 👍 / 👎.
| . An instance declares the *schema major.minor* it was written against | ||
| (`:schema-version "1.2"` for a deed, `pedigree.schema_version` for K9, | ||
| `metadata.schema_version` for coordination). |
There was a problem hiding this comment.
This proposed common major.minor instance shape is not the rule used by K9: K9-S002 requires a numeric MAJOR.MINOR.PATCH dot-triple, and the conformance corpus explicitly rejects schema_version = "1.0". If Q5 is implemented uniformly from this text, the resulting K9 components will fail the canonical validator. Keep the three-segment K9 representation or explicitly make the representation format-specific.
Useful? React with 👍 / 👎.
| |Q9 |Template contractiles leash (from #247) |(E) `'Yard`: the record declares, | ||
| the runner executes; `'Hunt` with signed records. |
There was a problem hiding this comment.
The recommended Yard arm conflicts with the K9 security contract: Yard permits only pure Nickel evaluation and explicitly forbids filesystem, network, subprocess, recipe, and must-shim execution, while a host must apply the leash before any side effect. Letting the paired runner execute probes while its record declares Yard moves those effects outside the Hunt five-precondition authorization gate. Executing contractiles need a Hunt request and its runtime evidence, rather than a Yard declaration with an independently executing runner.
Useful? React with 👍 / 👎.
| `declaration` fields, not Verbfiles; add the `(contractiles …)` clause with six | ||
| verbs; make `:contractiles_required` list six. _Accept:_ `deed_lint.js` OK; a | ||
| grep for "Mustfile" in the contractiles README returns only the build-system |
There was a problem hiding this comment.
The stated acceptance check cannot establish the change it is meant to accept: deed_lint.js permits arbitrary field and clause names and semantically checks only the document head, filename dispatch, and presence/type of :schema-version. It will stay green if (contractiles …) is absent, if either attestation contains fewer than six verbs, or if the two lists disagree. Add a semantic assertion or fixture that extracts and compares both six-verb attestations.
Useful? React with 👍 / 👎.
| * Every `*file.a2ml`, `*.manifest.a2ml`, `INDEX.a2ml` and `.contractile` file in | ||
| standards' own contractiles, once the deed-era runner reads the K9 form (P2.1). |
There was a problem hiding this comment.
P2.1 only teaches the CLI to read a declaration field, but none of standards' six current <verb>.k9.ncl files contains that field; each still points at its paired A2ML xfile. Moreover, the required .github/workflows/k9-contractile.yml gate directly runs the A2ML structure/execution scripts and discovers files through INDEX.a2ml. Deleting the listed files as soon as the new CLI exists would therefore discard standards' declaration data and make its required check fail. Add an explicit standards conversion and gate-rewiring step before this deletion.
Useful? React with 👍 / 👎.
This branch has not been deployed
2 participants
Summary
The owner asked for a proper review of the deed / K9 / contractile / descriptile system across the estate, a review of the 2026-10-19 Copilot conversation on assurance envelopes, exnovation and Panoply, and an ultraplan. This PR adds one file:
docs/ULTRAPLAN-DEED-K9-CONTRACTILES-2026-10-19.adoc(v0.1.0, DRAFT). Nothing in it is ruled. Sections marked PROPOSED are design, written to be reviewed by a second reader.Measured with the canonical tools, not from status documents:
deed_lint.js,k9-validate.sh --layer L2 --strictwith the estate-pinned Nickel 1.18.0 (SHA-256 verified), the contractile CLI built from source, and the template's coaptation drift gate.coordination.k9Root causes named in the document:
k9,must,Mustfile,manifest, and two or three live meanings each foradjust,dustandbust..deed, and its CI gate edited so it fails on every.deed.*file.a2ml.coordination.k9, and templates come from four sources.On the Copilot model: the arithmetic is verified correct. The likelihoods are invented, though, and doubling two of them moves the verdict from "exnovate" to "review". Four formulas have demonstrated defects. The AffineScript-to-Panoply history contradicts Panoply's own README. The envelope shape is kept as a typed
(claims …)clause using the constitution's six labels.The plan builds on hyperpolymath/rsr-template-repo#247 and hyperpolymath/rsr-template-repo#248 rather than redoing them. It has four phases: P0 stop the bleeding, P1 sort out and differentiate, P2 design and develop, P3 deploy. It also lists seven experiments with falsifiers, nine owner decisions (Q1–Q9), and a beyond-this-repo list.
Testing
.githooks/pre-commit(with gitleaks 8.18.4 and mikefarah yq v4.44.3, both checksum-verified)asciidoctor --failure-level WARNscripts/check-canonical-names.sh origin/mainscripts/link-rot-guard.sh docsNot done
.a2mlfile is touched.Generated by Claude Code