hyperpolymath · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
@@ -4,7 +4,7 @@
 
 Every pull request in this repository gets one generated comment, marked
 `<!-- fork-governance-verdict: regenerated on every run -->`. It reports three
-lanes in a fixed order: summary, **k9-deed conformance**, **Hypatia verdict
+lanes in a fixed order: summary, **K9-DEED conformance**, **Hypatia verdict
 grid**. The comment is produced by `.github/workflows/fork-governance.yml`
 (lanes) and `.github/workflows/fork-governance-reusable.yml` (posting).
 

@@ -14,7 +14,7 @@ lanes, in this order:
 |===
 | Lane | What it tells you
 | DEED syntax | whether the repository's `.deed` self-description still parses
-| k9-deed conformance | whether its committed K9 contracts pass layers L0–L2
+| K9-DEED conformance | whether its committed K9 contracts pass layers L0–L2
 | Hypatia verdict grid | what the scanners ran and what each of them reported
 |===
 

@@ -4,8 +4,8 @@
 # fork-governance-reusable.yml — post the Fork governance summary on a pull
 # request, with the lanes in a fixed order:
 #
-#   1. summary        DEED syntax · k9-deed conformance · Hypatia verdict grid
-#   2. k9-deed conformance grid
+#   1. summary        DEED syntax · K9-DEED conformance · Hypatia verdict grid
+#   2. K9-DEED conformance grid
 #   3. Hypatia verdict grid
 #
 # This workflow POSTS; it does not run the lanes. A reusable cannot read the
@@ -69,6 +69,14 @@ on:
         type: string
         required: false
         default: "verdict-grid"
+      hypatia-advisory:
+        description: >-
+          needs.<hypatia job>.outputs.advisory — `<state>:<critical>:<high>`
+          or `none`. Shown beside the verdict so an advisory critical is
+          visible without being able to grade the change. Empty is fine.
+        type: string
+        required: false
+        default: ""
       grid-author:
         description: "The account whose previous comment is read as the baseline. Only this account's comment is trusted."
         type: string
@@ -143,6 +151,7 @@ jobs:
           K9_VERDICT: ${{ inputs.k9-verdict }}
           HYPATIA_RESULT: ${{ inputs.hypatia-result }}
           HYPATIA_VERDICT: ${{ inputs.hypatia-verdict }}
+          HYPATIA_ADVISORY: ${{ inputs.hypatia-advisory }}
         run: |
           set -euo pipefail
           case "${{ github.repository }}" in
@@ -154,6 +163,7 @@ jobs:
                 --deed-result "$DEED_RESULT"
                 --k9-result "$K9_RESULT" --k9-verdict "$K9_VERDICT"
                 --hypatia-result "$HYPATIA_RESULT" --hypatia-verdict "$HYPATIA_VERDICT"
+                --hypatia-advisory "${HYPATIA_ADVISORY:-}"
                 --sha "$GITHUB_SHA" --run "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY")
           [ -s k9-grid/report.md ] && args+=(--k9-report k9-grid/report.md)
           [ -s verdict-grid/report.md ] && args+=(--hypatia-report verdict-grid/report.md)

@@ -5,8 +5,8 @@
 #
 # Every pull request gets one comment, regenerated in place, carrying:
 #
-#   1. the summary        DEED syntax · k9-deed conformance · Hypatia verdict
-#   2. k9-deed conformance grid
+#   1. the summary        DEED syntax · K9-DEED conformance · Hypatia verdict
+#   2. K9-DEED conformance grid
 #   3. Hypatia verdict grid
 #
 # THIS WORKFLOW IS THE SINGLE PR-TIME ENTRY POINT for the three lanes. The lane
@@ -56,7 +56,7 @@ jobs:
       require-files: true
 
   k9:
-    name: k9-deed conformance
+    name: K9-DEED conformance
     uses: ./.github/workflows/k9-conformance.yml
     permissions:
       contents: read
@@ -98,3 +98,4 @@ jobs:
       k9-verdict: ${{ needs.k9.outputs.verdict }}
       hypatia-result: ${{ needs.hypatia.result }}
       hypatia-verdict: ${{ needs.hypatia.outputs.verdict }}
+      hypatia-advisory: ${{ needs.hypatia.outputs.advisory }}
@@ -20,6 +20,16 @@ on:
         type: string
         required: false
         default: ubuntu-latest
+      baseline-strict:
+        description: >-
+          Fail when an acknowledgement in .hypatia-baseline.json carries no
+          `expires_at`. Default false: an undated entry is REPORTED but does
+          not fail, so this is adoptable by repositories mid-migration. A
+          repository that has dated all of its entries should turn it on —
+          otherwise the undated ones it already fixed can silently come back.
+        type: boolean
+        required: false
+        default: false
     secrets:
       HYPATIA_SCAN_PAT:
         description: Fine-grained token with repository Administration read access
@@ -1679,11 +1689,38 @@ jobs:
           # Both files: the ratchet calls count-ledger-entries.sh as a sibling,
           # and it has no fallback if the counter is missing — deliberately.
           cp .standards-checkout/scripts/check-exemption-ratchet.sh \
-             .standards-checkout/scripts/count-ledger-entries.sh "$RUNNER_TEMP/"
+             .standards-checkout/scripts/count-ledger-entries.sh \
+             .standards-checkout/scripts/check-baseline-expiry.sh "$RUNNER_TEMP/"
           rm -rf .standards-checkout
           bash "$RUNNER_TEMP/check-exemption-ratchet.sh" \
             "${{ github.event.pull_request.base.sha }}"
 
+      # The ratchet stops NEW undated debt; this reports the debt already
+      # there. They are different jobs on purpose: the ratchet is a gate and
+      # must fail, this is a forecast and must not — a repository with 200
+      # undated legacy entries cannot be asked to fix them in the PR that
+      # happens to notice. `baseline-strict` is the switch a migrated
+      # repository flips once, and this repository has flipped it.
+      - name: Forecast baseline expiry
+        if: ${{ always() }}
+        continue-on-error: ${{ ! inputs.baseline-strict }}
+        env:
+          STRICT: ${{ inputs.baseline-strict }}
+        run: |
+          set -uo pipefail
+          if [ ! -f .hypatia-baseline.json ]; then
+            echo "No .hypatia-baseline.json — nothing is acknowledged, nothing expires."
+            exit 0
+          fi
+          args=(--quiet --warn-days 60)
+          if [ "$STRICT" != "true" ]; then
+            args+=(--allow-undated)
+          fi
+          # Intentionally NOT `set -e`: an expired or undated entry must not
+          # hide the forecast for the rest, so the script runs once and its
+          # exit code is the step's.
+          bash "$RUNNER_TEMP/check-baseline-expiry.sh" "${args[@]}"
+
   debt-ratchet:
     name: Debt ratchet
     runs-on: ${{ inputs.runs-on }}

@@ -17,6 +17,12 @@ permissions:
 jobs:
   governance:
     uses: ./.github/workflows/governance-reusable.yml
+    with:
+      # This repository dates every acknowledgement (2026-10-24: 63/63), so an
+      # undated one is a regression, not legacy debt. Without this a future
+      # entry added without a date would be warned about and ignored — which is
+      # how the 23 got there in the first place.
+      baseline-strict: true
     # Only the one secret the callee declares (optional). Was `secrets:
     # inherit`, which forwarded every repo/org secret (standards#1108
     # §6b); narrowed to the callee's declared contract.

@@ -12,6 +12,16 @@ on:
         type: boolean
         required: false
         default: false
+      scope-excludes:
+        description: >-
+          Comma-separated path prefixes that are reported but NEVER graded, and
+          whose SARIF is not uploaded: frozen history that cannot be edited
+          without falsifying the record. Default 9-archive/ -- matching the
+          CodeQL config, which already ignores the same tree. Set to an empty
+          string to grade everything.
+        type: string
+        required: false
+        default: "9-archive/"
       hypatia-ref:
         description: >-
           Hypatia commit to build the scanner from. Defaults to a vetted SHA so a
@@ -33,10 +43,18 @@ on:
     outputs:
       verdict:
         description: >-
-          Overall state of the lane's verdict grid (docs/VERDICT-GRID-SPEC.adoc):
-          purple, red, orange, yellow, blue, green or grey. Callers that comment
-          on or gate from the grid read this and the verdict-grid artifact.
+          Overall state of the lane's verdict grid, computed over GATING rows
+          only (docs/VERDICT-GRID-SPEC.adoc): purple, red, orange, yellow,
+          blue, green or grey. Advisory rows are reported in the grid and in
+          `advisory`, and never set this.
         value: ${{ jobs.scan.outputs.verdict }}
+      advisory:
+        description: >-
+          Advisory rows in the report, as `<state>:<critical>:<high>`, or
+          `none` when the lane has no advisory reporter. Empty when the grid
+          did not render. Callers show this beside the verdict so that an
+          advisory critical is visible WITHOUT being able to grade the change.
+        value: ${{ jobs.scan.outputs.advisory }}
 
 permissions:
   actions: read
@@ -53,6 +71,7 @@ jobs:
     timeout-minutes: 45
     outputs:
       verdict: ${{ steps.grid.outputs.state }}
+      advisory: ${{ steps.grid.outputs.advisory }}
     env:
       # panic-attack v2.5.5, built from source at this commit (cargo --rev
       # checks out exactly this object; --locked holds every dependency to the
@@ -538,6 +557,30 @@ jobs:
           APPLY_BASELINE=scripts/apply-baseline.sh \
             bash "$FILTER" hypatia.sarif hypatia-findings.relativized.json .hypatia-baseline.json
 
+      # ── Scope: keep frozen history out of code scanning ───────────────────
+      # Runs AFTER the baseline filter, so the two cannot disagree about which
+      # results survive: the baseline removes acknowledged results, this removes
+      # a declared out-of-scope prefix. A finding that is both is removed once
+      # and by the second pass, which is idempotent.
+      #
+      # Fails OPEN: an unfiltered upload shows more alerts, never fewer.
+      - name: Filter SARIF by declared scope
+        id: filter_scope
+        run: |
+          set -uo pipefail
+          SCOPE_EXCLUDES="${{ inputs.scope-excludes }}"
+          [ -z "$SCOPE_EXCLUDES" ] && { echo "  no scope exclusions declared"; exit 0; }
+          if [ -f .standards-checkout/scripts/filter-sarif-by-scope.sh ]; then
+            FILTER=.standards-checkout/scripts/filter-sarif-by-scope.sh
+          elif [ -f scripts/filter-sarif-by-scope.sh ]; then
+            FILTER=scripts/filter-sarif-by-scope.sh
+          else
+            echo "  ::warning::scope filter unavailable — SARIF uploaded unfiltered"
+            exit 0
+          fi
+          IFS=',' read -r -a _prefixes <<< "$SCOPE_EXCLUDES"
+          bash "$FILTER" hypatia.sarif hypatia.sarif "${_prefixes[@]}"
+
       - name: Upload SARIF to code scanning
         # NOTE: this does NOT make under-permissioned callers "skip gracefully".
         # This workflow declares `security-events: write` at the top, so a
@@ -590,6 +633,42 @@ jobs:
             scripts/lib/verdict-grid.jq
           sparse-checkout-cone-mode: false
 
+      # ── Scope: what the grid is allowed to GRADE ──────────────────────────
+      # Without this the grid grades the whole repository, so its verdict is a
+      # property of the REPOSITORY and not of the pull request: every revision
+      # scores the same, and a comment that never changes is not read. Delta
+      # mode grades only findings in files the change touches; everything else
+      # is still counted and named in the comment, never hidden.
+      #
+      # Falls back to whole-repository scope when the base commit cannot be
+      # resolved (a push, a force-push, a shallow clone). A fallback that
+      # silently NARROWED the scope would be the dangerous direction; this one
+      # only ever widens it.
+      - name: Compute the change scope
+        id: scope
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          SCOPE_EXCLUDES: ${{ inputs.scope-excludes }}
+        run: |
+          set -uo pipefail
+          : > "$RUNNER_TEMP/changed.txt"
+          mode=whole-repo
+          case "$BASE_SHA" in
+          '') : ;;
+          *)
+            if git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null || git fetch --quiet origin "$BASE_SHA" 2>/dev/null; then
+              base=$(git merge-base "$BASE_SHA" "$HEAD_SHA" 2>/dev/null) || base="$BASE_SHA"
+              if git diff --name-only "$base" "$HEAD_SHA" > "$RUNNER_TEMP/changed.txt" 2>/dev/null; then
+                mode=delta
+              fi
+            fi
+            ;;
+          esac
+          n=$(grep -c . "$RUNNER_TEMP/changed.txt" 2>/dev/null || true)
+          echo "mode=$mode" >> "$GITHUB_OUTPUT"
+          echo "scope: $mode (${n:-0} changed file(s), excluded: ${SCOPE_EXCLUDES:-none})"
+
       - name: Read the previous verdict grid
         if: ${{ always() && github.event_name == 'pull_request' }}
         # Best effort: the token may lack pull-request read on the caller. A
@@ -611,6 +690,8 @@ jobs:
           HYPATIA_REF: ${{ steps.hypatia-rev.outputs.sha }}
           PR_NUMBER: ${{ github.event.pull_request.number || 'local' }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          SCOPE_MODE: ${{ steps.scope.outputs.mode }}
+          SCOPE_EXCLUDES: ${{ inputs.scope-excludes }}
         run: |
           set -uo pipefail
           renderer=.standards-grid/scripts/verdict-grid.sh
@@ -632,14 +713,34 @@ jobs:
           # The renderer appends the grid to the step summary and writes
           # state= to GITHUB_OUTPUT itself; its exit code is 0 for any
           # rendered verdict and 2 only for a usage error.
+          # Scope: delta when the change scope step resolved a base commit,
+          # whole-repository otherwise. A missing changed.txt with mode=delta
+          # is a usage error inside the renderer, not a silent fallback.
+          scope_args=()
+          [ "${SCOPE_MODE:-}" = "delta" ] && scope_args+=(--changed "$RUNNER_TEMP/changed.txt")
+          # Prefixes from the caller; empty means grade everything.
+          IFS=',' read -r -a _ex <<< "${SCOPE_EXCLUDES:-}"
+          for _p in "${_ex[@]}"; do
+            [ -n "$_p" ] && scope_args+=(--exclude-prefix "$_p")
+          done
           bash "$renderer" render --out verdict-grid \
             --hypatia "$findings" --panic panic-attack-findings.json --pons pons-findings.json \
             --report-backs .gitbot-fleet/report-backs --enrolment "$enrolment" \
             --previous "$RUNNER_TEMP/grid-previous.md" \
             --sha "$HEAD_SHA" --run "$GITHUB_RUN_ID" \
             --url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
             --pr "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
-            --hypatia-ref "$HYPATIA_REF" --panic-ref "$PANIC_ATTACK_SHA" --pons-ref "$PONS_SHA" > /dev/null
+            --hypatia-ref "$HYPATIA_REF" --panic-ref "$PANIC_ATTACK_SHA" --pons-ref "$PONS_SHA" \
+            "${scope_args[@]}" > /dev/null
+          # Advisory summary, for callers that show it beside the verdict. The
+          # verdict output is written by the renderer and covers GATING rows
+          # only; without this a caller would state "green" and omit the four
+          # advisory criticals sitting directly beneath it.
+          if [ -s verdict-grid/report.json ]; then
+            adv=$(jq -r 'if (.advisory.rows // 0) == 0 then "none"
+                         else "\(.advisory.state):\(.advisory.critical):\(.advisory.high)" end' verdict-grid/report.json)
+            echo "advisory=$adv" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Upload the verdict grid
         if: ${{ always() }}

@@ -57,7 +57,7 @@ on:
       - 'scripts/tests/k9-grid-test.sh'
       - '.machine_readable/k9-contract-debt.txt'
       - '.github/workflows/k9-conformance.yml'
-  # No `pull_request` trigger: PR-time k9-deed conformance runs inside
+  # No `pull_request` trigger: PR-time K9-DEED conformance runs inside
   # fork-governance.yml, once, for every PR. The push trigger below still
   # catches a direct commit to main that touches the corpus.
   workflow_call: