Branch protection: required context "Hypatia Neurosymbolic Analysis" never matches (blocks all merges)

Problem

main branch protection lists Hypatia Neurosymbolic Analysis (bare name) as a
required status check. No check actually reports under that exact name — the Hypatia
workflow reports its check-run as hypatia / Hypatia Neurosymbolic Analysis (job
prefix) and Hypatia. Both pass, but neither matches the required bare context, so
every PR is permanently mergeStateStatus: BLOCKED even when all real checks are green.

Verified on PR #16 (head a2267b5): all 7 required contexts satisfied except
Hypatia Neurosymbolic Analysis, while hypatia / Hypatia Neurosymbolic Analysis :: success
and Hypatia :: success both ran. enforce_admins is false, so only an admin override
can currently land a PR.

Fix (pick one)

Update branch protection — replace the required context
Hypatia Neurosymbolic Analysis with hypatia / Hypatia Neurosymbolic Analysis
(the name actually reported), or
Rename the workflow job so the reported check-run name is the bare
Hypatia Neurosymbolic Analysis.

Option 1 is the smaller change and matches how the governance / * contexts are already
named in the policy.

Impact

Blocks PR #16 (Lean tropical migration — all checks green, commits GPG-verified). Likely
affects every PR to this repo. Estate-wide check: other repos that adopted the same
protection + hypatia wrapper naming may have the identical latent block.

Closing evidence, 2026-09-20.

Diagnosis confirmed

A job that calls a reusable workflow publishes <caller job id> / <inner job display name>; a plain job publishes its own name:. main required the bare Hypatia Neurosymbolic Analysis, which no wrapper can ever publish — so the required check was never satisfied while every real check passed. This repository published scan / Hypatia Neurosymbolic Analysis, exactly the wrapper-prefix class catalogued in standards docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc.

Current state of the requirement (read from the API today)

legacy branch protection on main: required_status_checks.enforcement_level = "off", contexts: [];
the Base ruleset carries required_signatures, deletion, pull_request, non_fast_forward — no required_status_checks rule.

So nothing is blocked today, and nothing is enforced either. Arming a required check is now possible for the first time: the canonical string is producible, and the exact command is in docs/CI-CONTEXTS.adoc.

Fix landed

#52 — caller job scan → hypatia, so the published context is the estate-canonical hypatia / Hypatia Neurosymbolic Analysis; verified green on the PR (hypatia / Hypatia Neurosymbolic Analysis :: success) and on main (merge commit 547ece5, GPG-verified by GitHub).

#53 — follow-up: the contract job referred to the secrets context, which the Hypatia scanner flags as RE001 (and step-security/harden-runner is not in the estate allowlist, so it cannot be satisfied that way); it now uses github.token.

The class cannot silently return

.machine_readable/CI-CONTEXTS.a2ml records which caller ids publish which context strings, what may be armed, and the strings that can never be satisfied.
tools/check-ci-contexts.sh (run by .github/workflows/ci-contexts.yml on every push and PR) fails the build when the caller id and the contract drift apart, and reports any required context no workflow can publish — naming the exact replacement when it sees the bare form.
docs/CI-CONTEXTS.adoc documents the naming rule, the current published names, and both honest remediations.

feat(ci): gate on required status contexts nothing can publish (#869)

fix(audit): correct the census total to 333, and the stale #17 tense …

Closing evidence, verified against the live repository rather than the workflow files.

The blocking condition is gone, and was gone before the fix. GET /repos/hyperpolymath/tropical-types/branches/main reports protected: true but protection.enabled: false with required_status_checks.enforcement_level: "off" and an empty contexts list; the active Base ruleset (14936606) carries no required_status_checks rule. So no required context — satisfiable or not — was gating main. The concrete state at the time of the original report cannot be recovered from the API (the legacy protection endpoint answers 401/403 to a non-admin credential), which is itself the reason this ran undetected.

The latent root cause is fixed rather than papered over.

the canonical name is published: the wrapper caller job is hypatia, so the check run is hypatia / Hypatia Neurosymbolic Analysis (confirmed in the check-run list on main);
the bare Hypatia Neurosymbolic Analysis — the string the earlier rule named — is not published here, and is not required by anything, so the repository is consistent: a rule naming a bare inner name can only be satisfied by implementing the check in-repo rather than calling the reusable (the pattern hyperpolymath/defiant uses), and this repository deliberately does not do that;
docs/CI-CONTEXTS.adoc + .machine_readable/CI-CONTEXTS.a2ml + tools/check-ci-contexts.sh record the contract and refuse a workflow that stops publishing the canonical string (sabotage-tested: renaming the caller job exits 1);
main is green: 22 check runs, 0 failing, including hypatia / Hypatia Neurosymbolic Analysis, Required contexts are producible and lake-build.

The class is now gated upstream. hyperpolymath/standards gained
scripts/check-required-contexts.sh (#869, corrected in #871) — it derives the names a repository's workflows can publish, reads what its rules actually require, and reports any context that nothing can publish. A census over all 365 non-archived public repositories found the class nearly extinct: 333 required contexts, 5 unsatisfiable, all five repository-owned job names in four other repositories (awesome-gleam ×2, casket-ssg, coord-tui, vext), each re-checked against the ruleset that carries it. tropical-types is not among them.

The audit recording all of this is docs/audits/audit-ci-context-producibility-2026-09-20.adoc in hyperpolymath/standards, and it supersedes the wrapper-prefix item in audit-hypatia-pin-orphan-2026-05-27.adoc.

ci(hypatia): standardise the wrapper caller id to the canonical `hypa…

fix(ci): grant the wrapper the permissions the reusable declares (#60)

fix(ci): grant the wrapper the permissions the reusable declares (#100)

fix(ci): grant the wrapper the permissions the reusable declares (#9)

fix(ci): grant the wrapper the permissions the reusable declares (#95)

fix(ci): grant the wrapper the permissions the reusable declares (#72)

fix(ci): grant the wrapper the permissions the reusable declares (#69)

ci(hypatia): standardise the wrapper caller id to the canonical `hypa…

ci(hypatia): standardise the wrapper caller id to the canonical `hypa… (

Navigation Menu

Repository navigation

Branch protection: required context "Hypatia Neurosymbolic Analysis" never matches (blocks all merges) #17

Problem

Fix (pick one)

Impact

Diagnosis confirmed

Current state of the requirement (read from the API today)

Fix landed

The class cannot silently return

189 remaining items

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Branch protection: required context "Hypatia Neurosymbolic Analysis" never matches (blocks all merges) #17

Description

Problem

Fix (pick one)

Impact

Activity

hyperpolymath commented on Sep 20, 2026

Diagnosis confirmed

Current state of the requirement (read from the API today)

Fix landed

The class cannot silently return

hyperpolymath commented on Sep 20, 2026

189 remaining items

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions