Fix/token permissions id 20260911 - #25
Open
hyperpolymath wants to merge 3 commits into
Open
Conversation
…the rest
Estate top-up pass. Three separate things, none of which invents a value.
FILLED — every token with a single mechanical answer: OWNER, REPO, FORGE,
PROJECT, PACKAGE_NAME, PROJECT_NAME, AUTHOR, AUTHOR_EMAIL, CONDUCT_EMAIL,
AUTHOR_FIRST/LAST/INITIALS, CURRENT_YEAR, CURRENT_DATE, DATE, MAIN_BRANCH.
Identity comes from the git remote, dates from the clock, project name from the
README H1 where there is one.
Deliberately NOT filled, because more than one defensible answer exists and a
confident wrong value is worse than a visible gap: SECURITY_EMAIL (two competing
addresses are in use across the estate), RESPONSE_TIME, CONDUCT_TEAM (which
substitutes into "a {{CONDUCT_TEAM}} member", not English), WEBSITE,
PROJECT_DESCRIPTION, LANG_STACK.
DELETED — ARCHITECTURE.md, where it is byte-identical to the 346-copy estate
boilerplate (blob 607e3d8). Those 33 lines describe a src/ tests/ docs/
scripts/ config/ tree that this repo does not have, so the file is not merely
uninformative, it is wrong. Genuinely written ARCHITECTURE files are matched by
hash and left alone. No file beats a confidently false one.
CODEOWNERS — rewritten to the solo form mandated by
hyperpolymath/standards CODEOWNERS-POLICY.adoc Rule 1, which forbids a catch-all
line where the only owner is the sole maintainer. The estate's own
templates/CODEOWNERS contradicts that policy; the policy is versioned, dated and
resolves standards#55, so it wins. Files naming a genuine co-owner are Rule 2
and are untouched. Note @hyperpolymath and @metadatastician are the same person,
so a file naming the other account is a copy artifact that silently routed
review requests to the wrong account.
SURFACED — REQUIRES_INITIALISATION.md, and a priority action in
0-AI-MANIFEST.a2ml. Tokens that need a decision no script can make are left
visibly unfilled rather than faked or quietly deleted. The marker says what each
one is, which files it belongs in, why it was not done already, and that it must
be deleted only once the work is genuinely finished.
Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (5)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details🔇 Additional comments (4)
📝 SummarySummary by CodeRabbit
WalkthroughThe pull request updates repository ownership metadata, documents required initialisation, replaces conduct email placeholders, and changes the Lean workflow to fail on any unsuccessful test command. ChangesRepository maintenance
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Merge Risk: ⚪ Minimal · up to No actionable merge-blocking risk remains in the reviewed changes. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the test-run light Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
hyperpolymath
enabled auto-merge (squash)
September 12, 2026 15:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #
Type of change
How has this been verified?
Checklist
git commit -S).SPDX-License-Identifier(code/configMPL-2.0,prose
CC-BY-SA-4.0); I did not relicense existing files.Notes for reviewers