Fix/ci 426 batch12 krl - #77
Open
hyperpolymath wants to merge 17 commits into
Open
Conversation
…w calls A timeout-minutes: key was set on one or more jobs that call a reusable workflow via uses:. GitHub does not permit that key on a workflow_call job, so it rejected the file at parse time — the workflow failed instantly (0s) on every push and never ran. The standards *-reusable.yml workflows already declare timeout-minutes on their internal jobs, so the caller key was redundant as well as invalid. Files: .github/workflows/rust-ci.yml Verified with actionlint (real tool): no "timeout-minutes is not available" findings remain. Part of the estate-wide CI cleanup (84 repos; reference hyperpolymath/gitbot-fleet#374). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…kflows
All three workflows in this repo that GitHub refused to parse are fixed, and
the gates they were meant to run are made real. Every claim below was verified
by executing the thing, not by reading it.
Workflows (actionlint: 3 errors -> 0)
* e2e.yml had an entirely commented-out `jobs:` section, so the file was
rejected with "jobs section should not be empty". It now runs four real
jobs against the checked-in scripts.
* boj-build.yml used the `secrets` context in a job-level `if:`, where only
`github`, `inputs`, `needs` and `vars` are available. The gate is removed
rather than narrowed to `vars`, which would have silently skipped the
secret-configured case; the step already exits 0 when the URL is unset,
which is the documented no-op behaviour.
* dogfood-gate.yml embedded Python at column 0 inside a `run: |` block
scalar whose indentation was fixed at 10 spaces, terminating the scalar
and breaking the YAML. Replaced with a quoted heredoc, which also removes
the `\"` escaping that provoked the dedent. Verified by extracting the step
and running it against no-manifest / valid / invalid inputs (0 / 0 / 1).
FFI (did not compile at all)
* src/interface/ffi/src/main.zig declared `pub const Handle = opaque { ... }`
with fields. Zig opaque types cannot carry fields, so the shim had never
compiled. C consumers only ever hold a `*Handle`, so a plain struct is
ABI-identical; this matches the fix already applied in rpa-elysium.
* `callconv(.C)` was removed in Zig 0.16; now `callconv(.c)`.
* build.zig was scaffolding that wired no steps. `zig build` now produces
libkrl.a and `zig build test` runs the three unit tests (3/3 pass).
Gates that could not fail
* tests/aspect_tests.sh grepped src/abi/ and ffi/zig/, neither of which
exists here (the real paths are src/interface/Abi and src/interface/ffi),
so its Idris check passed vacuously. It now fails loudly when the scan set
is empty, rather than reporting success for having looked at nothing.
* The same script flagged verification/proofs/README.adoc for containing the
words `sorry` and `unsafeCoerce` while documenting them as banned. Scanning
is now restricted to source files, with comment lines excluded.
* Aspect 3 (ABI/FFI correspondence) was commented out and its paths were
wrong. Enabled: 4 %foreign declarations covered by 11 Zig exports.
* tests/e2e.sh was entirely TODO and reported PASS=0 FAIL=0 while exiting 0.
It now runs four checks. Negative-controlled: injecting a fault into an
exported function yields FAIL=2 and exit 2.
Licensing
* Reconciled the three unpushed sweeper commits against canonical SPDX text
rather than against each other. origin/main's CC-BY-SA-4.0.txt is already
byte-exact canonical; the sweeper's +474/-110 rewrite substituted the
Creative Commons plaintext variant and was a regression, so it is dropped.
* Neither version of MPL-2.0.txt was canonical (origin/main had http:// where
SPDX has https://; the sweeper stripped a significant trailing space).
Replaced with the canonical SPDX text. Both files now match byte for byte.
* LICENSES/AGPL-3.0-or-later.txt is dropped. It contradicts this repo's own
.machine_readable/compliance/rust/deny.toml, no file carries an AGPL SPDX
header, and `reuse lint` reports it as "Unused licenses: AGPL-3.0-or-later".
* trailing-whitespace and end-of-file-fixer now exclude LICENSES/. Both
canonical texts contain significant trailing whitespace, so the hooks were
guaranteed to corrupt them on every commit. This is the mechanism behind
that class of damage.
* The rest of the sweeper's output is dropped: ARCHITECTURE.md was generic
boilerplate describing a src/tests/docs/scripts/config layout this repo
does not have (and was byte-identical to the one it added to tangle);
GOVERNANCE.md, MAINTAINERS and .github/funding.yml duplicate the existing
GOVERNANCE.adoc, MAINTAINERS.adoc and .github/FUNDING.yml; mise.toml pinned
30 tools to "latest" and collided with .tool-versions.
Also
* .pre-commit-config.yaml had a truncated secret-detection block with no
`- repo:` key. YAML last-key-wins silently overwrote editorconfig-checker's
rev with v8.24.3 and set its hooks to null, so gitleaks was absent and one
hook pointed at a non-existent tag. Restored. Eighteen other repos in the
estate share this exact truncation.
* .tool-versions pinned `rust nightly` -- the one language absent from this
repo -- while zig and idris2 sat commented out. Corrected.
* zig-out/ added to .gitignore.
The three projects are distinct and were built for different purposes. QuandleDB is the knot database. KRL is its resolution language, developed alongside it. Tangle is a separate, general language for knot mathematics that happens to share the subject matter. Documentation in this repository had fused KRL and Tangle into a single compilation pipeline that does not exist. README.md * Removed the claim that KRL "lowers through TangleIR into Tangle-level computation", and the layer table presenting Tangle as KRL's substrate. `TangleIR` appears 0 times in the KRL implementation; the struct definitions the README documented as "the single hardest-designed artifact in the stack" correspond to no code. * Removed `KRLAdapter.jl` as the named canonical implementation. It no longer exists. A short note records that both claims were false, so the correction is legible rather than silent. * Removed the `TanglePL` usage example, which imports packages that do not exist. * Restated what the repository actually holds, and what it does not: there is no parser here, so nothing in this tree can execute a KRL program. * Added the known divergence between this repository's grammar and QuandleDB's — disjoint on core vocabulary, with `|` bound to opposite meanings. * Restructured to a single <h1>. Ddraig SSG certifies pages against a decidable a11y predicate requiring exactly one <h1> and no heading-level skips; the old README had 8, which is why GitHub Pages was failing. Verified by compiling Ddraig locally and running it: old README FAIL (exit 1), new README ok (exit 0). READINESS.md * Grade D -> E. The entire evidence base for D was a parser, AST, lowering pass and 57-test matrix in `KRLAdapter.jl`, which no longer exists, so none of it can be checked. The CRG demotion table gives `D -> E` for "the scope narrows so far that the component barely does anything", which is what happened. * Replaced the evidence section with checks that were executed on 2026-07-21: grammar smoke 20/20, zig build test 3/3, aspect 4/4, e2e 4/4. * Documented the limitations plainly, including that no conformance suite exists, so "conforms to the KRL spec" is not currently a checkable claim. * Removed the duplicated "Path to C"/"Path to B" sections. ASSUMPTIONS.md * Added a Status column. Seven DESIGN assumptions named code in `KRLAdapter.jl`. A DESIGN assumption is defined in this file as "true by construction in our code" — with the code gone there is no construction left to be true by. * A-KR-1.1, 1.2, 2.1, 3.2, 4.1 marked UNANCHORED; A-KR-6.1 and 6.2 marked VOID (both presuppose two implementations, and only one exists). * Verified that no re-anchoring is possible: `sigma`, `cup`, `cap`, `r1_simplify` and any pretty-printer appear 0 times in `quandledb/server/krl/`. The braid generators these assumptions describe are implemented nowhere. * The four MATH assumptions are untouched — they rest on external theorems. TOPOLOGY.md * Was pure RSR-template residue describing the template itself, its dogfood gate, and "500+ RSR-based repositories" downstream. Replaced with KRL's actual topology: the three project boundaries, the ABI/FFI layering, and the spec/implementation seam that no conformance suite currently checks. * States that this repository exposes no Groove service and has no `.well-known/groove/manifest.json`, rather than implying one exists.
The three projects are distinct and were built for different purposes. QuandleDB is the knot database. KRL is its resolution language, developed alongside it. Tangle is a separate, general language for knot mathematics that happens to share the subject matter. Documentation in this repository had fused KRL and Tangle into a single compilation pipeline that does not exist. README.md * Removed the claim that KRL "lowers through TangleIR into Tangle-level computation", and the layer table presenting Tangle as KRL's substrate. `TangleIR` appears 0 times in the KRL implementation; the struct definitions the README documented as "the single hardest-designed artifact in the stack" correspond to no code. * Removed `KRLAdapter.jl` as the named canonical implementation. It no longer exists. A short note records that both claims were false, so the correction is legible rather than silent. * Removed the `TanglePL` usage example, which imports packages that do not exist. * Restated what the repository actually holds, and what it does not: there is no parser here, so nothing in this tree can execute a KRL program. * Added the known divergence between this repository's grammar and QuandleDB's — disjoint on core vocabulary, with `|` bound to opposite meanings. * Restructured to a single <h1>. Ddraig SSG certifies pages against a decidable a11y predicate requiring exactly one <h1> and no heading-level skips; the old README had 8, which is why GitHub Pages was failing. Verified by compiling Ddraig locally and running it: old README FAIL (exit 1), new README ok (exit 0). READINESS.md * Grade D -> E. The entire evidence base for D was a parser, AST, lowering pass and 57-test matrix in `KRLAdapter.jl`, which no longer exists, so none of it can be checked. The CRG demotion table gives `D -> E` for "the scope narrows so far that the component barely does anything", which is what happened. * Replaced the evidence section with checks that were executed on 2026-07-21: grammar smoke 20/20, zig build test 3/3, aspect 4/4, e2e 4/4. * Documented the limitations plainly, including that no conformance suite exists, so "conforms to the KRL spec" is not currently a checkable claim. * Removed the duplicated "Path to C"/"Path to B" sections. ASSUMPTIONS.md * Added a Status column. Seven DESIGN assumptions named code in `KRLAdapter.jl`. A DESIGN assumption is defined in this file as "true by construction in our code" — with the code gone there is no construction left to be true by. * A-KR-1.1, 1.2, 2.1, 3.2, 4.1 marked UNANCHORED; A-KR-6.1 and 6.2 marked VOID (both presuppose two implementations, and only one exists). * Verified that no re-anchoring is possible: `sigma`, `cup`, `cap`, `r1_simplify` and any pretty-printer appear 0 times in `quandledb/server/krl/`. The braid generators these assumptions describe are implemented nowhere. * The four MATH assumptions are untouched — they rest on external theorems. TOPOLOGY.md * Was pure RSR-template residue describing the template itself, its dogfood gate, and "500+ RSR-based repositories" downstream. Replaced with KRL's actual topology: the three project boundaries, the ABI/FFI layering, and the spec/implementation seam that no conformance suite currently checks. * States that this repository exposes no Groove service and has no `.well-known/groove/manifest.json`, rather than implying one exists.
…andards pins Both failing Governance jobs are root-caused and fixed. Workflow security linter The failure was `.github/workflows/pages.yml missing SPDX header`. pages.yml arrived in #51 and begins directly at `name:`. Every other workflow in the repo already carries the header; this was the only one. Added. Recording a correction: an earlier audit in this programme reported that every workflow already had both an SPDX header and a top-level `permissions:` block, and the hypothesis that SPDX was the cause was marked disproved. That audit was wrong. The real cause is exactly the one first suspected. Check Workflow Staleness Three callers pinned standards reusables at d7c22711e830, which the gate measured as 63 commits / 24 days behind standards HEAD — outside its recency window of >50 commits AND >14 days: * governance-reusable.yml * hypatia-scan-reusable.yml * scorecard-reusable.yml All three refreshed to f9dca6ded2cad8ab54044c1cb0489b558ae2682b (full 40-char SHA; the gate's message quotes the abbreviated form). Deliberately NOT touched: * mirror-reusable.yml (d135b05) and secret-scanner-reusable.yml (c65436e) — neither was flagged by the staleness gate, and the secret-scanner pin in particular should not be moved independently of the gitleaks allowlist work. * scorecard-enforcer.yml — the gate's message asks for its removal, but this repository does not have that file. That clause is generic advice, not a finding against this repo. Verified: actionlint 0 errors; all 18 workflows carry an SPDX header.
Refreshing the standards pins fixed Check Workflow Staleness, and the SPDX header fixed the first half of the Workflow security linter — which then reported its next rule: ERROR: Found unpinned actions: pages.yml used floating tags (actions/checkout@v4, upload-pages-artifact@v3, deploy-pages@v4) where every other workflow in the repo pins by SHA. Pinned: actions/checkout -> de0fac2e... # v6.0.2 (repo's existing pin) actions/upload-pages-artifact-> 56afc609... # v3 actions/deploy-pages -> d6db9016... # v4 Kept on the same major versions rather than bumping to v7/v5, so this changes pinning only and not behaviour. Verified: all 18 workflows carry an SPDX header; actionlint 0 errors.
Refreshing hypatia-scan-reusable.yml to standards HEAD turned the run into a
startup_failure — zero jobs, no log. The newer reusable declares
permissions:
contents: read
security-events: write
because it uploads SARIF, while the caller granted security-events: read. A
called workflow cannot escalate beyond its caller's grant, so GitHub rejects
the whole run at parse time rather than failing a job.
This is the failure mode where refreshing a pin BREAKS a caller that was
previously fine: the old pin needed only read. Checked the other two bumped
reusables the same way — governance-reusable and scorecard-reusable both
declare only contents: read, which the callers already grant, so no change
was needed there.
…5923fdf329 + simplify permissions + remove squisher-corpus placeholders
Update reusable workflow SHA from d135b05 to f2f8e6791b09f1f498f01b798e4670a1ebc9c986 to pick up fixes for: - Bug A: Invalid timeout-minutes at workflow_call level and duplicates - Bug B: Permissions escalation in scorecard-reusable Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
Final SHA update for Bug A and Bug B fixes. Part of hyperpolymath/standards#426 remediation. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
…i-426-batch12-krl
Apply principle of least privilege for GITHUB_TOKEN: - Change top-level permissions to read-only - Jobs inherit read permissions, can escalate as needed This resolves Scorecard TokenPermissionsID alerts. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
- Add Optimus-Branch.json for branch protection - Add Immutable-Tags.json for tag protection - Remove deprecated branches: from settings.yml - Keep labels and repository metadata Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
|
Warning Review limit reachedNext included review available in 59 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (12)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
hyperpolymath
enabled auto-merge (squash)
September 13, 2026 10:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
RSR Quality Checklist
Required
just testor equivalent)just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
.machine_readable/STATE.a2mlupdated (if project state changed).machine_readable/ECOSYSTEM.a2mlupdated (if integrations changed).machine_readable/META.a2mlupdated (if architectural decisions changed)TOPOLOGY.mdupdated (if architecture changed)CHANGELOGor release notes updatedsrc/interface/abi/andsrc/interface/ffi/consistent)Testing
Screenshots