[hyperpolymath]

Summary

This ports commit 8ffc72a from hyperpolymath/rsr-template-repo#290. That commit landed in the template after this repository's port, #20, had already merged without it. It clears the SonarCloud failure "C Security Rating on New Code" that #20 merged with.

reusable_source in scripts/check-workflow-edges.sh fetches a called workflow with curl -fsSL. Because of -L, curl follows redirects to any protocol, so a redirect could downgrade the fetch to plain http. That is the SonarCloud annotation on line 150 ("Not enforcing HTTPS here might allow for redirections to insecure websites").

Changes

• scripts/check-workflow-edges.sh: line 150 now passes --proto =https --proto-redir =https to curl, so both the request and any redirect must stay on https.

RSR Quality Checklist

Required

• Tests pass: bash tests/workflows/workflow_edges_test.sh passes 46 checks, and bash scripts/check-workflow-edges.sh passes on this tree.
• Code is formatted (one-line change)
• Linter is clean (no new warnings or errors)
• No banned language patterns
• No unsafe blocks without // SAFETY: comments
• No banned functions
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

As Applicable

Nothing here applies: this is a one-flag change to a check script.

Testing

• I ran the edge suite and the live checker, as listed above.
• I fetched a pinned reusable from raw.githubusercontent.com with the restricted flags and the fetch succeeded.
• The same change on the template turned SonarCloud's quality gate from failed to passed on #290.

Known reds on main, not this PR's

main (eee4e40) is red on three checks this PR does not touch:

• Canon lockstep. metadatastician/standards' canon.lock moved to draft 2.1.5 on 2026-11-07, with a new gates hash. The deed declares 2.1.3. The template's main is red on the same check. The spine adopts first, per [canon].order.
• canary. rhodibot reports one would-mutate finding, also on template main.
• estate-rules. just repo-init on a Use-this-template child reports one unfilled token.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: hyperpolymath/secret-types
• Branch: claude/edges-https-only
• File: .coderabbit.yaml
• Commit: b603aca
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 15b9e08c-29ca-4a14-b33b-5eb839965530

Commits

Reviewing files that changed from the base of the PR and between eee4e40 and b603aca.

Files selected for processing: 3

• scripts/check-workflow-edges.sh
• secret-types_chora.deed
• tests/workflows/governance_policy_test.sh

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

🟠 indeterminate · commit b603acaccca1 · run 42628293603 · scope: this change (3 file(s))

Advisory: 11 row(s), worst 🔴 high (0 critical, 9 high) — reported, never grading the change.

Reporter	Gate	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	gating	🟠 indeterminate	0	0	0	0	— indeterminate
panic-attack assail	advisory	🟡 medium	0	0	1	0	↔ unchanged
pons asinorum	advisory	🟢 clean	0	0	0	0	↔ unchanged
finishingbot (release readiness)	advisory	🔴 high	0	9	23	0	↓ more medium
glambot (presentation quality)	advisory	🔵 minor	0	0	0	5	↔ unchanged
rhodibot (RSR compliance)	advisory	🟢 clean	0	0	0	0	↔ unchanged
accessibilitybot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged
cipherbot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged
echidnabot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged
panicbot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged
seambot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged
sustainabot	advisory	⚪ not applicable	0	0	0	0	↔ unchanged

Hypatia scan: error — the scanner produced no findings array

• 🟠 indeterminate: the scanner produced no findings array

panic-attack assail: 14 finding(s)

• medium CommandInjection — scripts/check-workflow-edges.sh — 36 potentially unquoted variable expansions in scripts/check-workflow-edges.sh
• 13 further finding(s) in files this change does not touch: reported, not graded (0 critical, 0 high).

pons asinorum: 9 finding(s)

• 9 further finding(s) in files this change does not touch: reported, not graded (0 critical, 0 high).

finishingbot (release readiness): 173 finding(s)

• high V1-DOC-ROADMAP.adoc — Required file ROADMAP.adoc not found (Project roadmap).
• high TOOL-001 — .tool-versions file not found for asdf/mise version management.
• high SCM-001-NEUROSYM.scm — Required SCM file NEUROSYM.scm not found (Neurosymbolic AI documentation).
• high SCM-001-AGENTIC.scm — Required SCM file AGENTIC.scm not found (Agentic AI integration documentation).
• high SCM-001-PLAYBOOK.scm — Required SCM file PLAYBOOK.scm not found (Operational playbooks and procedures).
• high SCM-001-ECOSYSTEM.scm — Required SCM file ECOSYSTEM.scm not found (Project's place in the ecosystem).
• high SCM-001-META.scm — Required SCM file META.scm not found (Meta-level information and architectural decisions).
• high SCM-001-STATE.scm — Required SCM file STATE.scm not found (Project state and progress tracking).
• high PH-100 — Found 124 placeholders, exceeds maximum allowed (0)
• medium V1-COM-CONTRIBUTING.md — CONTRIBUTING.md file not found (Contribution guidelines).
• medium V1-COM-CODE_OF_CONDUCT.md — CODE_OF_CONDUCT.md file not found (Code of conduct).
• medium V1-SEC-001 — SECURITY.md not found for responsible disclosure.
• medium TEST-001 — Could not determine if this is a Rust or Deno project.
• medium REL-004 — No SECURITY.md file found
• medium PH-004 — secret-types_chora.deed:943 — Found 'HACK' in: :marker-scan ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• medium PH-003 — secret-types_chora.deed:943 — Found 'XXX' in: :marker-scan ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• medium PH-002 — secret-types_chora.deed:943 — Found 'FIXME' in: :marker-scan ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• medium PH-001 — secret-types_chora.deed:943 — Found 'TODO' in: :marker-scan ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• medium PH-004 — secret-types_chora.deed:840 — Found 'HACK' in: :marker_scan_required ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• medium PH-003 — secret-types_chora.deed:840 — Found 'XXX' in: :marker_scan_required ("TODO" "FIXME" "XXX" "HACK" "STUB" "PARTIAL")
• 12 more graded finding(s); see the structured report in the artifact.
• 141 further finding(s) in files this change does not touch: reported, not graded (0 critical, 3 high).

glambot (presentation quality): 93 finding(s)

• info GS-001 — Install git-seo for comprehensive SEO analysis: https://github.com/hyperpolymath/git-seo
• info MACH-007 — ECOSYSTEM.scm not found in .machine_readable/ directory.
• info MACH-007 — META.scm not found in .machine_readable/ directory.
• info MACH-007 — STATE.scm not found in .machine_readable/ directory.
• info MACH-005 — No robots.txt found. Consider adding one for crawler control.
• 88 further finding(s) in files this change does not touch: reported, not graded (0 critical, 2 high).

rhodibot (RSR compliance): 13 finding(s)

• 13 further finding(s) in files this change does not touch: reported, not graded (0 critical, 12 high).

accessibilitybot: not_applicable — template default: enrol once the repository serves HTML

• ⚪ not applicable: template default: enrol once the repository serves HTML

cipherbot: not_applicable — template default: enrol once the repository implements cryptography

• ⚪ not applicable: template default: enrol once the repository implements cryptography

echidnabot: not_applicable — template default: enrol once the repository carries proofs and an ECHIDNA engine is configured

• ⚪ not applicable: template default: enrol once the repository carries proofs and an ECHIDNA engine is configured

panicbot: not_applicable — panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree

• ⚪ not applicable: panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree

seambot: not_applicable — template default: enrol once a seam register exists at spec/seams/seam-register.json

• ⚪ not applicable: template default: enrol once a seam register exists at spec/seams/seam-register.json

sustainabot: not_applicable — reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)

• ⚪ not applicable: reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)

Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

[hyperpolymath]

Canon lockstep is red on this PR, and the failure isn't this PR's. It fails identically on main (eee4e40), and on rsr-template-repo main (2be7b88). This PR changes only one curl flag in scripts/check-workflow-edges.sh.

The cause is the canon itself. On 2026-11-07, metadatastician/standards' canon.lock moved to version 2.1.5. That release is still status = "draft" with a zero commit, and its gates sha256 is now 5c510bba…. The deed here still declares 2.1.3 with gates 2f31f46d….

There is no fix to port. [canon].order requires the spine (rsr-template-repo) to adopt first, and it has not adopted 2.1.5 yet. Bumping only the version here would still fail on the gates hash. I'm not re-running the check: the mismatch is deterministic and already shows on the base branch.

SonarCloud's quality gate now passes on this head. That clears the C security rating that #20 merged with.

---

Generated by Claude Code

[hyperpolymath]

estate-rules is red on this PR, and the failure isn't this PR's. It fails the same way on main (eee4e40).

The failing step is tests/e2e/use_template_mint_test.sh. It runs just repo-init on a Use-this-template child of this tree, and the mint stops on mint-probe.md: {{OWNER}} with "1 unfilled token(s) in a minted tree (no archetypes/)". That test was inherited from rsr-template-repo c481073, and it assumes it runs inside the template, which still has archetypes/.

There is no small fix to port. rsr-template-repo fixed this over a series of PRs: #275 (the mint records its answers), #291, #293 (mint and replay regressions) and #294 (the regression control stays valid in an instantiated descendant). #294 was also backported to one descendant. Those changes touch build/just/repo-init.just, the deed's mint record and this test together. Bringing them here amounts to syncing this repository with a later template commit, which is a separate change, not a one-flag PR. I'm putting that to the owner rather than widening this one.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-09T15:47:49.697746Z We couldn’t complete this review. Comment @codex review to try again.	b603aca	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud