Repository navigation
chore(canon): adopt canon 2.1.5 (gate table 0.3.1; criteria unchanged) - #27
Merged
Merged
Conversation
Canon lockstep is red on main. standards' canon.lock records 2.1.5 (#1424: gate table 0.3.1 and the applicability policy changed; the criteria did not), and this deed declared 2.1.3. Port of hyperpolymath/rsr-template-repo#298, the spine's adoption. - secret-types_chora.deed (canon): :version 2.1.3 to 2.1.5, and :gates-sha256 2f31f46d… to 5c510bba…. The criteria hash is unchanged. The (provenance) clause keeps 2.1.3: it records the canon this repository was minted against, which is history. - tests/workflows/governance_policy_test.sh expects the 2.1.5 tuple. That test already fails on main earlier, on the governance.yml pull_request filter that #15's caller carries; this does not change that. canon.lock marks 2.1.5 status "draft"; this adopts the identity the lock records, which is what the lockstep gate compares. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BYbQRtNu216R13jtZLmoqs
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 44 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
This was referenced Nov 9, 2026
Owner
Author
|
estate-rules is red here, but the failure comes from Generated by Claude Code |
|
🟠 indeterminate · commit Advisory: 11 row(s), worst 🔴 high (0 critical, 9 high) — reported, never grading the change.
Hypatia scan: error — the scanner produced no findings array
panic-attack assail: 14 finding(s)
pons asinorum: 9 finding(s)
finishingbot (release readiness): 173 finding(s)
glambot (presentation quality): 93 finding(s)
rhodibot (RSR compliance): 13 finding(s)
accessibilitybot: not_applicable — template default: enrol once the repository serves HTML
cipherbot: not_applicable — template default: enrol once the repository implements cryptography
echidnabot: not_applicable — template default: enrol once the repository carries proofs and an ECHIDNA engine is configured
panicbot: not_applicable — panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree
seambot: not_applicable — template default: enrol once a seam register exists at spec/seams/seam-register.json
sustainabot: not_applicable — reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
hyperpolymath
added a commit
that referenced
this pull request
Nov 9, 2026
…#28) ## Summary **estate-rules is red on `main`.** Its step "Use-this-template mint end to end" runs `tests/e2e/use_template_mint_test.sh` as inherited from template `c481073`. That version re-mints this already-minted tree and fails on an unfilled `{{OWNER}}` token. The template fixed this across #275, #291, #293 and #294, and its current test self-skips in a minted child. I reproduced both sides: the `c481073` test fails on `main`, and the current test passes on this branch. ## Changes This is a three-way sync. The base is `c481073`, the commit this repository was minted from, and the target is template `2be7b88`. - **43 files** that this repository still held byte-identical to `c481073` take the template's current version: mint machinery, hooks, workflows, checks and tests. - **9 new machinery files**: `chain-mint`, `replay-mint`, `check-mint-drift` and `format-container-kyaml`, plus their tests. The template's own diagnostic workflow (`oracle-segfault-diag.yml`) and its lock record are left out. - **Diverged files** were three-way merged. These stay as this repository's own: - `governance.yml`, the reusable caller from #15; - `README.adoc`; - `mise.toml`, with `yq` added for `scripts/kyaml-format.sh`; - the verdict-grid lane and the rule-order policy, kept at standards `8e48b1c` because that renderer works and the template's `e064539` does not; - the rule-order checker and its test, from #22; - `CHANGELOG.adoc`, which gets one entry for this sync instead of the template's release notes. - **`secret-scanner.yml`** takes the template's inline three-scanner workflow (rsr-template-repo#295: stable status contexts, no `secrets: inherit`). Its lock record is updated and its contract test wired. - **`non_interactive_mint_test.sh` and `chain_mint_test.sh`** carry hyperpolymath/rsr-template-repo#300's guard. Without it, both tests fail in any legacy minted child. In a repository minted without `(mint-answers)`, the guard asserts that `repo-init` refuses to mint again, by name. ## RSR Quality Checklist ### Required - [x] Tests pass. Locally: - `check-lock-sync`: in sync. - `check-workflow-edges`, `check-required-contexts`, `check-root-shape`: pass. - `run-proven-suite.sh`: `ALL LANES PASSED`. - Every single-line estate-rules lane: the same five fail as on unmodified `main`. Four are environmental on this machine (asciidoctor, this machine's `yq`) and pass in CI. - [x] No banned language patterns - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ## Still red, and why - **`governance_policy_test`** fails because the #15 governance caller's `pull_request` trigger carries a branch filter, and the test also expects the inline standards checkout. CI never reached this step before, because the mint test failed first. Whether to keep the caller or take the template's inline governance workflow is your call. - **Canon lockstep**: fixed by #27. --- _Generated by [Claude Code](https://claude.ai/code/session_01BYbQRtNu216R13jtZLmoqs)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
November 9, 2026 23:21
hyperpolymath
disabled auto-merge
November 10, 2026 02:01
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
hyperpolymath
pushed a commit
that referenced
this pull request
Nov 10, 2026
My earlier merge (ba2484f) took #32's head before #32 was updated (3bf7f8e), because the local ref was stale. So this branch lacked main's later changes (the template sync #28, canon 2.1.5 #27, https-only edges #25) and kept some #26-only text. This merge corrects that. Each conflicted file is a 3-way merge on 3bf7f8e (the #32 commit the earlier merge used), so only this PR's legs changes are carried onto main. Files the legs work does not own take main's version: tests/workflows/governance_policy_test.sh, and docs/proof-debt.adoc except its legs bullet (this restores #32's dated W-1 record). The receipt is regenerated. The diff against main is now the legs work: the Rocq and Lean sources, check-legs.sh, the legs CI job, the receipt's (legs) block and RECONCILED leg states (PWG-2ii derived), and the matching doc lines. Checked with Agda 2.6.4.3, Coq 8.18.0 and Lean 4.24.0: check.sh, minimal-laws.sh, check-legs.sh, grade-receipt.sh --check (15 modules), check-escape-hatches.sh, the invisible-character scan and tests/workflows/governance_policy_test.sh. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmAsYpFA9gxfQLF3F6 Signed-off-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Canon lockstep is red on
main. standards'canon.locknow records canon 2.1.5 (metadatastician/standards#1424): the gate table moved to 0.3.1 and the applicability policy changed, but the criteria did not. This deed still declares 2.1.3.This ports hyperpolymath/rsr-template-repo#298, the template's adoption. I've also ported the same commit into #25 and #26 so Canon lockstep goes green there; the port becomes a no-op once this PR merges.
Changes
secret-types_chora.deed(canon …)::versiongoes from 2.1.3 to 2.1.5, and:gates-sha256from2f31f46d…to5c510bba…. The criteria hash is unchanged.(provenance)clause keeps 2.1.3. It records the canon this repository was minted against, which is history.tests/workflows/governance_policy_test.shnow expects the 2.1.5 tuple.RSR Quality Checklist
Required
.envfiles includedgovernance_policy_test.shalready fails onmain, before it reaches the canon assertion. Its first check rejectsgovernance.yml'spull_request: branches: [main, master]filter, which came in with fix(ci): canonical reusable callers, least-privilege Actions canary and lock sync #15's canonical caller. This PR doesn't change that;deed-field.shreturns the 2.1.5 tuple.Testing
deed-field.shreturns version 2.1.5, criteria6a5aa885…and gates5c510bba…, the same valuescanon.lockhas on standardsmain.canon.lockstill marks 2.1.5 asstatus = "draft". This PR adopts the identity the lock records, which is what the lockstep gate compares.Generated by Claude Code