[hyperpolymath]

Summary

estate-rules is red on main. Its step "Use-this-template mint end to end" runs tests/e2e/use_template_mint_test.sh as inherited from template c481073. That version re-mints this already-minted tree and fails on an unfilled {{OWNER}} token. The template fixed this across #275, #291, #293 and #294, and its current test self-skips in a minted child.

I reproduced both sides: the c481073 test fails on main, and the current test passes on this branch.

Changes

This is a three-way sync. The base is c481073, the commit this repository was minted from, and the target is template 2be7b88.

• 43 files that this repository still held byte-identical to c481073 take the template's current version: mint machinery, hooks, workflows, checks and tests.
• 9 new machinery files: chain-mint, replay-mint, check-mint-drift and format-container-kyaml, plus their tests. The template's own diagnostic workflow (oracle-segfault-diag.yml) and its lock record are left out.
• Diverged files were three-way merged. These stay as this repository's own:
  • governance.yml, the reusable caller from fix(ci): canonical reusable callers, least-privilege Actions canary and lock sync #15;
  • README.adoc;
  • mise.toml, with yq added for scripts/kyaml-format.sh;
  • the verdict-grid lane and the rule-order policy, kept at standards 8e48b1c because that renderer works and the template's e064539 does not;
  • the rule-order checker and its test, from Migrate proof receipt to DEED and repair scanner policy checks #22;
  • CHANGELOG.adoc, which gets one entry for this sync instead of the template's release notes.
• secret-scanner.yml takes the template's inline three-scanner workflow (rsr-template-repo#295: stable status contexts, no secrets: inherit). Its lock record is updated and its contract test wired.
• non_interactive_mint_test.sh and chain_mint_test.sh carry test(mint): in a legacy minted child, assert the re-mint refusal instead of failing rsr-template-repo#300's guard. Without it, both tests fail in any legacy minted child. In a repository minted without (mint-answers), the guard asserts that repo-init refuses to mint again, by name.

RSR Quality Checklist

Required

• Tests pass. Locally:
  • check-lock-sync: in sync.
  • check-workflow-edges, check-required-contexts, check-root-shape: pass.
  • run-proven-suite.sh: ALL LANES PASSED.
  • Every single-line estate-rules lane: the same five fail as on unmodified main. Four are environmental on this machine (asciidoctor, this machine's yq) and pass in CI.
• No banned language patterns
• SPDX license headers present on all new/modified source files
• No secrets, credentials, or .env files included

Still red, and why

• governance_policy_test fails because the fix(ci): canonical reusable callers, least-privilege Actions canary and lock sync #15 governance caller's pull_request trigger carries a branch filter, and the test also expects the inline standards checkout. CI never reached this step before, because the mint test failed first. Whether to keep the caller or take the template's inline governance workflow is your call.
• Canon lockstep: fixed by chore(canon): adopt canon 2.1.5 (gate table 0.3.1; criteria unchanged) #27.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-09T15:40:30.160363Z We couldn’t complete this review. Comment @codex review to try again.	612a04b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

🟠 indeterminate · commit c23ac75285b3 · run 42655684863 · scope: this change (68 file(s))

Advisory: 11 row(s), worst 🟠 indeterminate (0 critical, 0 high) — reported, never grading the change.

Reporter	Gate	Status	Critical	High	Medium	Minor	Since previous revision
Hypatia scan	gating	🟠 indeterminate	0	0	0	0	— no comparable baseline
panic-attack assail	advisory	🟠 indeterminate	0	0	0	0	— no comparable baseline
pons asinorum	advisory	🟠 indeterminate	0	0	0	0	— no comparable baseline
accessibilitybot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline
cipherbot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline
echidnabot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline
finishingbot (release readiness)	advisory	🟠 indeterminate	0	0	0	0	— no comparable baseline
glambot (presentation quality)	advisory	🟠 indeterminate	0	0	0	0	— no comparable baseline
panicbot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline
rhodibot (RSR compliance)	advisory	🟠 indeterminate	0	0	0	0	— no comparable baseline
seambot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline
sustainabot	advisory	⚪ not applicable	0	0	0	0	— no comparable baseline

Hypatia scan: error — the scanner produced no findings array

• 🟠 indeterminate: the scanner produced no findings array

panic-attack assail: not_run — no status envelope was produced

• 🟠 indeterminate: no status envelope was produced

pons asinorum: not_run — no status envelope was produced

• 🟠 indeterminate: no status envelope was produced

accessibilitybot: not_applicable — template default: enrol once the repository serves HTML

• ⚪ not applicable: template default: enrol once the repository serves HTML

cipherbot: not_applicable — template default: enrol once the repository implements cryptography

• ⚪ not applicable: template default: enrol once the repository implements cryptography

echidnabot: not_applicable — template default: enrol once the repository carries proofs and an ECHIDNA engine is configured

• ⚪ not applicable: template default: enrol once the repository carries proofs and an ECHIDNA engine is configured

finishingbot (release readiness): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

glambot (presentation quality): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

panicbot: not_applicable — panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree

• ⚪ not applicable: panic-attack is already graded by the verdict grid's own panic-attack row, from static-analysis-gate.yml evidence; enrolling panicbot would report one scanner twice and give two rows that can disagree

rhodibot (RSR compliance): not_run — enrolled, but no report-back was received

• 🟠 indeterminate: enrolled, but no report-back was received

seambot: not_applicable — template default: enrol once a seam register exists at spec/seams/seam-register.json

• ⚪ not applicable: template default: enrol once a seam register exists at spec/seams/seam-register.json

sustainabot: not_applicable — reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)

• ⚪ not applicable: reserved fleet slot; no adapter exists (gitbot-fleet bots/sustainabot/README.adoc)

Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
284 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud