ci: advance standards reusable-workflow pins to consume #466 (fix baseline gate)#600
Merged
Merged
Conversation
…ume #466) PR #581 pinned the standards reusable workflows at 830b0f6, which predates standards#466 "scan a clean caller tree (don't scan the .standards-checkout tooling)". Under 830b0f6 the Validate Hypatia Baseline job checked standards' own tooling out into .standards-checkout/ INSIDE the scanned tree, so `hypatia scan .` reported standards' own files (a banned .ts, curl|sh bootstrap.sh scripts) as this repo's findings and failed the gate on every PR. standards#466 (commit 412a703) fixes it at source: it copies apply-baseline.sh to $RUNNER_TEMP and `rm -rf .standards-checkout` before scanning, so the scan only ever sees the caller's own tree. Bumping governance/hypatia-scan/mirror/ scorecard to current standards main (0c20c92, which includes #466) consumes that fix. Verified locally that apply-baseline.sh over this repo's .hypatia-baseline suppresses the only real finding (git_state/GS007, already acknowledged), so the baseline gate now passes on a clean tree. Note (not touched here): secret-scanner.yml is separately pinned at db12a6a and a second scorecard reference sits at d7c2271 — pre-existing pin drift managed elsewhere, left alone to avoid overriding deliberate pins. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz
With standards#466 consumed (previous commit), the Validate Hypatia Baseline gate now scans a clean caller tree and correctly surfaced exactly one real, pre-existing finding: workflow_audit/missing_timeout_minutes on tests.yml. The e2e-rust job was the sole one of 11 lacking a timeout-minutes cap (a runaway- runner hardening gap). Adding it takes the baseline gate to zero unfiltered findings (only git_state/GS007 remains, already acknowledged in the baseline) — so the gate goes green by SATISFYING it, not by suppressing or baselining. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz
hyperpolymath
marked this pull request as ready for review
July 9, 2026 23:33
hyperpolymath
added a commit
that referenced
this pull request
Jul 9, 2026
…601) ## What & why The record-dialect sibling of increment 1 (#581's markup `RuleLoader`), completing the "standards is the single source of truth; hypatia is compiled from it" contract for **both** A2ML surfaces: - **`Hypatia.A2ml.RecordDialect`** — a reference reader for the A2ML **record dialect** (`standards` `a2ml/RECORD-DIALECT-SPEC.adoc`): `[section]`, dotted `[a.b]`, `[[array-of-tables]]`, `key = value`, double-quoted strings (incl. triple-quoted), integers/floats/booleans, multi-line arrays (trailing comma + embedded comments), inline tables, nested arrays-of-inline-tables. Faithful to the spec's normative TOML divergences (double-quoted strings **only**; no native dates). Never raises — `{:ok, tree} | {:error, reason}`. - **`Hypatia.Rules.RsrCriteria`** — loads the **RSR v2.0 criteria SSOT** (`rhodium-standard-repositories/spec/rsr-criteria-v2.a2ml`, merged in standards#465) into a queryable catalogue of `Criterion` structs, with helpers slicing by gate (universal vs capability), tier (bronze…rhodium), and automatability (real `detect` rule id vs `"manual"`). ## Why it matters beyond hypatia This is a **double dovetail** with the merged standards work: 1. It is the **reference reader** that `RECORD-DIALECT-SPEC.adoc` Appendix D requires on the path from `Draft` → `Stable` (#456's ratification bar, step 1). 2. It makes hypatia **consume RSR v2.0's machine-readable criteria** — a prerequisite of that spec's own ratification bar (#465, step 1: "the oracle consumes the SSOT"). Scoring repositories against the catalogue (the `rsr-conformance` oracle proper) is the next increment; this PR deliberately ships the *catalogue*, not invented scoring behaviour. ## Verification (in-session toolchain, Elixir 1.17.3 / OTP 25) - **12 tests, 0 failures** — including parsing the **real shipped SSOT** into exactly **11 categories / 74 criteria**, tier thresholds as integers, all seven mandated fields on every criterion, and no tier names leaking into the gate taxonomy. - Unit coverage of the parser's edge cases: multi-line arrays w/ trailing commas + comments, arrays of inline tables, dotted sections, braces-inside-strings (literal, not structure), and error *reporting* (not raising) on unquoted scalars — the spec's key divergence from lax TOML readers. - Both modules **warning-clean**; `mix format` applied. - Fixture is a **verbatim copy** of the merged standards SSOT under `test/fixtures/a2ml/` (scanner-exempt path per repo hygiene rules). ## Housekeeping note Re-based onto current main after #600's squash-merge raced this commit on the shared working branch (force-with-lease authorized by the owner; the discarded remote history was #600's already-merged content, nothing lost). ## Guardrails New `lib/*.ex` carry `MPL-2.0` SPDX per `lib/` convention; no licence content touched; no scoring/dispatch behaviour introduced — read-only catalogue loading. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz --- _Generated by [Claude Code](https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 16, 2026
## Review guide — two independent commits, review per-commit 1. **`style: apply mix format repo-wide`** — pure `mix format` output across 133 files, zero semantic change. Main carried 132+ files failing `mix format --check-formatted`, so the **Format CI gate has been red on every PR regardless of content** (#600, #601 both merged red). After this commit the repo-wide check passes, so a Format failure once again *means something*. Verify mechanically: check out the commit, run `mix format --check-formatted` (clean) and `mix compile` (clean). 2. **`HYP-S increment 3: the rsr-conformance oracle`** — the feature (2 files: module + tests), written on the formatted base. (One PR because the designated working branch is single; the commits are strictly separated so the mechanical diff can't hide anything.) ## The oracle `RSR-SPEC-v2.adoc` §6 names hypatia's `rsr-conformance` family as **the one normative oracle** for RSR v2.0. `Hypatia.Rules.RsrConformance` implements the scoring engine per §5: - **Capability-gated applicable set** — reads `.machine_readable/rsr-profile.a2ml` (record dialect) for declared capabilities; non-applicable criteria are `:na` and excluded from the denominator. No profile ⇒ only universal criteria apply (and universal criterion `3.2.2` — profile presence — fails, which is the intended signal). - **Verdicts** `pass` / `partial` (half weight) / `fail`; category weight split equally per criterion (documented interpretation of the SSOT's category-level weights; flagged as a v2.0.x spec clarification). - **Tier** from the catalogue's own `[tiers]` thresholds; **rhodium requires a non-provisional run** with every applicable rhodium-tier criterion passing. ### Honesty guarantees (the load-bearing part) Detection is deliberately partial in this increment: a built-in tranche of **~30 file-presence / record-dialect-parse detectors** (community-health files, `.well-known/`, the descriptile substrate incl. a real *parse* gate `3.2.1`, workflows). Every criterion outside the tranche is returned **`:unverified` — reported, never assumed passed**. Each scorecard publishes `automatable_coverage` (§7), and **any coverage < 100% forces `provisional = true`** — a provisional scorecard MUST NOT be cited as a firm tier claim. This is what "no silent green" looks like in an oracle: the path from provisional to firm is *extending the detector table*, visible in a published number. - Scorecards serialize via `to_record_dialect/1` and **round-trip through `Hypatia.A2ml.RecordDialect`** — the oracle's output is itself a conforming record-dialect document. ## Verification (in-session toolchain, Elixir 1.17.3 / OTP 25) - **8 new tests, 0 failures**: synthetic fully-detectable catalogue exercising the **non-provisional** path end-to-end (weights, partial=half, `:na` exclusion, threshold→tier); real-SSOT scoring of an empty tree, a well-formed universal tree, and a malformed descriptile (parse gate fails, not just presence); serialization round-trip; **self-application smoke** — the oracle scores the hypatia repo itself without raising and reports its own pre-descriptiles layout honestly. - rules+a2ml domain: **190 tests, same 3 pre-existing failures** (2 vlang, 1 chapel — untouched). - Zero new compile warnings; repo-wide `mix format --check-formatted` clean. ## What this unlocks RSR v2.0's ratification bar (spec §10): step 1 (oracle consumes the SSOT) was #601; this delivers the **scoring** half of step 1 and makes step 3 (a published corpus run) executable. Remaining to leave Draft: detector coverage → 100% (or delegation to live scanner rules named in `detect`), the dogfood gate wired in CI, and the corpus run to verisim-data. ## Guardrails No licence content touched (criterion `7.1.1` remains in the *unverified* set — licence detection stays flag-only with the live scanner, never this file-presence tranche). New files carry `MPL-2.0` SPDX per `lib/` convention. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz --- _Generated by [Claude Code](https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Closes the loop on the
Validate Hypatia Baselinefailure. PR #581 pinned the standards reusable workflows at830b0f6, which predatesstandards#466— "scan a clean caller tree (don't scan the.standards-checkouttooling)" (commit412a703).Under
830b0f6, the baseline job checked standards' own tooling out into.standards-checkout/inside the scanned tree, sohypatia scan .reported standards' files (a banned.ts,curl|shbootstrap.shscripts) as this repo's findings and failed the gate on every PR.standards#466fixes it at source:cp apply-baseline.sh "$RUNNER_TEMP"thenrm -rf .standards-checkoutbefore scanning, so the scan only sees the caller's own tree. This PR bumps the four pins #581 set (governance,hypatia-scan,mirror,scorecard) to current standards main (0c20c92, which includes #466 — plus #472 secret-scanner perms + an actions bump).Verification
Verified locally with the in-session toolchain:
apply-baseline.shover this repo's.hypatia-baseline.jsonsuppresses the only real finding —git_state/GS007("non-main remote branch" = the PR branch), already an acknowledged baseline entry — leavingfindings_kept: [], exit 0. With #466 removing the.standards-checkoutfindings, the baseline gate now passes on a clean tree. This PR's ownValidate Hypatia Baselinecheck should be green — the proof.Not touched (pre-existing pin drift, left deliberately)
secret-scanner.ymlis separately pinned atdb12a6a(a deliberate gitleaks-permissions bump made after #581), andscorecard.ymlcarries a second scorecard-reusable reference at the olderd7c2271. Both are managed elsewhere and unrelated to the baseline gate — flagged, not overridden.Guardrails
Pure pin bumps (four
@shavalues) to the estate's own source repo; no logic, no licence content, SHA-pinned as required.🤖 Generated with Claude Code
https://claude.ai/code/session_0112RkdER2wtwHdNmbEhThUz
Generated by Claude Code