fix(ci): adopt the Actions lockfile — every workflow was startup_failure - #56
Merged
Conversation
All 16 workflows here return startup_failure in 0s. The last 30 runs are startup_failure without exception, so this repo has had no working CI at all, and the two open PRs (#53, #55) have never been verified by anything. Workflow-lockfile enforcement is active on this account and this repo had no .github/workflows/actions.lock. Applied the cure proven on haec #50 and trope-particularity-workbench #45, which takes four steps because each one's failure is invisible until the previous is fixed: 1. gh actions-lock — generates the lockfile and normalises pins to tags. 2. Hoist SPDX back to line 1. actions-lock inserts its own banner there, and the workflow linter requires SPDX first, so the tool that cures the startup failures reddens every workflow file unless this is undone. 3. Hand-author an empty [] lockfile entry for each of the 6 reusable- workflow callers. gh actions-lock SKIPS callers, so without this they stay startup_failure while everything else goes green. 4. Re-pin those callers to standards bd0df9ead7fa, the commit that made the governance check lockfile-aware, verified via the commits API. Expect previously-unseen failures. Nothing here has been checked in a long time, so the first green run is a starting point rather than a result. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ ApprovedAdopts the GitHub Actions lockfile across workflows to resolve persistent startup failures, accompanied by SPDX header adjustments and manual caller pinning. No issues found.
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Important Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more. Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
hyperpolymath
added a commit
that referenced
this pull request
Aug 7, 2026
…#60) Stacked on #53. Retargets to `main` automatically when that merges. ## The correction that drove this The **three-layer claim checker** is this repository's principal subject — and it was barely documented, while the AffineScript same-cube example was over-represented relative to it. `faces` is one profile of six, a lens onto a corpus that lives elsewhere: a good demonstration of the idea in miniature, not the subject. This PR fixes that proportion. ## Human **`ARCHITECTURE.md` was template boilerplate** describing `src/`, `tests/`, `config/` and `README.adoc` — none of which match this repo — duplicating the real `docs/ARCHITECTURE.md`, and saying *nothing whatever* about the three layers. (Closed PR #58 independently spotted this as "drop false ARCHITECTURE"; it did not land, so the problem persisted.) Rewritten in two parts: **Part I** the layer architecture — Layer 1 (`type`) and what the diode actually buys, with its three open problems (epistemic vs ontic clock, partial-order time, composition-forgery as holonomy); Layer 2 (`trope`) as actually built in `trope-checker`/`hermeneia`, affine with a guarded contraction rule; Layer 3 (`sortal`), the doubling attack, and the `L3 -> L2` dependency arrow. **Part II** the shipping extractor/classifier. **`README.md` had drifted from the tool.** It said every face's lowering "must normalise to the same canonical text"; the verifier now compiles each face to typed-wasm and compares `sha256`, keeping text diffs as a diagnostic only. The README asserted something that held on both sides of a transition while no longer meaning the same thing — **this repository's own failure mode, turned inward.** ## Machine `0-AI-MANIFEST.a2ml`: real structure (it omitted `docs/decisions/`, `proofs/`, `examples/`, `src/ui/`); new `(architecture …)` block with the three layers, dependency order, doubling attack, decided-not-built status and the `L1`/`L2`/`L3` numbering hazard; new `(debt …)` block; ADR-0001 in milestones. **The do-not-paraphrase `(core-idea)` block is untouched.** **Wiki** was a one-line stub → `Home` + `Three-Layers` (pushed separately — wikis are their own git repo). ## Debt — new `docs/DEBT.md` | | Dimension | Open | Worst | |---|---|---|---| | A | Architecture | 3 | **HIGH** | | C | CI/CD | 3 | MEDIUM | | L | Licence | 3 | MEDIUM | | D | Docs | 3 | MEDIUM | | P | Proof | 2 | MEDIUM | | K | Code | 1 | LOW | **The headline finding went stale mid-audit, and that is recorded rather than hidden.** C1 was filed CRITICAL — no lockfile, every workflow `startup_failure` on every branch, `main` never green. **PR #56 fixed it while this was being written.** Re-measured: 10 workflows green on `main` including Rust CI, CodeQL and Secret Scanner. C1 is now RESOLVED with the history kept, and the residue split into C2 (Scorecard still `startup_failure`), C3 (two workflows failing on *content*, untriaged — invisible until the lockfile landed), C4 (no proof gate). Other findings: - **L1** — GitHub reported **no licence**. Cause found: `LICENSE` deviated from canonical MPL-2.0 by a **trailing space** (line 38) and `http` vs `https` (line 360). Replaced with the canonical text. - **A1–A3** — Layer 1 has no substrate anywhere; Layer 3's equivalence side does not exist; Layer 2's vocabulary does not match its implementation (**`p-residue` exists in no repository**). - **P1** — `SameCube.agda` is genuinely good (`--safe`, zero postulates, zero holes) but **ungated**. `docs/tech-debt-2026-05-26.md`'s "RESOLVED" banner was **partly wrong** and is corrected in place: licence was not actually detected, and proof debt was half closed. ## Repo metadata (applied via API, not in this diff) - **Description** was `Dual-use claim-grounder (Phase A in progress)` — vague and stale. Now states what the tool does and its governance role. - **Topics** were `development, hyperpolymath, open-source, rust, software, tooling` — owner name, generic words, and a language GitHub detects itself. Replaced with eight concept-level ones: `claim-checking`, `argumentation`, `semantic-drift`, `provenance`, `cross-domain-equivalence`, `architecture-decision-records`, `formal-methods`, `static-analysis`. ## Verification - `0-AI-MANIFEST.a2ml` parens and quotes balance - `reuse lint` missing-info count **unchanged** from baseline (1, pre-existing) — verified by stashing and re-running - every path cited in `ARCHITECTURE.md` exists on disk - CI state re-measured per workflow before publishing the claim - no code touched 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo has had no working CI. All 16 workflows return
startup_failurein 0s; the last 30 runs arestartup_failurewithout a single exception.That has a consequence worth stating before anything else: the two open PRs here (#53, #55) have never been verified by anything. Their green-looking absence of failures is an absence of checks.
Cause
Workflow-lockfile enforcement is active on this account, and this repo had no
.github/workflows/actions.lock.The cure, in four steps
Proven on haec#50 and trope-particularity-workbench#45. It takes four steps because each one's failure is invisible until the previous is fixed — they surface strictly one at a time:
gh actions-lock— generates the lockfile, normalises pins to readable tags.actions-lockinserts its own banner as line 1, and the workflow linter requires the SPDX header there — so the tool that cures the startup failures reddens every workflow file unless this is undone in the same commit.[]lockfile entry per reusable caller (6 here).gh actions-lockskips reusable-workflow callers, so without this they remainstartup_failurewhile everything else goes green — which reads as a partial fix rather than a missing step.bd0df9ead7fa, the commit that made the governance check lockfile-aware. Verified present via the commits API rather than copied.Expect failures
Nothing here has been checked in a long time. The first green run is a starting point, not a result — some of what surfaces will be real and long-standing. If two callers come back
startup_failureafter this, the cause is permission escalation (a reusable requesting more than its caller grants is rejected before any job starts, producing no log); that was the last residual on tpw#45.Found during the 2026-08-05 estate CI/CD census, which measured 8 repos mostly dead and 47 partly dead out of 421.
🤖 Generated with Claude Code