Skip to content

docs: record tech-debt audit findings (2026-05-26)#26

Merged
hyperpolymath merged 1 commit into
mainfrom
claude/tech-debt-2026-05-26
May 28, 2026
Merged

docs: record tech-debt audit findings (2026-05-26)#26
hyperpolymath merged 1 commit into
mainfrom
claude/tech-debt-2026-05-26

Conversation

@hyperpolymath
Copy link
Copy Markdown
Owner

Adds docs/tech-debt-2026-05-26.md with this repo's findings from the estate-wide tech-debt scan: proof debt, licence debt, documentation debt.

This file records the findings only — it does not close the debt.

Cross-references:

Adds docs/tech-debt-2026-05-26.md with this repo's findings from the
estate-wide tech-debt scan: proof debt, licence debt, documentation
debt.

This file records the findings only — it does not close the debt.

Cross-references:
- hyperpolymath/standards#195 (estate proof-debt audit)
- hyperpolymath/standards#196 (estate licence-debt audit)
- hyperpolymath/standards#197 (estate documentation-debt audit)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hyperpolymath hyperpolymath merged commit 4b2d48e into main May 28, 2026
37 of 46 checks passed
@hyperpolymath hyperpolymath deleted the claude/tech-debt-2026-05-26 branch May 28, 2026 23:59
@github-actions
Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 78 issues detected

Severity Count
🔴 Critical 2
🟠 High 5
🟡 Medium 71

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Backup file in root",
    "type": "stale",
    "file": "META.scm.bak",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Backup file in root",
    "type": "stale",
    "file": "ECOSYSTEM.scm.bak",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Merge artifact in root",
    "type": "stale",
    "file": "SPEC.core.scm.orig",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dependabot-automerge.yml",
    "type": "unknown",
    "file": "dependabot-automerge.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "unknown",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath added a commit that referenced this pull request Jun 2, 2026
…36)

Validator PR #26 (merged 2026-06-01) taught the action to recognise
both TOML `name = "x"` AND s-expression `(name "x")` identity
and version forms. The pre-fix SHA only matched TOML, so any
`.a2ml` file using s-expression dialect (idiomatic in campaign
reports and audit registries) failed Dogfood Gate with
"Missing required identity field" even when the field was
structurally present.

Real-world bite: hyperpolymath/panic-attack#94 hit this on
docs/campaigns/2026-05-26.a2ml on 2026-06-01.

This bump is purely a workflow SHA refresh; no behavioural change
for repos that don't carry s-expression manifests.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant