feat(aggregator): estate organization — manifest, thread runner, generated superproject by hyperpolymath · Pull Request #63 · hyperpolymath/reposystem

hyperpolymath · 2026-05-18T22:34:11Z

What

Establishes the one-aggregator organization for the ~300-repo estate so the dual-layout confusion (flat clones vs. stale submodule superproject) is removed.

The rule: flat clones in $REPOS_DIR = single source of truth · reposystem = coordination layer · repos-monorepo = generated output (Pages/mirror/governance keep working).

Changes

repos.toml — generated manifest of all 297 estate repos (just repos-manifest)
repos.groups.toml — hand-maintained epic/group index, survives regeneration
scripts/thread.sh — cross-repo thread runner; each repo merges via its own PR
scripts/sync-aggregator.sh — regenerates repos-monorepo as generated artifact; per-submodule walk survives the URL-less .git-private-farm entry
scripts/gen-repos-manifest.sh — .gitmodules → repos.toml generator
ESTATE-ORGANIZATION.adoc — the rule + migration checklist
Justfile — new recipes; fixes a pre-existing parse-breaking dedent in doctor that was breaking the entire Justfile

Notes

No STATE/contractiles/.bot_directives changes.
Verified: just --list parses; just repos-manifest → 297 entries; sync-aggregator dry-run no longer aborts on .git-private-farm.

🤖 Generated with Claude Code

github-actions · 2026-05-19T11:28:05Z

🔍 Hypatia Security Scan

Findings: 195 issues detected

Severity	Count
🔴 Critical	14
🟠 High	112
🟡 Medium	69

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/reposystem/reposystem/tools/rsr-certified/extensions/vscode/src/extension.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/browser-extension/scripts/popup.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/browser-extension/scripts/content.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (4 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/dashboard/js/dashboard.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/annotation-layer/annotations.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (7 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/web/app.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in code -- use HTTPS for non-localhost (16 occurrences, CWE-319)",
    "type": "js_http_url_in_code",
    "file": "/home/runner/work/reposystem/reposystem/web/app.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…rated superproject Establish one source of truth + one coordination layer: - repos.toml: generated manifest of all 297 estate repos (regen: just repos-manifest) - repos.groups.toml: hand-maintained epic/group index (survives regen) - scripts/thread.sh: cross-repo thread runner; each repo merges via its own PR - scripts/sync-aggregator.sh: regenerate repos-monorepo as a generated artifact; per-submodule walk to survive the URL-less .git-private-farm entry - scripts/gen-repos-manifest.sh: .gitmodules -> repos.toml generator - ESTATE-ORGANIZATION.adoc: the rule + migration checklist - Justfile: add repos-manifest/thread/sync-aggregator/aggregator-drift recipes; fix pre-existing parse-breaking dedent in the doctor recipe (panic-attack block) that was breaking the entire Justfile No STATE/contractiles/.bot_directives changes. Not pushed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

sync-aggregator leaves repos with stale .gitmodules URLs as `warn ... left as-is` (root cause: GitHub repo rename, e.g. snif -> snifs). This script resolves each warned submodule's canonical name via the GitHub API (follows rename redirects), rewrites submodule.<name>.url, and `git submodule sync`s. DRY-RUN default; --apply writes .gitmodules (no commit/push). Hard guard: refuses to run while sync-aggregator.sh is active (git lock contention). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- gen-repos-manifest.sh now emits SPDX header into repos.toml (estate requires SPDX on all files); manifest regenerated - README.adoc: add discoverable "Estate Organization" section linking ESTATE-ORGANIZATION.adoc (was orphaned) - ESTATE-ORGANIZATION.adoc: document the deliberate generated-file exception vs 0-AI-MANIFEST.a2ml policy - STATE.a2ml: record this work in metadata/recent-changes/session-history per 0-AI-MANIFEST.a2ml delivery promise (was stale at 2026-04-25) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ne separately Empirical finding from the live pointer reconcile: warns are NOT one class. At 239/297 sync there are 57 warns spanning renames, over-declared repos that never existed (URL already basename-correct — a rewrite cannot help), wiki entries, and transient blips. Rebuild fix-stale-submodule-urls.sh as a classifier: - RENAMED -> --apply-renames (safe URL rewrite) - NONEXISTENT -> --prune-nonexistent (destructive, separately gated) - WIKI -> --prune-nonexistent (labelled) - TRANSIENT -> re-run sync-aggregator (no action) Section lookup handles slash/leading-dot paths. Lock guard + no-commit behaviour retained. ESTATE-ORGANIZATION.adoc documents the four classes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

`gh api` writes its error JSON body to STDOUT on 4xx, so a bare capture yielded `{"message":"Not Found"...}` and was mis-read as a value — every NONEXISTENT repo was misclassified RENAMED with a corrupt `git@github.com:{...}.git` target. --apply-renames would have written garbage URLs into the published .gitmodules. Add canon_name() which strictly validates the result matches ^owner/name$. Verified on the full 80-warn set: RENAMED 69->2 (snif->snifs, panic-attacker->panic-attack), NONEXISTENT 0->67, WIKI 2, TRANSIENT 9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…odules A .gitmodules-only prune leaves an orphan gitlink in the tree (status disagreement). Prune now also git-rm --cached the path, drops the stale .git/config section, and removes the empty placeholder dir. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-19T16:17:45Z

🔍 Hypatia Security Scan

Findings: 195 issues detected

Severity	Count
🔴 Critical	14
🟠 High	112
🟡 Medium	69

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/reposystem/reposystem/tools/rsr-certified/extensions/vscode/src/extension.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/browser-extension/scripts/popup.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/browser-extension/scripts/content.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (4 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/dashboard/js/dashboard.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/stateful-artefacts/annotation-layer/annotations.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (7 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/reposystem/reposystem/web/app.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in code -- use HTTPS for non-localhost (16 occurrences, CWE-319)",
    "type": "js_http_url_in_code",
    "file": "/home/runner/work/reposystem/reposystem/web/app.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-05-19T16:20:48Z

Rebased onto current main (12 commits ahead); only conflict was the additive STATE.a2ml history log — resolved as a union of both the repo-batcher #56 and estate-aggregator entries. The one red check (Language / package anti-pattern policy) is pre-existing ReScript baseline rot (gui/src/*.res, scaffoldia/repo-batcher/examples/*.res, etc. — all on main): this PR adds zero banned-language files (only .sh/.toml/.adoc/.yml). That ReScript bucket is the separate #229 workstream. Not a required check; merging.

hyperpolymath and others added 6 commits May 19, 2026 17:15

hyperpolymath force-pushed the feat/estate-aggregator-organization branch from 5e2a28b to f8b77f8 Compare May 19, 2026 16:16

hyperpolymath merged commit 58df095 into main May 19, 2026
12 of 13 checks passed

hyperpolymath deleted the feat/estate-aggregator-organization branch May 19, 2026 16:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(aggregator): estate organization — manifest, thread runner, generated superproject#63

feat(aggregator): estate organization — manifest, thread runner, generated superproject#63
hyperpolymath merged 6 commits into
mainfrom
feat/estate-aggregator-organization

hyperpolymath commented May 18, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

github-actions Bot commented May 19, 2026

Uh oh!

hyperpolymath commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented May 18, 2026

What

Changes

Notes

Uh oh!

github-actions Bot commented May 19, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented May 19, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant