Repository navigation
ci: repin standards to metadatastician, adopt fork-governance, migrate K9 to contract v1.0.0 - #166
Merged
Merged
Conversation
Bring every tracked `*.k9.ncl` / `*.k9` file into line with the K9
contract v1.0.0 that standards' K9-DEED conformance lane enforces:
- 98 panel-clade configs: `K9!` magic line, SPDX header, and a
`pedigree` envelope (schema_version, component_type, security.leash
'Kennel, metadata.name/version/author, side_effects). The old top-level
name/version/magic_number/author/leash keys are folded into it.
Budgets.idr is unchanged (gen-budgets --check is current).
- 4 layout presets: `K9!` envelope with an inline 'Yard pedigree; the
preset is checked against pedigree-layout.ncl's contracts.
pedigree-layout.ncl exports its contracts by explicit binding (a bare
`{ Foo, }` field declares Foo without defining it) and PaneSizesSum100
uses std.contract.from_validator. database-design's `verisim_panel`
is renamed to the schema's `verisimdb_panel`.
- svc/k9 templates and the container deploy template are renamed to
`.k9.ncl.in` (templates are not instances, per the contract); the
setup-repo example is replaced by standards' canonical one, and the
references in the READMEs, manifests and TOPOLOGY are updated.
- generated/k9iser/*.k9 are untracked: .gitignore already ignores them.
Checked with standards' k9-validate.sh --strict --layer L2 at
1fdc61c: 106 pass, 1 routed (coordination.k9), 0 fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
hyperpolymath/standards moved to metadatastician/standards. Every caller pinned under the old owner failed at startup with "workflow was not found", because actions.lock recorded the old owner. - Repin governance, hypatia-scan, scorecard, secret-scanner and mirror to metadatastician/standards@1fdc61c (standards main), and rust-ci to metadatastician/standards@412a703 (same commit, new owner). - Add fork-governance.yml per standards' fork-governance ADOPTION.adoc: the DEED, K9-DEED and Hypatia lanes plus one PR comment, all at the same standards commit as canon-ref. DEED runs with require-files: false, since PanLL has no .deed files yet (standards #837). - hypatia-scan.yml loses its pull_request trigger (ADOPTION §3); fork-governance runs the Hypatia lane on PRs. - dogfood-gate.yml drops the k9-ecosystem validate-action job, which rejected the `K9!` envelope that contract v1.0.0 requires; the K9-DEED lane replaces it. - actions.lock: standards records re-keyed to metadatastician (owner_id 297579217), nested uses recomputed over every called file at 1fdc61c, and records nothing references any more are pruned. Verified with standards' check-actions-lock-gate.sh, validate-actions-lock.sh and update-actions-lock.sh --verify-local at 1fdc61c. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Contributor
|
Important Review skippedToo many files! This PR contains 122 files, which is 22 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.
 |
Owner
Author
|
The preflight checks every This PR can't avoid it:
No standards PR adds the pattern yet. Proposed one-line patch to --- a/rhodium-standard-repositories/actions-allowlist/allowed-actions.json
+++ b/rhodium-standard-repositories/actions-allowlist/allowed-actions.json
@@
"lycheeverse/lychee-action@*",
+ "metadatastician/*",
"mlugg/setup-zig@*",Once that lands, bump the standards pins here, and their Generated by Claude Code |
These are k9iser output, already ignored by .gitignore. The previous commit meant to untrack them but the removal was dropped while the change was split into commits, so the K9-DEED lane still scanned them and failed (no SPDX header, not Nickel). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
hyperpolymath
marked this pull request as ready for review
October 27, 2026 01:33
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Fork governance
Scope: the three lanes below are static checks at the named commit. A K9-DEED conformance🟢 conformant · commit
K9 live corpus (L0–L2): 1 finding(s) / scope notes
Scope: K9 components L0–L2 against contract v1.0.0 at the named standards commit. L3 signature verification and routed coordination-dialect files are not certified. Green is limited to this scope. Orange is missing evidence; yellow is grandfathered debt or warnings; grey is an explicit scope exclusion. report.json, badge.json and the validator logs are in the k9-grid artifact on the linked run. Hypatia verdict grid🔴 high · commit Advisory: 2 row(s), worst 🟢 clean (0 critical, 0 high) — reported, never grading the change.
Hypatia scan: 88 finding(s)
panic-attack assail: 62 finding(s)
pons asinorum: 16 finding(s)
Scope: static findings reported by each row's tool at the named commit. The table grades only findings in files this change touches, so the colour answers "does this change introduce anything?", not "what does the whole repository still carry?". Standing findings are counted in each accordion and in report.json; the baseline filter remains the place where acknowledged debt is recorded. The lane state is the worst GATING row; advisory rows are listed and counted but never set it. Purple, red, yellow and blue grade the worst GRADED finding present; orange is evidence missing, malformed or a scanner that did not run; grey is an explicit scope exclusion with its reason. No row is a security certification. report.json, badge.json and the raw findings are in the verdict-grid artifact on the linked run. |
Top-level permissions drop to contents: read; the job gets actions: read, contents: read and security-events: write, which is what hypatia-scan-reusable declares. pull-requests: write goes: the workflow no longer runs on pull_request. Addresses the Scorecard Token-Permissions alert on this file that fork-governance's Hypatia lane grades. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
The previous commit dropped it, so the workflow did not parse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e5b52dbfcb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
hyperpolymath
pushed a commit
that referenced
this pull request
Oct 27, 2026
#166 was squash-merged at 85e71b2; this branch carries the two review-fix commits that landed after it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3 # Conflicts: # .github/workflows/actions.lock # .github/workflows/dogfood-gate.yml # panel-clades/container/README.adoc # panel-clades/container/deploy.k9.ncl.in
Owner
Author
|
This PR was squash-merged at
Generated by Claude Code |
hyperpolymath
added a commit
that referenced
this pull request
Oct 27, 2026
… K9-aware layout docs (#167) ## Why #166 was squash-merged at `85e71b2`. Two follow-up commits that fix four of its Codex review findings were pushed after the merge, so they missed it. The review threads were resolved as "fixed in dc04df7 / 882dd75", but `main` does not have those fixes. This PR lands them. The branch carries a merge of the #166 squash. Its diff against `main` is exactly those two commits: 7 files, +226/−147. ## What **`dc04df7`: deploy template, Hunt grant, push coverage** - **`panel-clades/container/deploy.k9.ncl.in`** - Replaced with the K9 contract v1.0.0 template ported from rsr-template-repo and adapted to this layout (`container/`, `compose.toml`). It has the `K9!` envelope, a capability grant, `side_effects`, and a signature block. - `just container-init` now renders it to `container/deploy.k9.ncl` once no `{{…}}` token is left. It never overwrites an existing file. - Before this, nothing created the `deploy.k9.ncl` that the docs use. - **`.machine_readable/svc/k9/template-hunt.k9.ncl.in`** - Grants `net.fetch`, `fs.write` and `process.spawn`, which its `allow_*` flags request (K9-S007). - Adds the Ed25519 presence block (K9-S009). - **`dogfood-gate.yml`** - Runs the standards K9-DEED lane on pushes to `main`/`master`, so a direct push is checked again. - Pull requests still run the lane once, in `fork-governance.yml`. - `actions.lock` records the call. **`882dd75`: layout docs** - **`layouts/README.adoc`** validates presets with `k9-validate.sh`, and evaluates the Nickel body with `tail -n +2 <preset> | nickel export`, run from `layouts/`. - The `K9!` envelope is not Nickel, so the old direct `nickel typecheck layouts/*.k9.ncl` no longer works. ## Verification (local, standards `1fdc61c`) - **K9 corpus:** 106 pass, 1 routed (`coordination.k9`), 0 fail. - **Templates:** - A Hunt template copy with its TODOs filled passes `--strict --layer L2`. - The deploy template, rendered via `just container-init` with sample values, passes L2. - **Layouts:** `logic-and-proofs` exports. A preset whose pane sizes do not sum to 100 is still rejected. - **Workflows:** - Every workflow parses. - The duplicate-key check is clean. - The lock gate, the lock validator and `update-actions-lock.sh --verify-local` pass. - **Build checks:** the panel-clades Justfile parses, and `gen-budgets.sh --check` reports current. ## Known, not in this PR - `governance / Allowlist Preflight` stays red until standards' allowlist gains `"metadatastician/*"`. - Fork-PR comment posting is being fixed upstream in standards. Once that merges, panll adds the `fork-governance-publish.yml` caller. --- _Generated by [Claude Code](https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
hyperpolymath/standardsmoved tometadatastician/standards. Every workflow that calls a standards reusable now fails at startup with "workflow was not found". Those are Governance, Hypatia, Scorecard, Secret Scanner, Mirror and Rust CI. The cause is thatactions.lockstill records the old owner (owner_id 6759885).This PR also adopts standards' fork-governance bundle, so DEED, K9-DEED and Hypatia report in one PR comment. To make the K9-DEED lane pass, every K9 file is migrated to contract v1.0.0.
What
CI (
cb77f07)metadatastician/standards@1fdc61c(standardsmain).metadatastician/standards@412a703: the same commit, under the new owner.fork-governance.yml(new), per standards'3-practice/fork-governance/ADOPTION.adoc:deed-conformance,k9-conformanceandhypatia-scan-reusablelanes, thenfork-governance-reusable, which posts one comment and updates it in place.canon-refuse the same SHA.require-files: false. PanLL has no.deedfiles yet; its manifests are still.a2mluntil the estate-wide migration in standards #837. The lane therefore reports grey, not red.hypatia-scan.ymlno longer triggers onpull_request(ADOPTION §3). Fork-governance runs the Hypatia lane on PRs; push, schedule and dispatch are unchanged.dogfood-gate.yml: the k9-ecosystemvalidate-actionjob is removed. It rejects theK9!envelope that contract v1.0.0 requires, so it and the K9-DEED lane could never both pass.actions.lock:metadatastician/standards(owner_id 297579217; repo_id 1116521501 is unchanged).uses:list is recomputed over every called file at 1fdc61c, including the three fork-governance reusables.git ls-remote.k9-ecosystem@main, plus the olddtolnay/scorecard-actionSHAs.K9 contract v1.0.0 (
4b1065f)panel-clades/clades/*/config.k9.ncl:K9!line and an SPDX header, and has apedigreeenvelope with these fields:schema_versioncomponent_typesecurity.leash = 'Kennelmetadataside_effectsname,version,magic_number,authorandleashkeys are folded into the envelope.Budgets.idris unchanged;gen-budgets.sh --checkreports it current.K9!envelope and an inline'Yardpedigree, and is checked againstpedigree-layout.ncl's contracts.PaneSizesSum100now usesstd.contract.from_validator.verisim_panelis renamed to the schema'sverisimdb_panel..k9.ncl.in: the three insvc/k9, pluspanel-clades/container/deploy. References to them are updated. Thesetup-repoexample is replaced with standards' canonical one.generated/k9iser/*.k9are no longer tracked..gitignorealready ignored them.Verification (local, against standards at 1fdc61c)
k9-validate.sh --strict --layer L2 --jsonover every tracked*.k9.ncl/*.k9file gives 106 pass, 1 routed (coordination.k9), 0 fail.check-actions-lock-gate.sh,validate-actions-lock.shandupdate-actions-lock.sh --verify-localall pass.permissions:.Not in this PR
.a2ml→.deedmanifest migration (standards #837): the DEED lane stays grey until then.vars.GITEA_HOSTand the Disroot repo.panel-clades/.github/workflows/is a nested copy that GitHub does not run, so it is left untouched.Generated by Claude Code