Skip to content

Commit 4e40494

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
Axiom flagship (4) — estate tooling: Aqua/JET/Documenter/test-gate + k9/panic-attack/RSR (#49)
## Summary Tier‑2 of the flagship effort: wires the estate/ecosystem tooling that makes Axiom.jl *demonstrably* best‑practice and CI‑gated. Two disjoint work‑streams, independently verified before commit (gaps G07, G08, G13, G14, G15, G16). ## Quality & testing - **Aqua** (`test/aqua.jl`): `Aqua.test_all(Axiom)` passes **all 11 checks with zero overrides**. Along the way it found + fixed a **real unbound‑type‑param bug** in `LayerNorm`/`InstanceNorm`/`GroupNorm` inner constructors, and removed the **stale `JSON3` dep** (its only consumer, dead `huggingface.jl`, isn't `include`d). (G07) - **JET** (`test/jet.jl`): `JET.test_package(Axiom; target_modules=(Axiom,))` — **zero** Axiom‑rooted errors, scoped via JET's own mechanism, no hand‑rolled allowlist. (G07) - **`[compat]` closure** (G08): upper‑bounded compat for all six weakdeps + stdlibs + extras; `Zygote` widened `0.6 → 0.6,0.7` (resolves to 0.7.11, suite unchanged). - **Documenter** (`docs/`) (G13): `docs/make.jl` builds with **doctests**; fixed the proxy‑URL remote detection and split the API into 4 pages under Documenter's size limit. - **Julia test‑gate CI** (`.github/workflows/julia-test.yml`): builds the **crypto cdylib before `Pkg.test`** — closing a real gap where the 27 hybrid‑signing tests had been silently `@test_skip`'d in CI. Matrix `1.10` + `1` + nightly(continue‑on‑error); no `on.*.paths`. ## Compliance & gates - **`k9iser.toml`** (G15): safety‑tier `fv`, constraints over `Project.toml` / `axiom-abi.ipkg` / `crypto/`. - **panic‑attack gate** (`static-analysis-gate.yml`) + Justfile `assail` recipe fixed (`panic-attacker`→`panic-attack`) (G14). First real `assail` run: **0 critical**, 2 high (the legitimate crypto/FFI `unsafe` boundary — tracked for P5 audit, not suppressed here). - **`estate-rules.yml`** — correctly bans **V‑lang**, explicitly **not** Zig (Axiom legitimately ships a Zig compute layer) — plus RSR files: `docs/legal/EXHIBIT-A/B`, `docs/governance/*`, `.machine_readable/policies/*`. (G16) ## Verification (independent re‑run) - `Pkg.test()` → **709 / 709 pass** (697 + 11 Aqua + 1 JET); Aqua/JET green. - `docs/make.jl` builds clean with doctests; `Pkg.resolve()` clean. - No licence/`NOTICE` files touched; **no private‑key material**; SPDX on every new file. ## Residuals (tracked) - Dead `huggingface.jl` (its stale dep is removed here; deletion belongs to the doc‑reconciliation/tier‑3 pass). - The 2 high `assail` findings (legit FFI/crypto `unsafe`) get audited `assail-classifications.a2ml` entries in P5. - `standards/julia-ci-reusable.yml` refactor (G40) + the flagship measuring‑stick rubric (P8) are the tier‑2 tail. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1 --- _Generated by [Claude Code](https://claude.ai/code/session_01UPFC9YQ7g9gc3VnRox42Q1)_ Co-authored-by: Claude <noreply@anthropic.com>
1 parent cf82ad6 commit 4e40494

26 files changed

Lines changed: 1709 additions & 10 deletions

‎.github/workflows/Documentation.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
4+
# Documenter build + (main-branch only) GitHub Pages deploy (G13).
5+
#
6+
# Per the estate required-check rule: no `on.*.paths` filter -- this
7+
# workflow always runs so it is never stuck "Expected" on unrelated PRs.
8+
9+
name: Documentation
10+
11+
permissions:
12+
contents: read
13+
pages: write
14+
id-token: write
15+
16+
on:
17+
push:
18+
branches: [main]
19+
pull_request:
20+
branches: [main]
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.ref }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
build:
28+
name: Build docs (Documenter, with doctests)
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
32+
33+
- uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2
34+
with:
35+
version: '1.10'
36+
37+
- uses: julia-actions/cache@e33b4bfa0ea7cd9caedd7cb82b0e36956ef40285 # v2
38+
39+
- name: Build documentation (doctest=true)
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
DOCUMENTER_KEY: ${{ secrets.DOCUMENTER_KEY }}
43+
run: julia --project=docs docs/make.jl

‎.github/workflows/estate-rules.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# SPDX-FileCopyrightText: 2026 Axiom.jl Contributors
3+
#
4+
# Estate Rules — enforces hyperpolymath estate-wide conventions relevant to a
5+
# Julia numerics package: no-Python (banned estate-wide, replacement is
6+
# Julia/Rust/AffineScript), AsciiDoc-by-default under docs/ (excluding the
7+
# docs/wiki/ GitHub-wiki mirror, which is legitimately Markdown because
8+
# GitHub's wiki renderer consumes .md, not .adoc), and no V-lang (vlang.io)
9+
# references — NOT a ban on Zig. Zig is the current estate default for
10+
# APIs/FFI/gateways (hyperpolymath/standards CLAUDE.md, "Estate default
11+
# 2026-05-28"), and Axiom.jl legitimately ships a Zig compute layer
12+
# (zig/, ffi/zig/); a same-named check adapted from an older template
13+
# repo had inverted this (banning the string "zig" itself, seemingly from a
14+
# botched V-lang-ban rename) — do not repeat that mistake here.
15+
#
16+
# Checks are inlined (no external scripts/ dependency) because this repo's
17+
# .github/workflows/ ownership does not include a scripts/ directory of its
18+
# own for these checks.
19+
name: Estate Rules
20+
on:
21+
push:
22+
branches: [main]
23+
pull_request:
24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref }}
26+
cancel-in-progress: true
27+
permissions:
28+
contents: read
29+
jobs:
30+
estate-rules:
31+
runs-on: ubuntu-latest
32+
timeout-minutes: 15
33+
steps:
34+
- name: Checkout
35+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
37+
- name: No Python anywhere (estate-banned; Julia/Rust/AffineScript only)
38+
run: |
39+
HITS=$(find . -type f \( -name '*.py' -o -name '*.pyi' \) \
40+
-not -path './crypto/target/*' \
41+
-not -path './.git/*' \
42+
2>/dev/null || true)
43+
if [ -n "$HITS" ]; then
44+
echo "::error::Python files found — Python is fully banned estate-wide:"
45+
echo "$HITS"
46+
exit 1
47+
fi
48+
echo "PASS: no Python files found"
49+
50+
- name: AsciiDoc by default under docs/ (excluding docs/wiki/ GitHub-wiki mirror)
51+
run: |
52+
HITS=$(find docs -name '*.md' -type f -not -path 'docs/wiki/*' 2>/dev/null || true)
53+
if [ -n "$HITS" ]; then
54+
echo "::error::.md files found under docs/ outside the docs/wiki/ mirror (estate rule: AsciiDoc by default):"
55+
echo "$HITS"
56+
exit 1
57+
fi
58+
echo "PASS: no disallowed .md files under docs/ (docs/wiki/ is the GitHub-wiki Markdown mirror, exempt by design)"
59+
60+
- name: No V-lang references (Zig is the estate default — do not confuse the two)
61+
run: |
62+
# V-lang (vlang.io) was banned 2026-04-10, superseded by Zig. This
63+
# check must NOT match "zig" — Zig is the estate default for
64+
# APIs/FFI/gateways and Axiom.jl ships a legitimate Zig compute
65+
# layer under zig/ and ffi/zig/.
66+
PATTERNS='vlang|v-lang|V-lang|asdf-vlang'
67+
HITS=$(grep -rniE "$PATTERNS" . \
68+
--exclude-dir=.git \
69+
--exclude-dir=node_modules \
70+
--exclude-dir=target \
71+
--include='*.jl' --include='*.rs' --include='*.toml' \
72+
--include='*.zig' --include='*.idr' --include='*.adoc' \
73+
--include='*.a2ml' --include='Justfile' \
74+
2>/dev/null || true)
75+
if [ -n "$HITS" ]; then
76+
echo "::error::V-lang reference(s) found (estate rule: V-lang is banned, replaced by Zig):"
77+
echo "$HITS"
78+
exit 1
79+
fi
80+
echo "PASS: no V-lang references found"

‎.github/workflows/julia-test.yml‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3+
4+
# Julia test gate (required check).
5+
#
6+
# `ci.yml`'s `julia-compat` job runs `Pkg.test()` but never builds the
7+
# hybrid Ed448+Dilithium5 crypto cdylib (crypto/), so
8+
# `test/verification/hybrid_signing_tests.jl` always takes the
9+
# `@test_skip` branch there and the real signing path is never exercised
10+
# in CI. This workflow builds the crypto shim first so those tests
11+
# actually run, and also runs the new Aqua/JET quality-gate testsets
12+
# (test/aqua.jl, test/jet.jl).
13+
#
14+
# Per the estate required-check rule: no `on.*.paths` filter on a required
15+
# gate -- a path-filtered required workflow that never triggers is
16+
# reported as permanently "Expected" and blocks merges. This workflow
17+
# always runs.
18+
19+
name: Julia Test Gate
20+
21+
permissions:
22+
contents: read
23+
24+
on:
25+
push:
26+
branches: [main, develop]
27+
pull_request:
28+
branches: [main]
29+
schedule:
30+
- cron: '0 0 * * 0'
31+
32+
concurrency:
33+
group: ${{ github.workflow }}-${{ github.ref }}
34+
cancel-in-progress: true
35+
36+
env:
37+
JULIA_NUM_THREADS: 2
38+
39+
jobs:
40+
test:
41+
name: Julia ${{ matrix.julia-version }} (crypto-enabled) - ubuntu-latest
42+
runs-on: ubuntu-latest
43+
strategy:
44+
fail-fast: false
45+
matrix:
46+
# 1.10 is the LTS floor declared in Project.toml's `[compat] julia`;
47+
# '1' resolves to the current stable release.
48+
julia-version: ['1.10', '1']
49+
50+
steps:
51+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
52+
53+
- name: Install Rust toolchain
54+
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
55+
56+
- name: Cache Cargo (crypto shim)
57+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
58+
with:
59+
path: |
60+
~/.cargo/registry
61+
~/.cargo/git
62+
crypto/target
63+
key: ${{ runner.os }}-cargo-crypto-${{ hashFiles('crypto/Cargo.lock') }}
64+
65+
- name: Build hybrid-signing crypto cdylib
66+
run: cd crypto && cargo build --release
67+
68+
- uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2
69+
with:
70+
version: ${{ matrix.julia-version }}
71+
72+
- uses: julia-actions/cache@e33b4bfa0ea7cd9caedd7cb82b0e36956ef40285 # v2
73+
74+
- name: Instantiate / Build / Precompile / Test
75+
run: julia --project=. -e 'using Pkg; Pkg.instantiate(); Pkg.build(); Pkg.precompile(); Pkg.test()'
76+
77+
test-nightly:
78+
name: Julia nightly (crypto-enabled) - ubuntu-latest
79+
runs-on: ubuntu-latest
80+
continue-on-error: true
81+
steps:
82+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
83+
84+
- name: Install Rust toolchain
85+
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
86+
87+
- name: Cache Cargo (crypto shim)
88+
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
89+
with:
90+
path: |
91+
~/.cargo/registry
92+
~/.cargo/git
93+
crypto/target
94+
key: ${{ runner.os }}-cargo-crypto-${{ hashFiles('crypto/Cargo.lock') }}
95+
96+
- name: Build hybrid-signing crypto cdylib
97+
run: cd crypto && cargo build --release
98+
99+
- uses: julia-actions/setup-julia@4c0cb0fce8556fdb04a90347310e5db8b1f98fb9 # v2
100+
with:
101+
version: nightly
102+
103+
- uses: julia-actions/cache@e33b4bfa0ea7cd9caedd7cb82b0e36956ef40285 # v2
104+
105+
- name: Instantiate / Build / Precompile / Test
106+
run: julia --project=. -e 'using Pkg; Pkg.instantiate(); Pkg.build(); Pkg.precompile(); Pkg.test()'

0 commit comments

Comments
 (0)