Skip to content

chore(ci): clear the two in-repo governance false-positives (LICENSE SPDX + trusted-base)#329

Merged
hyperpolymath merged 2 commits into
mainfrom
claude/governance-ci-falsepos
Jun 27, 2026
Merged

chore(ci): clear the two in-repo governance false-positives (LICENSE SPDX + trusted-base)#329
hyperpolymath merged 2 commits into
mainfrom
claude/governance-ci-falsepos

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Two governance checks have been red on every PR (#322#324) for reasons unrelated to any diff — both are repo-level. This clears the two that are in ephapax's control. Fixes were derived from the exact standards@d135b05 check-script regexes (fetched via raw HTTPS and verified locally, not guessed).

1. governance / Licence consistency

Root LICENSE is the verbatim MPL-2.0 text with no SPDX header. check-licence-consistency.sh does:

grep -m1 -E '^[[:space:]]*SPDX-License-Identifier:' "$lic_file"

then normalises the identifier and checks it matches the manifest. Fix: prepend SPDX-License-Identifier: MPL-2.0 (normalises to mpl-2.0, matches Cargo.toml license = "MPL-2.0"). Verified the grep now matches.

2. governance / Trusted-base reduction policy

check-trusted-base.sh flags ^[[:space:]]*(Axiom|Admitted|admit\.). formal/RegionEnvL1.v:17 is a prose comment"Axiom budget: this file is axiom-free" — that happens to start with "Axiom". A false positive. Fix: reword to "On the axiom budget: …" so the line no longer matches (verified).

Chosen over a .trusted-base-ignore entry deliberately: the file stays fully scanned, so a genuine future axiom there is still caught — and a TRUSTED:/AXIOM: inline annotation would be false (the file really is axiom-free; that's the whole point of RegionEnvL1.v).

Not fixable here

scan / Hypatia Neurosymbolic Analysis fails on an Elixir CompileError (real_subdirs) inside the standards/Hypatia repo — out of ephapax's reach. Flagging, not fixing.

Verification

  • Both fixes checked against the actual fetched regexes (standards@d135b05).
  • formal/RegionEnvL1.v still compiles under coqc 8.18.0 (comment-only change).
  • 2 files, +3/−1.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AGFqWzByua4dKbA7W7oVsL


Generated by Claude Code

Two governance checks have been red on every PR for reasons unrelated to
any diff; both are repo-level. Fixed against the exact standards@d135b05
check regexes (fetched + verified, not guessed):

- Licence consistency: root LICENSE (verbatim MPL-2.0 text) had no SPDX
  header. check-licence-consistency.sh greps `^SPDX-License-Identifier:`
  and normalises it against the manifest. Prepend
  `SPDX-License-Identifier: MPL-2.0` (matches Cargo.toml `license = "MPL-2.0"`).

- Trusted-base reduction policy: check-trusted-base.sh flags
  `^[[:space:]]*(Axiom|Admitted|admit\.)`; formal/RegionEnvL1.v:17 is a
  PROSE comment ("Axiom budget: this file is axiom-free") that starts with
  "Axiom" — a false positive. Reworded to "On the axiom budget: …" so the
  line no longer matches. Chosen over a .trusted-base-ignore entry on
  purpose: the file stays fully scanned, so a genuine future axiom there is
  still caught (and a TRUSTED:/AXIOM: annotation would be false — the file
  really is axiom-free).

Hypatia's own Elixir CompileError lives in the standards repo and is out of
ephapax's reach. RegionEnvL1.v still compiles (comment-only change).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AGFqWzByua4dKbA7W7oVsL
@hyperpolymath
hyperpolymath marked this pull request as ready for review June 27, 2026 18:35
@hyperpolymath
hyperpolymath merged commit bb83b7e into main Jun 27, 2026
14 of 15 checks passed
@hyperpolymath
hyperpolymath deleted the claude/governance-ci-falsepos branch June 27, 2026 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants