Skip to content

Proofs-first alignment checkpoint — Echo Types accommodation#24

Merged
hyperpolymath merged 4 commits into
mainfrom
claude/affinescript-julia-viper-alignment-4guGJ
Jun 2, 2026
Merged

Proofs-first alignment checkpoint — Echo Types accommodation#24
hyperpolymath merged 4 commits into
mainfrom
claude/affinescript-julia-viper-alignment-4guGJ

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Jun 2, 2026

Copy link
Copy Markdown
Owner

Summary

A scope-frozen, proofs-first alignment checkpoint for Julia the Viper: it moves JtV toward the hyperpolymath/affinescript maturity/governance posture starting from proofs, and accommodates the echo-types loss taxonomy in the type checker.

This PR is intentionally a checkpoint, not an umbrella — build repair and Echo runtime implementation land in dedicated follow-up PRs (see Follow-ups).

echo-types (Agda) defines the echo of f at y as the fibre Echo f y := Σ x, f x ≡ y. Echo's semantic object is retained-loss lineage — proof-relevant provenance of collapsed/weakened/sampled/projected/degraded information — not a generic Σ-type or a decorative effect. Levels: EchoSafe ⊑ EchoNeutral ⊑ EchoBreaking.

What's here

Proofs first

  • jtv_proofs/JtvEcho.lean — Echo as a bounded join-semilattice, the reverse-block contract blockEcho_admissible, and the fibre/lineage correspondence with echo-types (injective_fibre_subsingleton, residue_lossy). sorry-free; wired into lakefile.lean / proof-regression.yml. Authoritative for JtV Echo semantics.

Type checker (accommodate echo-types)

  • crates/jtv-core/src/echo.rs — executable image of JtvEcho.lean (lattice, join, admissibility, statement classifier).
  • typechecker.rs — reverse blocks admit only EchoSafe (JtvError::EchoViolation), realising blockEcho_admissible; + tests.

Governance / spec

  • ALIGNMENT-AFFINESCRIPT.adoc (gap analysis + phased roadmap + decisions of record), verification/PROOF-CAPABILITY-MATRIX.adoc, academic/TODO_GAPS.md (doc-truthing: proofs are sorry-free), spec/jtv_v2_type_system_corrected.adoc (§7 @echo, §8 anchored to echo-types, §12 numeric-conversion echo).

Settled Echo decisions (now recorded, no longer open)

  • Effect now, value later — Echo is an effect-classification dimension; AST/grammar shape reserved so a value-level Echo<T> can be added later without redesign.
  • Reverse blocks: Safe-onlyNeutral/Breaking rejected (stricter than the prior spec; matches current interpreter reality). Neutral admission later requires an explicit carried Bennett residue.
  • Echo source: infer + @echo(safe|neutral|breaking) — inferred by default, with checked annotations where needed (boundaries / foreign calls / audited APIs); not infer-only, not annotation-everywhere.
  • Numeric conversions carry echo (3-way) — exact/injective ⇒ Safe; lossy + residue ⇒ Neutral; lossy without usable residue ⇒ Breaking (Float→Int per residue retention). Value type unaffected.
  • Formal layerJtvEcho.lean authoritative now; echo-types Agda is the conceptual reference; the Agda↔Lean bridge is deferred to Phase 4; grammar v2 is not blocked on it.

CI status — the red is pre-existing infra, handled by the build-truth follow-up

This checkpoint deliberately does not repair the repo's pre-existing build/CI breakage — that is the explicit job of the next PR. Known-red and out of scope here:

  • rust.yml targets a different project's layout (packages/jtzig, tools/cli) and the crate depends on an unvendored sibling patacl-core (../patacl) → Check / Clippy / Format / test fail.
  • ast.rs ↔ code drift: ControlStmt lacks the ReversibleBlock / ReverseToken / AbandonToken variants that interpreter.rs, typechecker.rs, and jtv-cli already match on → the crate does not build as committed (contradicts STATUS.md's "100% Complete"). My additions reference only real variants and were validated in isolation.
  • proof-regression.yml (Lean) startup-fails (run created with 0 jobs) — infra, not a proof error.
  • Governance/Hypatia "rest" (un-pinned coverage.yml / governance.yml / generator…, missing secret-scanner.yml, missing timeout-minutes, curl|sh) and the banned vscode-extension TypeScript.

Follow-ups (separate PRs, in order)

  1. Build-truth — delete stale rust.yml (keep rust-ci.yml), vendor/feature-gate patacl-core, fix the ast.rs variant drift → jtv-core compiles and the Lean job actually runs.
  2. Phase-2 Echo implementation — parse @echo, thread echo through infer_data_expr, numeric-conversion classification, reserved Echo<T> AST node, Lean updates + tests.
  3. echo-types benchmarks — cross-estate; once echo-types and EchoTypes.jl are in scope (Agda-artifact benches across elaboration / normalization / MAlonzo runtime, scaling along Echo lineage chains; CI tiers).

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG


Generated by Claude Code

@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 119 issues detected

Severity Count
🔴 Critical 13
🟠 High 14
🟡 Medium 92

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action tions/cache@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "proof-regression.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "generator-generic-ossf-slsa3-publish.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "rust.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath
hyperpolymath marked this pull request as ready for review June 2, 2026 14:04
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 119 issues detected

Severity Count
🔴 Critical 13
🟠 High 14
🟡 Medium 92

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action tions/cache@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "proof-regression.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action dtolnay/rust-action@stable needs attention",
    "type": "unpinned_action",
    "file": "rust.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "generator-generic-ossf-slsa3-publish.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "rust.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath pushed a commit that referenced this pull request Jun 2, 2026
Folds the approved CI action-pinning into PR #24 (G2/G3 governance).

- proof-regression.yml: pin actions/cache@v4 -> @6849a648 (SHA already
  trusted in rust.yml). Unblocks the Lean proof job so JtvEcho.lean is
  actually built/verified by CI.
- rust.yml: replace unpinned, mis-named dtolnay/rust-action@stable with
  the trusted dtolnay/rust-toolchain@4be9e76 # stable (×4), and add a
  permissions: contents: read block. Clears the Hypatia unpinned_action
  + missing_permissions findings for rust.yml.

Note: rust.yml's *build* jobs will still fail — it targets a different
project's layout (packages/jtzig, tools/cli, which don't exist here) and
the crate depends on the unvendored sibling patacl-core. That is Phase-3
build-truth work; rust-ci.yml is the correctly-configured Rust workflow.

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 112 issues detected

Severity Count
🔴 Critical 13
🟠 High 13
🟡 Medium 86

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "generator-generic-ossf-slsa3-publish.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "proof-regression.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in coverage.yml",
    "type": "missing_timeout_minutes",
    "file": "coverage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno.yml",
    "type": "missing_timeout_minutes",
    "file": "deno.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

2 similar comments
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 112 issues detected

Severity Count
🔴 Critical 13
🟠 High 13
🟡 Medium 86

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "generator-generic-ossf-slsa3-publish.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "proof-regression.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in coverage.yml",
    "type": "missing_timeout_minutes",
    "file": "coverage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno.yml",
    "type": "missing_timeout_minutes",
    "file": "deno.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 112 issues detected

Severity Count
🔴 Critical 13
🟠 High 13
🟡 Medium 86

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "No permissions declaration -- add permissions: read-all",
    "type": "missing_permissions",
    "file": "generator-generic-ossf-slsa3-publish.yml",
    "action": "add_permissions",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "proof-regression.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in coverage.yml",
    "type": "missing_timeout_minutes",
    "file": "coverage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno.yml",
    "type": "missing_timeout_minutes",
    "file": "deno.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath hyperpolymath changed the title Commence AffineScript alignment — Echo Types, proofs-first Proofs-first alignment checkpoint — Echo Types accommodation Jun 2, 2026
claude added 4 commits June 2, 2026 18:39
Begins moving JtV to AffineScript's maturity/governance position, starting
with proofs, and accommodates the echo-types loss taxonomy in the checker.

Proofs (first):
- jtv_proofs/JtvEcho.lean: formalise JtV's Echo system (spec v2 §8-9) as a
  bounded join-semilattice (Safe ⊑ Neutral ⊑ Breaking) with the reverse-block
  admissibility contract (blockEcho_admissible) and the fibre correspondence
  with the echo-types Agda library (Echo f y := Σ x, f x = y). Wired into
  lakefile.lean / proof-regression CI. sorry-free.

Type checker (accommodate echo-types):
- crates/jtv-core/src/echo.rs: executable image of JtvEcho.lean — Echo lattice,
  join, admissibility, statement classifier (validated against AST stubs).
- typechecker.rs: reverse blocks rejected when aggregate echo is Breaking
  (JtvError::EchoViolation) — realises blockEcho_admissible. + tests.

Governance (adopt the AffineScript matrix discipline):
- ALIGNMENT-AFFINESCRIPT.adoc: gap analysis + phased roadmap (proofs first).
- verification/PROOF-CAPABILITY-MATRIX.adoc: authoritative proof-status matrix.
- academic/TODO_GAPS.md: doc-truthing — proofs are sorry-free (PROOF-5 stale).
- spec: anchor §8 Echo System to echo-types / JtvEcho.lean / echo.rs.

Findings recorded for later phases: jtv-core does not currently compile
(ast.rs ControlStmt lacks ReversibleBlock/ReverseToken/AbandonToken used by
interpreter/typechecker/cli; unvendored patacl-core path dep) — contradicting
STATUS.md "100% complete".

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG
Per design decision: reverse blocks accept only EchoSafe; EchoNeutral and
EchoBreaking are both rejected (stricter than spec §9, which permits Neutral
via residue reversal — deferred until that runtime mechanism exists).

- echo.rs: admissible_in_reverse ⇔ Safe; tests + docs updated; rustfmt-clean.
- typechecker.rs: EchoViolation message reflects Safe-only policy.
- JtvEcho.lean: Echo.admissible is Safe-only; admissible_iff ↔ e = safe.
  join_admissible / blockEcho_admissible still hold (join is safe ⇔ both safe).
- spec §9, ALIGNMENT, PROOF matrix: record the Safe-only policy + the four
  Echo design decisions (effect-only; Safe-only; infer+@echo; bridge deferred).

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG
- Echo source is inference-only (no @echo annotation); lossy numeric widening
  (Float→Int) carries EchoNeutral. Revises spec §12's "widening independent of
  echo" — widening may raise the echo dimension but never the value type.
- Echo value type (Echo<T>) deferred; AST/Type to be designed so it can be
  added without rework.
- Confirms Safe-only reversal and independent-Lean (no Agda bridge) decisions.

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG
Per authoritative Echo design decisions:
- Principle: Echo = structured, proof-relevant loss; the semantic object is
  retained-loss lineage/provenance, not a generic Σ-type or decorative effect.
  Reframed echo.rs + JtvEcho.lean accordingly (fibre = lineage carrier).
- Echo source: infer-by-default + @echo(safe|neutral|breaking) checked
  annotations (not infer-only; needed at boundaries/foreign/audited APIs).
  Added @echo to spec §7.
- Numeric conversions carry echo (3-way): exact⇒Safe, lossy+residue⇒Neutral,
  lossy-no-residue⇒Breaking; Float→Int per residue retention. Revised spec §12.
- Effect-now/value-later: reserve AST/grammar for value-level Echo<T>.
- Formal: JtvEcho.lean authoritative for JtV semantics; Agda↔Lean bridge
  deferred to Phase 4; grammar v2 not blocked on it.

https://claude.ai/code/session_01EJLZKDtcF1RGdKx6TcUTQG
@hyperpolymath
hyperpolymath force-pushed the claude/affinescript-julia-viper-alignment-4guGJ branch from a0d6bee to 824dada Compare June 2, 2026 18:40
@hyperpolymath
hyperpolymath merged commit 9f5541b into main Jun 2, 2026
@hyperpolymath
hyperpolymath deleted the claude/affinescript-julia-viper-alignment-4guGJ branch June 2, 2026 18:41
@github-actions

github-actions Bot commented Jun 2, 2026

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 105 issues detected

Severity Count
🔴 Critical 13
🟠 High 13
🟡 Medium 79

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_workflow",
    "file": "secret-scanner.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action tions/upload-artifact@v4\n  needs attention",
    "type": "unpinned_action",
    "file": "coverage.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
    "type": "download_then_run",
    "file": "proof-regression.yml",
    "action": "verify_download_integrity",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in cflite_batch.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_batch.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in cflite_pr.yml",
    "type": "missing_timeout_minutes",
    "file": "cflite_pr.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in coverage.yml",
    "type": "missing_timeout_minutes",
    "file": "coverage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno.yml",
    "type": "missing_timeout_minutes",
    "file": "deno.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in dogfood-gate.yml",
    "type": "missing_timeout_minutes",
    "file": "dogfood-gate.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants