ci(k9): exempt standards contractile trident dir from the K9!-magic validator (fix main)#31
Merged
Merged
Conversation
…alidator PR #30 added .machine_readable/contractiles/{family}/*.k9.ncl from hyperpolymath/standards, which broke the `Validate K9 contracts` gate on main: jtv's k9-validate-action requires a `K9!` magic number + a hunt-level `signature` field, but standards ships those contractile k9-COMPONENTS as plain Nickel (no magic / signature) by design — they are trident runner-companions, not K9!-magic service files. Add `.machine_readable/contractiles/` to the action's `paths-ignore` (which REPLACES the default, so the default ignores are reproduced). This restores a green K9 gate without mangling the standards-sourced files (keeping them byte-identical to standards) and is the same exemption each repo will need as the contractile migration rolls out. Flagged for an estate issue: the two K9 conventions — `K9!`-magic service files vs Nickel contractile k9-components sharing the `.k9.ncl` extension — should be reconciled in hyperpolymath/standards + k9-validate-action. https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
🔍 Hypatia Security ScanFindings: 77 issues detected
View findings[
{
"reason": "Issue in secret-scanner.yml",
"type": "missing_workflow",
"file": "secret-scanner.yml",
"action": "create",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Workflow executes remote script directly (curl/wget piped to shell). Download, verify checksum/signature, then execute.",
"type": "download_then_run",
"file": "proof-regression.yml",
"action": "verify_download_integrity",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in generator-generic-ossf-slsa3-publish.yml",
"type": "missing_timeout_minutes",
"file": "generator-generic-ossf-slsa3-publish.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in governance.yml",
"type": "missing_timeout_minutes",
"file": "governance.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in mirror.yml",
"type": "missing_timeout_minutes",
"file": "mirror.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard.yml",
"type": "missing_timeout_minutes",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in scorecard.yml",
"type": "scorecard_wrapper_missing_job_permissions",
"file": "scorecard.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "high"
},
{
"reason": "Issue in codeql.yml",
"type": "codeql_missing_actions_language",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Possible hardcoded credential -- use environment variable (1 occurrences, CWE-798)",
"type": "js_hardcoded_secret",
"file": "/home/runner/work/julia-the-viper/julia-the-viper/playground/experiments/_attic/database-demos/arangodb-demo/queries.js",
"action": "flag",
"rule_module": "code_safety",
"severity": "critical"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
marked this pull request as ready for review
June 13, 2026 12:34
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 14, 2026
All five sibling repos were estate-standardized (estate-standardization wave, 2026-06-12..14) to a FLAT contractile layout + self-validating/ + bot_directives/. jtv's PR #30 had used the standards contractiles/{family}/ trident instead, leaving jtv the odd one out. This re-aligns jtv to match its siblings, reusing the already-adapted content. * contractiles/: flatten to {Must,Trust,Adjust,Bust,Dust,Intent}file.a2ml (content preserved from the #30 trident Xfiles) + add Justfile; remove the {family}/ runner/k9/manifest trident, _base.ncl, INDEX.a2ml, README.adoc. * retire bot_exclusion_registry.a2ml (estate-wave uses bot_directives/). * add self-validating/: README + template-{hunt,kennel,yard}.k9.ncl (estate K9 templates; carry K9! magic + signature_required, so they pass the dogfood-gate K9 validator natively). * add bot_directives/: README + hypatia.a2ml (jtv accepted findings incl. the frozen-archive placeholder + reusable-caller timeout false-positives) + gitbot-fleet.a2ml (jtv never-touch: jtv_proofs/, *.lean, src/abi/Types.idr, grammar.pest, spec/, docs/design-decisions/; echidnabot proof-integrity denies incl. the addition-only/no-subtract-token mandate) + git-private-farm.a2ml (propagation disabled; no instant-sync.yml). * remove the now-duplicated top-level .machine_readable/*.contractile (their content lives in contractiles/*.a2ml); repoint the one reference in QUICKSTART-DEV.adoc. Content-preserving; matches echo-types' layout. The obsolete (now harmless) contractiles/ entry in dogfood-gate.yml's K9 paths-ignore (from #31) can be pruned in a follow-up — contractiles/ no longer holds any .k9.ncl. https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes a red
Validate K9 contractsgate onmainintroduced when #30 merged.Root cause
#30 added
.machine_readable/contractiles/{family}/*.k9.nclcopied fromhyperpolymath/standards. jtv'sdogfood-gate.ymlrunshyperpolymath/k9-validate-action, which requires aK9!magic number + a hunt-levelsignaturefield. Standards ships those contractile k9-components as plain Nickel (no magic/signature) by design — they're trident runner-companions, notK9!-magic service files. So the validator (correctly, by its own rules) failed with 10 errors.Fix
Add
.machine_readable/contractiles/to the action'spaths-ignore(which replaces the default, so the defaults are reproduced). Restores green without mangling the standards-sourced files (they stay byte-identical to standards). This same exemption will be needed in each repo as the contractile migration rolls out.Flag (for an estate issue)
There are effectively two K9 conventions sharing
.k9.ncl:K9!-magic service files (whatk9-validate-actionvalidates) vs Nickel contractile k9-components (what standards' trident ships). These should be reconciled upstream inhyperpolymath/standards+k9-validate-action(e.g., the action skippingcontractiles/**, or the components carrying aK9!-compatible header).Workflow-only change; SPDX + permissions + SHA-pin + timeout preserved.
https://claude.ai/code/session_01BJmfoz1ZS1Pejy9LLMY742
Generated by Claude Code