ci: bump a2ml-validate-action to 6bff6ec (s-expression form support)#26
Merged
Merged
Conversation
Validator PR #26 (merged 2026-06-01) taught the action to recognise both TOML `name = "x"` AND s-expression `(name "x")` identity and version forms. The pre-fix SHA only matched TOML, so any `.a2ml` file using s-expression dialect (idiomatic in campaign reports and audit registries) failed Dogfood Gate with "Missing required identity field" even when the field was structurally present. Real-world bite: hyperpolymath/panic-attack#94 hit this on docs/campaigns/2026-05-26.a2ml on 2026-06-01. This bump is purely a workflow SHA refresh; no behavioural change for repos that don't carry s-expression manifests.
hyperpolymath
enabled auto-merge (squash)
June 2, 2026 15:03
🔍 Hypatia Security ScanFindings: 67 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dependabot-automerge.yml",
"type": "missing_timeout_minutes",
"file": "dependabot-automerge.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in governance.yml",
"type": "missing_timeout_minutes",
"file": "governance.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in hypatia-scan.yml",
"type": "missing_timeout_minutes",
"file": "hypatia-scan.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
…ed (#55) Follows #53 and #54. The Dogfood Gate **could not parse** before #53, so it never ran. Now that it parses, it runs — and immediately reported **2 A2ML errors and 4 K9 errors** on `main`. That's the gate working as intended; this PR clears what it found. Each fix was verified by running the **actual validator** locally, not by reading its source. ## A2ML: 2 errors → 0 ### `docs/governance/TSDM.a2ml` was not defective — the pin was stale This is the [SHA-pinning-defeats-upstream-fixes](https://github.com/hyperpolymath/krl) pattern, caught red-handed: | | | |---|---| | Pinned | `6bff6ec` — PR **#26**, *"recognise s-expression identity/version fields"* | | Fix needed | `6c47174` — PR **#41**, *"recognise colon/brace-block identity"* | TSDM.a2ml declares `id: "tsdm-standard"`, the colon/brace-block form. The validator's own source comment **names this exact file** as the motivating case — so the fix existed upstream, and the pin predated it. Confirmed before changing anything: running the newer validator locally drops the count **2 → 1**. Bumped to current main (`5468b7f`). ### `docs/governance/MAINTENANCE-CHECKLIST.a2ml` genuinely lacked identity The validator exempts four categories — `*AI-MANIFEST*` files, `.machine_readable/` (structural identity), contractile `@directive` shape, and named typed manifests. **None applies here**, and the file has no `name`/`project`/`agent-id`. Added `name` to its `[metadata]` block. ## K9: 4 errors → 0 Unlike the A2ML case, these are **genuine file defects** — the current validator reports the same 4 errors as the pinned one, so pin staleness is ruled out. - Both `container/deploy.k9.ncl` and `.machine_readable/self-validating/methodology-guard.k9.ncl` were missing the mandatory **`K9!` magic number** on line 1. - `deploy.k9.ncl` had `pedigree = component_pedigree,` where the canonical template (`rsr-julia-library-template-repo`) has `pedigree = component_pedigree & { name = "…" },`. Without the merge the pedigree carries no name. Matched to the template. - `methodology-guard.k9.ncl` had **no pedigree block at all**. Added one. > This is template rot with a measurable blast radius: `container/deploy.k9.ncl` is missing the `K9!` line in **6 repos** (lucidscript, pandoc-k9, pseudoscript, squeakwell, stateful-artefacts, systemet) while the newer template has it. ##⚠️ `K9!` and Nickel contradict each other, estate-wide Worth recording, and **not** changed here: ```console $ nickel typecheck container/deploy.k9.ncl error: unexpected token 1 │ K9! │ ^ ``` The magic number **is not valid Nickel**, so `nickel typecheck` fails on *every* `.k9.ncl` in the estate that carries it — including the canonical template and every currently-passing file. `k9-svc` evidently strips the line before parsing. The consequence is that the `nickel typecheck container/deploy.k9.ncl` usage line **in these files' own headers can never succeed as written**. Pre-existing and estate-wide, so left alone. But I used it as a check: both files were typechecked with the magic line stripped, and **that caught a real error in my first draft**, where the new pedigree block sat at top level in a file whose body is `let … in …` — invalid Nickel. Moved inside the record; the validator matches at any indent. ## Verified | Check | Result | |---|---| | K9 validator | **0 errors** (8 files) | | A2ML validator | **0 errors** (121 files) | | `actionlint` | **0 errors** | | `tests/aspect_tests.sh` | 4/4 | | `tests/e2e.sh` | 4/4 | | `tests/smoke/grammar_smoke.sh` | 20/20 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump
hyperpolymath/a2ml-validate-actionfrom59145c7to6bff6ec.Upstream PR: hyperpolymath/a2ml-validate-action#26 (merged 2026-06-01) — validator now recognises both TOML and s-expression identity/version dialects.
Real-world bite: panic-attack#94 hit this on
docs/campaigns/2026-05-26.a2mlon 2026-06-01.Estate sweep: 215 repos in the same wave. No behavioural change unless the repo carries an s-expression-form
.a2mlfile.