fix(coordination): restore missing .gitmodules for absolute-zero submodule#117
Merged
Merged
Conversation
…odule The absolute-zero/ gitlink (160000 commit ad085ba) was recorded in the index but .gitmodules was never committed, leaving a dangling submodule pointer: `git submodule` could not resolve it and the Mustfile `submodule-recorded` check (severity: critical) always failed. Eight machine-readable contractiles (Mustfile, Bustfile, Dustfile, Intentfile, Trustfile, gitbot-fleet, hypatia) document absolute-zero/ as a pinned submodule (PR #89); only the README contradicted them by calling it "referenced, not vendored as a submodule". Restore .gitmodules pinned to hyperpolymath/absolute-zero and reconcile the README to match the documented intent. Verified: `git config -f .gitmodules submodule.absolute-zero.url` now succeeds and `git submodule status` resolves the pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz
hyperpolymath
marked this pull request as ready for review
July 3, 2026 01:41
hyperpolymath
added a commit
that referenced
this pull request
Jul 21, 2026
…123) ## Summary A sitrep on this repo turned up something bigger than the CI gap it started as: **`aletheia` has not compiled since 2026-06-17.** This branch fixes that, then adds the gate that would have caught it, and clears two unrelated reds. | # | Finding | State | |---|---|---| | 1 | `aletheia` fails to build — unclosed delimiter in `src/config.rs` | **fixed & verified** | | 2 | `aletheia` has no CI anywhere; its 16 workflows are inert | **root gate added** | | 3 | Governance red — `pages.yml` missing SPDX header | **fixed** | | 4 | `absolute-zero` pinned to a nonexistent commit; Dependabot dead | **re-pinned — needs your confirmation** | ## 1. The compile break `Config::load_config` opened three blocks on one collapsed line and closed two. Introduced by `b5322c2` *"security: remediate Track C and Track E findings"* — which correctly added a 1 MiB read cap against memory exhaustion, then dropped a brace collapsing the block. **`main` has been unbuildable for over a month.** The security intent is preserved exactly; the cap is retained and now commented. ## 2. Why nothing noticed `aletheia/` is vendored as **plain tracked files (mode 100644), not a submodule**. Actions only reads `.github/workflows/` at the *repository root*, so all 16 files under `aletheia/.github/workflows/` — `rust-ci`, `codeql`, `cflite_*`, SLSA3, GHCR — have **never executed**. There is no standalone `hyperpolymath/aletheia` running them either; it was removed from GitHub in early 2026. No root workflow mentioned cargo, and root `codeql.yml`'s language matrix excludes Rust. ~962 lines were completely ungated. Adds root `.github/workflows/rust-ci.yml`: debug + release build, 26 unit tests, `cargo fmt --check`, and a zero-dependency check enforcing the RSR Bronze constraint from `aletheia/CLAUDE.md`. It uses the runner's preinstalled Rust — **no new third-party action**, no added supply-chain surface. Also adds `aletheia/.github/workflows/README.md` so nobody edits an inert workflow again. ### What I deliberately did *not* gate Two things are genuinely red, and a hollow green job is worse than no job. Neither is masked with `continue-on-error`; both are documented in the workflow header: - **Integration tests: 27 of 29 fail.** They exercise a CLI surface — `--help`, `--version`, `--format=`, `--badge`, `--html`, `--init-hook` — that `src/main.rs` does not implement. It parses only `--json` and `--sarif`. - **`clippy -D warnings`: 25 findings**, mostly dead code. These share one root cause: the crate was split into 5 modules (962 lines) but `main.rs` is only 117 lines and never wires most of them up. `glob_match`, `check_path_security`, `parse_toml`, `TomlValue`, `PathCheckResult` are all unreachable. **aletheia is mid-refactor and incomplete** — its 823-line test suite is closer to a specification of the intended tool than a description of the current one. That is a product decision, not a CI fix, so I have left it to you. ## 4. Submodule re-pin — please confirm `ad085baa` **does not exist** upstream (API 422), nor on the GitLab or Codeberg mirrors; orphaned by a force-push during the Ddraig rollout. Dependabot has failed since 2026-07-20 with `upload-pack: not our ref`. Re-pinned to current upstream main `87902bb7`. **This is a semantic bump, not a restore** — the old pin's content is unrecoverable, so I cannot verify `87902bb7` is the intended CNO state. It may also not be durable: this repo has already oscillated three times (#89 → `bef4c92` → #117). Worth settling submodule-vs-vendor, or barring force-push on `absolute-zero`. ## Verification All run locally from a clean target dir before pushing: ``` build: PASS release: PASS tests: 26 passed; 0 failed fmt: PASS zero-dep: PASS git submodule update --init absolute-zero -> checks out 87902bb7 cleanly ``` ## Notes - `PROOF-NEEDS.md` is **stale**: it claims one `Admitted` in `y_not_cno`. There are zero — it is a documented *KEPT AXIOM*. A declared trust assumption, not an unproven hole. Worth correcting separately. - `rustfmt.toml` sets 18 nightly-only options that stable rustfmt silently ignores. - `aletheia/Cargo.toml` still points `repository` at the deleted GitHub repo. - Untouched: the uncommitted SonarCloud edits in the working copy (unpinned `@master`), and the 4 unpushed local commits. Both are yours to decide. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
The
absolute-zero/gitlink (160000 commit ad085ba) was recorded in the index, but.gitmoduleswas never committed — leaving a dangling submodule pointer. As a resultgit submodulecould not resolve it, and the Mustfilesubmodule-recordedcheck (severity = "critical") always failed.Eight machine-readable contractiles (Mustfile, Bustfile, Dustfile, Intentfile, Trustfile, gitbot-fleet, hypatia) document
absolute-zero/as a pinned git submodule (PR #89). Only the README contradicted them ("referenced, not vendored as a submodule"). This PR resolves the contradiction in favour of the documented majority intent.Changes
.gitmodulespinningabsolute-zerotohttps://github.com/hyperpolymath/absolute-zero.git.Verification
git config -f .gitmodules submodule.absolute-zero.urlnow succeeds → the criticalsubmodule-recordedcheck passes.git submodule statusresolves the pinned pointer.Context
This is task A1 of a broader estate assessment (the coordination fix that unblocks a fresh clone reaching the CNO foundation). Part of a documentation/coordination honesty pass across the estate. Draft pending human review.
🤖 Generated with Claude Code
https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz
Generated by Claude Code