neurophone: wire MUST enforcement (quality.yml + must-check) + SPDX fixes#161
Merged
Merged
Conversation
… SPDX MUST.contractile [enforcement] promised "quality.yml runs must-check on every PR", but neither the workflow nor the validator existed (and the estate Nickel k9 runner + its _base.ncl/template-hunt.k9.ncl bases are not wired into this repo — the existing bust.ncl already imports a missing _base.ncl). Wire-first: deliver a portable enforcer that actually runs today. - .machine_readable/contractiles/k9/must-check.sh — portable, read-only bash enforcer for the mechanically-verifiable MUST invariants: LICENSE=MPL-2.0, 0-AI-MANIFEST + .machine_readable preserved, no loose root SCM files, all GitHub Actions SHA-pinned, no proof escape hatches (believe_me/assert_total/ sorry/Admitted/unsafeCoerce/Obj.magic), no new TS/Python/Go, no hardcoded /home|/mnt paths, SPDX header on every Rust source. Passes clean (exit 0). - .github/workflows/quality.yml — runs must-check on push(main)/PR, SHA-pinned, least-privilege, always-created (no path filters) so it's a stable check; advisory EditorConfig pass. - MUST.contractile [enforcement] — reference the runnable must-check.sh alongside the declarative .k9.ncl (no invariants changed; reference no longer dangling). - Fix the real MUST violation must-check surfaced: add the missing `// SPDX-License-Identifier: MPL-2.0` header to crates/claude-client/src/lib.rs and crates/lsm/src/lib.rs. Verified: must-check exit 0, quality.yml YAML valid, cargo build OK, fmt clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
|
hyperpolymath
marked this pull request as ready for review
July 1, 2026 12:30
hyperpolymath
added a commit
that referenced
this pull request
Jul 1, 2026
…F→Code Scanning) (#162) ## Summary Fixes the **recurring `governance / Check Workflow Staleness` red** that has failed on every recent PR (#154, #161, …). **Root cause (pre-existing, from #159):** the Scorecard workflow adopted in #159 runs Scorecard in **SARIF** mode and pushes the SARIF into **GitHub Code Scanning**, but only fires on `push(main)`/`schedule` — not per-PR-head. The standards governance staleness gate forbids exactly that: > `::error:: OSSF Scorecard must not upload SARIF to GitHub Code Scanning unless it runs > for every PR head commit.` **Fix:** delegate `scorecard.yml` to the canonical standards `scorecard-reusable.yml@7c9db0e` — it runs Scorecard in **JSON** mode with `publish_results` and uploads an **artifact**, and does **not** push SARIF into Code Scanning. That's the canonical behaviour #159's title ("adopt canonical scorecard.yml") intended, and it satisfies the gate. Job name (`analysis`) preserved for the required-check contract. Also hardened `must-check.sh` (portable `[[:space:]]` instead of GNU-only `\s`; quoted `exit "$fail"`). **Verified locally:** `check-workflow-staleness.sh` → "All workflow staleness checks passed"; `scorecard.yml` YAML valid; `must-check` exit 0. ## FLAGS (unchanged) - `gossamer` + `conative-gating` still 403-blocked → #83 / #103 staged (needs the repos added to the environment's scope). - OPEN proof obligations 1.1 / 1.2 (formal) / 3.2 remain honestly staged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh --- _Generated by [Claude Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_ Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 1, 2026
…gfault (#163) ## Summary Fixes the **recurring `rust-ci / Coverage (tarpaulin + codecov)` red** (failed on #161, #162, …) with a **locally-verified** repo-side change. **Root cause:** the standards rust-ci reusable runs `cargo tarpaulin --out Xml` with the default **ptrace** engine, which **segfaults** on the CI runners while instrumenting the property-test binary (`"Failed to run tests: A segfault occurred while executing tests"`). It's a tarpaulin instrumentation flake — the suite passes under `cargo test`, and the ptrace engine doesn't even reproduce the segfault locally. **Fix:** `tarpaulin.toml` selecting the **LLVM (source-based) engine**, which avoids ptrace entirely. The reusable's `cargo tarpaulin --out Xml` reads this `[default]` profile, so **no standards-reusable change is needed**. **Verified locally** (I installed tarpaulin and reproduced the setup): - default engine locally → passes (segfault is CI-runner-specific); - `[default] engine = "Llvm"` + `cargo tarpaulin --out Xml` → activates `LLVM_PROFILE_FILE` coverage across 26 test binaries, exits 0, writes a valid `cobertura.xml`. - Note: the value must be capitalized `"Llvm"` — serde is case-sensitive; lowercase silently falls back to ptrace. This clears the last **repo-side-fixable** CI red. Remaining reds are genuinely external: `governance / Validate Hypatia Baseline` is pre-existing **#41 debt** (needs the hypatia CLI, out of session scope, or a baseline-regen decision), which the owner has merged past. ## FLAGS (unchanged) - `gossamer` + `conative-gating` still 403-blocked → **#83 / #103 staged** until added to the environment's repo scope. - OPEN proof obligations 1.1 / 1.2 (formal) / 3.2 remain honestly staged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh --- _Generated by [Claude Code](https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RSR wire-first follow-up (after merged #160).
MUST.contractilepromised"quality.yml runs must-check on every PR", but neither the workflow nor the validator
existed — and the estate Nickel k9 runner (with its
_base.ncl/template-hunt.k9.nclbases) isn't wired into this repo (the existing
bust.nclalready imports a missing_base.ncl). So I delivered a portable enforcer that actually runs today..machine_readable/contractiles/k9/must-check.sh— read-only bash enforcer for themechanically-verifiable MUST invariants: LICENSE = MPL-2.0,
0-AI-MANIFEST+.machine_readablepreserved, no loose root SCM files, all Actions SHA-pinned, noproof escape hatches (
believe_me/sorry/Admitted/…), no new TS/Python/Go, nohardcoded
/home|/mntpaths, SPDX header on every Rust source. Exits 0..github/workflows/quality.yml— runs must-check on push(main)/PR; SHA-pinned,least-privilege, always-created (stable check); advisory EditorConfig pass.
MUST.contractile[enforcement] — references the runnablemust-check.shalongsidethe declarative
.k9.ncl(no invariants changed; the reference is no longer dangling).crates/claude-client/src/lib.rsandcrates/lsm/src/lib.rs.Verified:
must-checkexit 0,quality.ymlYAML valid,cargo buildOK, fmt clean.FLAGS — external / owner-plane
gossamer+conative-gatingclones are still 403-blocked by the environment'segress/scope policy (retried on owner request; the proxy README says not to route around
a policy denial). build: migrate Kotlin/Gradle Android app to gossamer (clears banned-language CI) #83 gossamer-migration and Adopt conative-gating as policy/egress GO/NO-GO veto (refs proof-obligation #84-3.1) #103 egress-veto remain staged
until these repos are added to the session's allowlist at the platform level.
6a2/(standards canon doesn't mandatedescriptiles/; it's anestate-wide convention) — see the plan; owner can request the full migration if preferred.
🤖 Generated with Claude Code
https://claude.ai/code/session_0172RBMz3qYjb1ttzD2i7RNh
Generated by Claude Code