You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Documentation + configuration wrap-up for the KitchenSpeak / echo-types
/ CI-hygiene work, and the change that makes recurring CI advisories
**self-handling**. Intended to **merge to main** once CI is green (per
maintainer authorization).
## Documentation (highest-standards refresh)
- **README.adoc** — new "Shared Formal Substrate — echo-types" section.
- **EXPLAINME.adoc** — echo-types/ADR-0004 note on KitchenSpeak + new
"Governance & CI Posture" section.
- **6a2**: `STATE` (kitchenspeak + ci-governance), `META` (ADRs,
practices, external rulesets), `ECOSYSTEM` (echo-types, EchoTypes.jl,
standards, typed-wasm). `CHANGELOG.md` + `TOOLING-STATUS.adoc`
refreshed.
## Hypatia / gitbot self-handling
The enforcing ruleset lives in `hyperpolymath/standards` (out of scope),
so the in-repo lever is a **machine-readable waiver registry**:
- **`6a2/NEUROSYM.a2ml` `[waivers]`** — every recurring advisory triaged
once: reusable-caller `timeout` false-positives, `governance@main` pin
(track), scorecard/instant-sync detector mismatches (addressed),
by-design `agda_postulate` axioms.
- **`6a2/PLAYBOOK.a2ml`** — gitbot runbook (consult the registry, skip
accepted findings, don't re-fix) + branch-hygiene + merge-gating.
- **`6a2/AGENTIC.a2ml`** — agent CI-handling + branch-hygiene contract.
## Contractiles
- **`MUST.contractile`** — project-specific invariants (proofs-first,
trusted-base documentation, echo-types attachment, waiver discipline).
- **`Trustfile`** — branch-hygiene reconciliation: deleting **merged**
PR branches is now permitted; force-push / CI-secret modification /
publish remain denied.
## Also done outside this PR
- The four merged feature branches (#63–#66) were deleted (they were
already auto-removed on merge; local refs pruned).
## Validation
- All six `6a2/*.a2ml` parse as valid TOML; `MUST.contractile` s-expr
paren-balanced; SPDX headers intact on all changed files (README has
none on `main` either — docs exempt).
## Honest limitation
Hypatia's enforcing ruleset is external; this PR records the accepted
findings repo-side so agents stop re-litigating them, but **full
auto-suppression of the addressed/false-positive items needs a one-time
`standards`-side change** — tracked in each waiver's `action`.
https://claude.ai/code/session_01RZWK1vf9QfP2H2JTFWCdJY
---
_Generated by [Claude
Code](https://claude.ai/code/session_01RZWK1vf9QfP2H2JTFWCdJY)_
Co-authored-by: Claude <noreply@anthropic.com>
justification = "These jobs call reusable workflows (jobs.<id>.uses). GitHub Actions rejects timeout-minutes on reusable-workflow caller jobs, so adding it would break the workflow."
64
+
65
+
[waivers.governance-reusable-pin]
66
+
rule = "unpinned_action"
67
+
files = "governance.yml"
68
+
severity = "medium"
69
+
disposition = "track"
70
+
justification = "hyperpolymath/standards governance-reusable.yml is referenced at @main. The standards repo is outside this session's scope and the SHA could not be resolved here; the check is green at @main."
71
+
action = "Pin to a commit SHA via an authenticated lookup of standards governance-reusable.yml on main."
72
+
73
+
[waivers.scorecard-publish-split]
74
+
rule = "scorecard_publish_with_run_step"
75
+
files = "scorecard-enforcer.yml"
76
+
severity = "high"
77
+
disposition = "addressed"
78
+
justification = "The privileged publish job (id-token: write) was split from a separate unprivileged score-gate job; the publish job has no run steps. Detector may want the publish in a separate workflow file rather than a separate job in the same file."
79
+
action = "If suppression is required, confirm the detector's exact shape with standards, or move the publish step to its own workflow file."
80
+
81
+
[waivers.instant-sync-secret-gate]
82
+
rule = "secret_action_without_presence_gate"
83
+
files = "instant-sync.yml"
84
+
severity = "high"
85
+
disposition = "addressed"
86
+
justification = "The repository-dispatch step is gated on FARM_DISPATCH_TOKEN presence via a job-level env plus a step-level `if`. Detector may expect a job-level gate."
87
+
action = "If suppression is required, confirm the detector's expected gate shape with standards."
justification = "These postulates are KitchenSpeak's deliberate trusted base: postulated echo-oracle sensor streams and the GENTLE controller spec. Each is annotated inline (AXIOM:) and enumerated in PROOF-NEEDS.md; they are documented trust boundaries, not undocumented soundness holes. The blocking Trusted-base reduction policy passes."
95
+
action = "Replaced by verified HAL bindings in a production lowering; tracked in PROOF-NEEDS.md."
echo-types = "Echo type bound to hyperpolymath/echo-types fiber; canonical attachment is Linear/Dyadic per ADR 0004; Bool bridge is a temporary smoke-test"
44
+
gated = "B-implementation gated on echo-types repo in scope (read EchoLinear/EchoTropical/EchoChoreo/EchoEpistemic/EchoResidueTaxonomy first)"
45
+
46
+
[ci-governance]
47
+
# Outcome of the 2026-06 CI hygiene pass.
48
+
timeouts = "timeout-minutes added to all real runs-on+steps jobs (reusable-caller jobs intentionally excluded)"
49
+
codeql = "matrix switched javascript-typescript -> actions (repo has no JS/TS sources)"
50
+
nuget = "spurious nuget dependabot ecosystem removed (no .NET projects)"
51
+
scorecard = "publish job split from unprivileged score-gate job"
52
+
instant-sync = "repository-dispatch gated on FARM_DISPATCH_TOKEN presence"
53
+
hypatia-waivers = "recurring advisory findings triaged in .machine_readable/6a2/NEUROSYM.a2ml [waivers]"
0 commit comments