Skip to content

Commit 3708ab2

Browse files
claudehyperpolymath
claude
authored and
hyperpolymath
committed
docs(audits): record central actions/cache SHA corruption + #394 repair
Diagnose-and-record audit for the estate-wide `scan / Hypatia Neurosymbolic Analysis` failure (2026-06-20/21): Unable to resolve action actions/cache@d4373f2 Root cause: the corrupt SHA (a corruption of v4.2.2's d4323d4…) was pinned centrally in the two reusable workflows (hypatia-scan-reusable.yml, governance-reusable.yml) — zero consumer workflows carried it. Already repaired and merged in standards#394 (d72fe5a): re-pinned to the genuine v4.2.0 commit 1bd1e32a…, verified against upstream `git ls-remote`. The audit also documents the propagation caveat (consumers pin reusables by standards SHA, so the post-#394 "Check Workflow Staleness" red is expected drift pending gitbot-fleet enroll-repos re-pin to d72fe5a+) and records two out-of-scope nextgen-databases findings (K9 pedigree missing metadata.name; trusted-base reduction policy red). Adds .adoc + .a2ml companion, mirroring audit-hypatia-pin-orphan-2026-05-27. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0144t85ipupFBhd9eJ8t9vaC
1 parent 0809b8e commit 3708ab2

2 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎docs/audits/audit-hypatia-cache-sha-corruption-2026-06-21.a2ml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Central Reusable actions/cache SHA Corruption — 2026-06-21
3+
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
4+
#
5+
# Machine-readable companion to audit-hypatia-cache-sha-corruption-2026-06-21.adoc.
6+
# Sibling to audit-hypatia-pin-orphan-2026-05-27.a2ml (a different SHA-pin class).
7+
8+
[manifest]
9+
schema = "audit/action-sha-corruption/v1"
10+
date = "2026-06-21"
11+
campaign_kind = "central_reusable_action_repin"
12+
human_companion = "audit-hypatia-cache-sha-corruption-2026-06-21.adoc"
13+
sibling_audit = "audit-hypatia-pin-orphan-2026-05-27.a2ml"
14+
umbrella_issue = "hyperpolymath/hypatia#464"
15+
out_of_scope_central_ref = "hyperpolymath/nextgen-typing#69"
16+
17+
[diagnosis]
18+
failure_class = "third_party_action_pin_unresolved_in_central_reusable"
19+
failure_stage = "Prepare all required actions"
20+
failure_banner = "Unable to resolve action actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b"
21+
corrupt_sha = "d4373f267a887d77f9eb0683a479ec60b1fe5b2b"
22+
corrupt_sha_comment = "# v4.2.0"
23+
likely_source = "corruption of v4.2.2 commit d4323d4df104b026a6aa633fdb11d772146be0bf"
24+
location = "central only — zero consumer workflows carry the SHA"
25+
affected_reusables = [
26+
".github/workflows/hypatia-scan-reusable.yml",
27+
".github/workflows/governance-reusable.yml",
28+
]
29+
observed_failing = ["nextgen-databases#41", "KnotTheory.jl#29", "nextgen-typing#67", "wokelangiser"]
30+
31+
[verification]
32+
method = "git ls-remote https://github.com/actions/cache"
33+
corrupt_sha_resolves = false
34+
repair_pin = "1bd1e32a3bdc45362d1e726936510720a7c30a57"
35+
repair_pin_ref = "refs/tags/v4.2.0"
36+
known_good_v4 = "0057852bfaa89a56745cba8c7296529d2fc39830" # refs/tags/v4 + v4.3.0
37+
known_good_v5 = "27d5ce7f107fe9357f9df03efb73ab90386fccae" # main + v5 + v5.0.5
38+
grep_after_fix = "zero matches for d4373f… across standards + hypatia"
39+
40+
[fix]
41+
pr = "hyperpolymath/standards#394"
42+
merged_at = "2026-06-21T10:52:13Z"
43+
merge_commit = "d72fe5a14e841ac6d78514b53624b6173038ee20"
44+
change = "actions/cache@d4373f… -> actions/cache@1bd1e32a… (# v4.2.0 preserved, now accurate)"
45+
status = "MERGED to standards/main — central root cause resolved + verified"
46+
47+
[propagation]
48+
caveat = "necessary but not sufficient: consumers pin reusables by standards commit SHA, not @main"
49+
consumer_pin_hypatia = "5eb28d7d8790d5389b7b6a5233fe6265a775e3d0"
50+
consumer_pin_most_repos = "861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613"
51+
staleness_check = "scripts/check-workflow-staleness.sh fails any consumer whose pinned SHA != current standards HEAD"
52+
staleness_red_meaning = "expected drift after #394, not a new defect — signals pending re-enrollment"
53+
re_enroll_target = "d72fe5a (or later standards HEAD)"
54+
re_enroll_tool = "gitbot-fleet enroll-repos"
55+
re_enroll_scope = "out_of_scope (consumer repos + gitbot-fleet are not standards/hypatia)"
56+
57+
[companion_findings_nextgen_databases.k9_pedigree]
58+
file = "verisimdb/connectors/test-infra/deploy.k9.ncl"
59+
error = "Pedigree block missing 'name'"
60+
schema_ref = "k9-svc/pedigree.ncl Metadata.name (String, no default -> mandatory)"
61+
sample_ref = "k9-svc/pandoc/container/deploy.k9.ncl"
62+
fix = "add metadata.name; ideally metadata.version + validation.pedigree_version + trust_level/security_level ('Kennel|'Yard|'Hunt)"
63+
scope = "out_of_scope (nextgen-databases repo-internal, pre-existing)"
64+
65+
[companion_findings_nextgen_databases.trusted_base]
66+
check = "governance / trusted-base"
67+
policy_ref = "docs/TRUSTED-BASE-REDUCTION-POLICY.adoc + scripts/check-trusted-base.sh"
68+
cause = "undocumented soundness-relevant escape hatch in a proof-bearing file"
69+
fix = "discharge / budget / axiom / dated-debt entry in nextgen-databases docs/proof-debt.md"
70+
scope = "out_of_scope (nextgen-databases repo-internal, pre-existing)"
71+
72+
[not_discharged]
73+
consumer_re_enrollment = "gitbot-fleet enroll-repos repin of consumers to d72fe5a+ — tracked on hypatia#464"
74+
nextgen_databases_internal = "K9 pedigree + trusted-base — repo-internal, flagged via hypatia#464 / nextgen-typing#69"

‎docs/audits/audit-hypatia-cache-sha-corruption-2026-06-21.adoc‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
// SPDX-License-Identifier: CC-BY-SA-4.0
2+
// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
3+
4+
= Central Reusable actions/cache SHA Corruption — 2026-06-21
5+
:toc:
6+
:toclevels: 2
7+
:source-highlighter: rouge
8+
:icons: font
9+
10+
Companion machine-readable manifest: `audit-hypatia-cache-sha-corruption-2026-06-21.a2ml`.
11+
Sibling to `audit-hypatia-pin-orphan-2026-05-27.adoc` — a *different* SHA-pin
12+
failure class on the same two reusables (that one was the orphaned
13+
`@<standards-sha>` reference to the reusable; this one is a corrupt
14+
third-party action SHA *inside* the reusable).
15+
16+
== Summary
17+
18+
From 2026-06-20/21 the estate-wide `scan / Hypatia Neurosymbolic Analysis`
19+
job failed at the *"Prepare all required actions"* stage — before any scan
20+
step ran — with:
21+
22+
----
23+
Unable to resolve action `actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b`
24+
(unable to find version d4373f267a887d77f9eb0683a479ec60b1fe5b2b)
25+
----
26+
27+
The corrupt SHA was **not** present in any consumer workflow. It was pinned
28+
once, centrally, in the two reusable workflows that every estate repo calls:
29+
30+
* `.github/workflows/hypatia-scan-reusable.yml`
31+
* `.github/workflows/governance-reusable.yml`
32+
33+
Observed failing on `nextgen-databases#41`, `KnotTheory.jl#29`,
34+
`nextgen-typing#67` (and, per PR #394, `wokelangiser`).
35+
36+
== Root cause
37+
38+
`d4373f267a887d77f9eb0683a479ec60b1fe5b2b` does not correspond to any
39+
`actions/cache` ref. It is a corruption of v4.2.2's real commit
40+
`d4323d4df104b026a6aa633fdb11d772146be0bf` — the version comment read
41+
`# v4.2.0`, but the hash matched neither v4.2.0 nor v4.2.2. GitHub Actions
42+
resolves a `uses:` SHA as a commit; an unknown SHA fails the whole job at
43+
parse stage, so no consumer scan ever started.
44+
45+
== Verification
46+
47+
Upstream resolution via `git ls-remote https://github.com/actions/cache`:
48+
49+
[cols="2,3,1", options="header"]
50+
|===
51+
| SHA | Upstream ref | Resolves?
52+
53+
| `d4373f26…` (the corrupt pin) | (none) | ✗ bogus
54+
| `d4323d4d…` (v4.2.2 — the likely typo source) | `refs/tags/v4.2.2` | ✓
55+
| `1bd1e32a…` (the repair pin) | `refs/tags/v4.2.0` | ✓
56+
| `0057852b…` (estate "most common") | `refs/tags/v4` + `v4.3.0` | ✓
57+
| `27d5ce7f…` (estate, used across hypatia) | `main` + `v5` + `v5.0.5` | ✓
58+
|===
59+
60+
`git grep d4373f267a887d77f9eb0683a479ec60b1fe5b2b` across standards and
61+
hypatia → zero matches after the fix.
62+
63+
== Fix — standards#394 (merged 2026-06-21T10:52Z, commit `d72fe5a`)
64+
65+
Both reusables re-pinned, preserving the documented version:
66+
67+
[source,diff]
68+
----
69+
- uses: actions/cache@d4373f267a887d77f9eb0683a479ec60b1fe5b2b # v4.2.0
70+
+ uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
71+
----
72+
73+
`1bd1e32a…` is the genuine immutable `v4.2.0` commit, so the `# v4.2.0`
74+
comment is now accurate. This is a surgical hash repair, not a version bump
75+
to the moving `v4` tag.
76+
77+
== Propagation caveat — necessary but not yet sufficient
78+
79+
Consumers do **not** pin these reusables to `@main`. They pin a specific
80+
`standards` commit SHA, e.g.:
81+
82+
----
83+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5eb28d7d… (hypatia itself)
84+
uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@861b5e91… (most consumers)
85+
----
86+
87+
Because the repair landed as a *new* `standards` HEAD (`d72fe5a`), every
88+
consumer still pinned at a pre-#394 SHA keeps dereferencing the broken cache
89+
pin until it is re-enrolled to a post-#394 SHA. This is exactly what
90+
`scripts/check-workflow-staleness.sh` reports — it fails any consumer whose
91+
pinned SHA != current standards HEAD ("Workflow pins Hypatia reusable before
92+
cache/baseline-delay fix. Refresh to current standards SHA.").
93+
94+
Therefore the post-#394 `governance / Check Workflow Staleness` red is
95+
**expected drift**, not a new defect: it is the signal that the estate
96+
re-enrollment pass (gitbot-fleet `enroll-repos`, repinning consumers to
97+
`d72fe5a` or later) is still pending. Re-enrollment is the propagation
98+
mechanism; until it runs, an affected consumer sees both the cache failure
99+
(if its pinned SHA predates #394) and the staleness failure.
100+
101+
== Companion findings — out of scope (central), recorded for the backlog
102+
103+
These surfaced on `nextgen-databases` alongside the central failure. They are
104+
**repo-internal**, pre-existing, and not addressed by #394:
105+
106+
. *K9 pedigree validation.* `verisimdb/connectors/test-infra/deploy.k9.ncl`
107+
fails "Pedigree block missing 'name'". In `k9-svc/pedigree.ncl`,
108+
`Metadata.name | String` is the only metadata field with no `default`, so
109+
it is mandatory. Fix: add `metadata.name`; per the canonical
110+
`k9-svc/pandoc/container/deploy.k9.ncl` sample, ideally also
111+
`metadata.version` + `validation.pedigree_version` and a leash level —
112+
`trust_level`/`security_level` ∈ `'Kennel | 'Yard | 'Hunt` (a
113+
shell-running `deploy.k9.ncl` is `'Hunt`).
114+
. *Trusted-base reduction policy.* The `governance / trusted-base` job (per
115+
`docs/TRUSTED-BASE-REDUCTION-POLICY.adoc` + `scripts/check-trusted-base.sh`)
116+
is red: a soundness-relevant escape hatch in a proof-bearing file in
117+
`nextgen-databases` is undocumented. Disposition is per-repo — discharge,
118+
budget (`// TRUSTED:`), axiom (`// AXIOM:`), or a dated debt entry in that
119+
repo's `docs/proof-debt.md`.
120+
121+
== What this audit does NOT discharge
122+
123+
* The consumer re-enrollment pass (gitbot-fleet `enroll-repos` → repin
124+
consumers to `d72fe5a`+). Out of scope for standards + hypatia; tracked on
125+
hypatia#464.
126+
* The two `nextgen-databases` repo-internal findings above. Out of scope
127+
(that repo); flagged for its maintainers via hypatia#464 / nextgen-typing#69.
128+
129+
== Cross-references
130+
131+
* Fix PR: `hyperpolymath/standards#394` (merged 2026-06-21).
132+
* Estate CI-health umbrella: `hyperpolymath/hypatia#464`.
133+
* "Out of scope — central" list: `hyperpolymath/nextgen-typing#69`.
134+
* Sibling SHA-pin audit: `audit-hypatia-pin-orphan-2026-05-27.adoc`.

0 commit comments

Comments
 (0)