feat(wave8): tighten the gates — three advisory surfaces become real gates

claude · hyperpolymath · commit 4dac1dd8056d · 2026-07-18T00:07:39.000+01:00
Promotes the enforcement surfaces that could not block, each honestly (no manufactured red noise), each with a red-team proof it CAN fail. - hypatia-scan-reusable.yml: baseline-aware gate. When a caller commits .hypatia-baseline.json (+ ships scripts/apply-baseline.sh), findings are filtered through the baseline and any UNBASELINED finding >= high FAILS the job (apply-baseline.sh blocking mode — thresholds, expiry, downgrades all already implemented there). Repos without a baseline keep the honestly- labelled ADVISORY behaviour; the gate arms itself the moment a baseline lands (standards#399/#437/#446). - affinescript-verify.yml: SPLIT GATE replaces the blanket advisory. ADDED .affine files must compile — a failing added file fails the job (new code has no excuse); MODIFIED legacy ports stay advisory until the port backlog clears (LEGACY_BLOCKING flag to flip later); toolchain failures skip LOUDLY ("SKIPPED, not passed" — never a silent green claim). Job-level continue-on-error removed; verify step guards against a missing compiler checkout before cd. - registry-verify.yml: Mustfile enforcement now gates PRs (structural check + run-mustfile.sh) — previously the invariants executed only on push-to-main, so a breaking change was caught after merge, not before. - scripts/tests/wave8-gates-test.sh (11 assertions; Justfile: gates-test): unbaselined-high blocks / baselined passes / EXPIRED baseline entry stops suppressing / low severity below threshold; Mustfile gate passes on this repo and blocks on a failing critical invariant; workflow-shape checks (job-level continue-on-error gone, blocking branch present, loud skip). Licence/SPDX untouched (flag-only policy). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0114ps6mY5jAH4SzbGxeuYjc
diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml
@@ -25,13 +25,20 @@ permissions:
 # compiler (hyperpolymath/affinescript). The compiler is pinned to a commit
 # SHA for reproducibility; bump COMPILER_REF deliberately.
 #
-# NON-BLOCKING (temporary): the initial ReScript->AffineScript port (PR #62)
-# was done without a compiler, so `affinescript check` currently reports
-# errors that need mechanical fixes. Until those are resolved this job
-# REPORTS failures (job summary + warnings) but exits green so it does not
-# block merges. Flip BLOCKING to "true" once the ports compile clean.
+# SPLIT GATE (Wave 8, standards#446 honest-gating): the initial
+# ReScript->AffineScript port (PR #62) predates the compiler, so some legacy
+# ports still fail `affinescript check`. Blindly flipping the whole job to
+# blocking would red every PR that touches a legacy port — manufactured noise.
+# Instead the gate distinguishes:
+#   * ADDED .affine files (diff-filter=A)  -> BLOCKING. New code has no excuse
+#     not to compile; a failing added file fails this job.
+#   * MODIFIED legacy files (diff-filter=CMR) -> advisory warnings until the
+#     port backlog clears (flip LEGACY_BLOCKING=true then).
+#   * Toolchain failures (compiler checkout/opam/build) -> advisory: the step
+#     reports "toolchain unavailable" and the verify step SKIPS (loudly) rather
+#     than blocking unrelated changes on OCaml infra flake.
 env:
-  BLOCKING: "false"
+  LEGACY_BLOCKING: "false"
   COMPILER_REPO: hyperpolymath/affinescript
   COMPILER_REF: d2875a552f1d389b4a60c4adfdc02ae53e36aca3
 
@@ -40,12 +47,6 @@ jobs:
     timeout-minutes: 20
     name: AffineScript Verify
     runs-on: ubuntu-latest
-    # advisory: see header note. continue-on-error keeps the
-    # whole job advisory — including the compiler checkout/setup-ocaml/build
-    # steps — so a toolchain/build problem cannot block merges or add
-    # estate-wide red noise while the ports + build are sorted in follow-up.
-    # Remove this (and flip BLOCKING=true) once the job is reliably green.
-    continue-on-error: true
     permissions:
       contents: read
     steps:
@@ -66,15 +67,20 @@ jobs:
              || printf '%s' "$BASE" | grep -qE '^0+$'; then
             BASE="$(git rev-parse HEAD^ 2>/dev/null || git rev-parse HEAD)"
           fi
-          FILES="$(git diff --name-only --diff-filter=ACMR "$BASE" HEAD -- '*.affine' || true)"
+          # Split-gate inputs: ADDED files gate hard; modified legacy files are
+          # advisory until the port backlog clears (see header).
+          ADDED="$(git diff --name-only --diff-filter=A "$BASE" HEAD -- '*.affine' || true)"
+          MODIFIED="$(git diff --name-only --diff-filter=CMR "$BASE" HEAD -- '*.affine' || true)"
+          FILES="$(printf '%s\n%s\n' "$ADDED" "$MODIFIED" | sed '/^$/d')"
           if [ -z "$FILES" ]; then
             echo "any=false" >> "$GITHUB_OUTPUT"
             echo "No changed .affine files — nothing to verify."
           else
             echo "any=true" >> "$GITHUB_OUTPUT"
-            echo "Changed .affine files:"
+            echo "Changed .affine files (added gate hard; modified advisory):"
             echo "$FILES"
             { echo 'files<<EOF'; echo "$FILES"; echo 'EOF'; } >> "$GITHUB_OUTPUT"
+            { echo 'added<<EOF'; echo "$ADDED"; echo 'EOF'; } >> "$GITHUB_OUTPUT"
           fi
 
       - name: Checkout AffineScript compiler
@@ -98,61 +104,86 @@ jobs:
           ocaml-compiler: "5.1"
 
       - name: Build compiler
+        id: build
         if: steps.changed.outputs.any == 'true'
-        # advisory: compiler build failures are reported by this job, not yet
-        # merge-blocking, until the report-only porting phase ends.
+        # advisory: toolchain failures are infra flake, not code failures —
+        # they must not block unrelated changes. The verify step below skips
+        # LOUDLY (never a silent green claim) when the compiler is unavailable.
         continue-on-error: true
         working-directory: .affinescript-compiler
         run: |
           opam install . --deps-only
           opam exec -- dune build
+          echo "ok=true" >> "$GITHUB_OUTPUT"
 
-      - name: Verify changed .affine files
+      - name: Verify changed .affine files (added files gate; legacy advisory)
         if: steps.changed.outputs.any == 'true'
-        # advisory: verification findings are emitted as warnings and job
-        # summary entries until BLOCKING is intentionally enabled.
-        continue-on-error: true
-        working-directory: .affinescript-compiler
+        # No working-directory: if the (advisory) compiler checkout failed, the
+        # dir may not exist — the guard below must run BEFORE any cd.
         run: |
           set -u
-          rc=0
-          failed=""
+          if [ "${{ steps.build.outputs.ok }}" != "true" ] || [ ! -d .affinescript-compiler ]; then
+            echo "::warning::AffineScript toolchain unavailable (compiler checkout/opam/build failed) — verification SKIPPED, not passed."
+            {
+              echo "## AffineScript Verify"
+              echo "⚠️ **SKIPPED — toolchain unavailable.** The compiler did not build;"
+              echo "no \`.affine\` file was verified. This is an infra flake, not a pass."
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          cd .affinescript-compiler
+          # is_added <file>: is this file in the added set? (added files gate hard)
+          is_added() {
+            case $'\n'"${ADDED_SET}"$'\n' in *$'\n'"$1"$'\n'*) return 0 ;; *) return 1 ;; esac
+          }
+          ADDED_SET="$(cat <<'EOF'
+          ${{ steps.changed.outputs.added }}
+          EOF
+          )"
+          ADDED_SET="$(printf '%s\n' "$ADDED_SET" | sed 's/^[[:space:]]*//' | sed '/^$/d')"
+          added_fail=""
+          legacy_fail=""
           while IFS= read -r f; do
             [ -z "$f" ] && continue
             abs="$GITHUB_WORKSPACE/$f"
             echo "::group::check $f"
             if opam exec -- dune exec affinescript -- check "$abs" 2>&1; then
               echo "✅ $f"
+            elif is_added "$f"; then
+              echo "::error file=$f::AffineScript check failed (ADDED file — blocking)"
+              echo "❌ $f failed (added file — blocking)"
+              added_fail="$added_fail$f"$'\n'
             else
-              echo "::warning file=$f::AffineScript check failed"
-              echo "❌ $f failed AffineScript check"
-              failed="$failed$f"$'\n'
-              rc=1
+              echo "::warning file=$f::AffineScript check failed (legacy port — advisory until backlog clears)"
+              echo "⚠️ $f failed (legacy port — advisory)"
+              legacy_fail="$legacy_fail$f"$'\n'
             fi
             echo "::endgroup::"
           done <<'EOF'
           ${{ steps.changed.outputs.files }}
           EOF
 
           {
-            echo "## AffineScript Verify"
-            if [ "$rc" -eq 0 ]; then
+            echo "## AffineScript Verify (split gate)"
+            if [ -z "$added_fail" ] && [ -z "$legacy_fail" ]; then
               echo "All changed \`.affine\` files passed \`affinescript check\`."
-            else
-              echo "The following changed \`.affine\` files failed \`affinescript check\`:"
-              echo ""
-              echo "$failed" | sed '/^$/d' | sed 's/^/- /'
-              echo ""
-              echo "_See the per-file groups in the job log for the compiler errors._"
+            fi
+            if [ -n "$added_fail" ]; then
+              echo "### ❌ ADDED files failing (BLOCKING — new code must compile)"
+              echo "$added_fail" | sed '/^$/d' | sed 's/^/- /'
+            fi
+            if [ -n "$legacy_fail" ]; then
+              echo "### ⚠️ Legacy ports failing (advisory until the port backlog clears)"
+              echo "$legacy_fail" | sed '/^$/d' | sed 's/^/- /'
             fi
           } >> "$GITHUB_STEP_SUMMARY"
 
-          if [ "$rc" -ne 0 ]; then
-            if [ "$BLOCKING" = "true" ]; then
-              echo "AffineScript verification failed (blocking)."
-              exit 1
-            fi
-            echo "::warning::AffineScript verification found errors but is non-blocking (BLOCKING=false). See job summary."
-            exit 0
+          if [ -n "$added_fail" ]; then
+            echo "AffineScript verification failed for ADDED files (blocking)."
+            exit 1
+          fi
+          if [ -n "$legacy_fail" ] && [ "$LEGACY_BLOCKING" = "true" ]; then
+            echo "Legacy port failures are blocking (LEGACY_BLOCKING=true)."
+            exit 1
           fi
-          echo "All changed .affine files passed AffineScript verification."
+          echo "Verification complete (added files clean)."
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
@@ -149,14 +149,30 @@ jobs:
             panic-attack-findings.json
           retention-days: 90
 
+      - name: Gate on baseline (blocking when a baseline is committed)
+        if: steps.scan.outputs.findings_count > 0
+        run: |
+          # Wave-8 gate promotion: when the calling repo commits a
+          # .hypatia-baseline.json (schema: .machine_readable/hypatia-baseline.
+          # schema.json) AND ships scripts/apply-baseline.sh, findings are
+          # filtered against the baseline and any UNBASELINED finding at or
+          # above the blocking threshold FAILS this job. Repos without a
+          # baseline keep the honest ADVISORY behaviour below — the gate arms
+          # itself the moment a baseline lands (standards#399/#437/#446).
+          if [ -f scripts/apply-baseline.sh ] && [ -f .hypatia-baseline.json ]; then
+            echo "Baseline present — running BLOCKING gate (threshold: high)."
+            bash scripts/apply-baseline.sh hypatia-findings.json .hypatia-baseline.json blocking
+          else
+            echo "No committed baseline — gate stays advisory (see next step)."
+          fi
+
       - name: Check for critical issues (ADVISORY — does not gate)
         if: steps.scan.outputs.critical > 0
         run: |
-          # This scan is ADVISORY / fix-forward: it never fails the build. The
-          # label and summary state that explicitly so a green check carrying
-          # critical findings is not mistaken for "no critical findings".
-          # (Promotion to blocking is tracked with the baseline reconciliation,
-          # standards#399/#437.)
+          # This scan is ADVISORY / fix-forward WHEN NO BASELINE IS COMMITTED
+          # (the step above becomes the blocking gate once .hypatia-baseline.json
+          # lands). The label and summary state that explicitly so a green check
+          # carrying critical findings is not mistaken for "no critical findings".
           echo "::warning title=Hypatia (ADVISORY, non-blocking)::${{ steps.scan.outputs.critical }} critical finding(s). This scan does not gate — review hypatia-findings.json and fix forward."
           {
             echo "### Hypatia scan — ADVISORY (does not gate)"
diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml
@@ -52,6 +52,14 @@ jobs:
             exit 1
           fi
 
+      - name: Mustfile enforcement (structural + execute invariants)
+        run: |
+          # Wave-8 gate promotion: the Mustfile's invariants previously executed
+          # only on push-to-main (boj-build.yml). PRs now gate on them too —
+          # a change that breaks a MUST invariant fails before merge, not after.
+          bash scripts/check-mustfile-structure.sh
+          bash scripts/run-mustfile.sh
+
       - name: Verify compliance dashboard is current (and pass-checks hold)
         run: |
           # --verify RUNS every pass-row's executable `check`: a claimed pass
diff --git a/Justfile b/Justfile
@@ -49,6 +49,10 @@ false-green-test:
 automation-test:
     @bash scripts/tests/wave1-automation-test.sh
 
+# Wave-8 gate-promotion regression: baseline gate + Mustfile PR gate can fail
+gates-test:
+    @bash scripts/tests/wave8-gates-test.sh
+
 # Structural validation of the Mustfile contract (severity + run/verification per check)
 mustfile-check path=".machine_readable/contractiles/must/Mustfile.a2ml":
     @bash scripts/check-mustfile-structure.sh "{{path}}"
diff --git a/scripts/tests/wave8-gates-test.sh b/scripts/tests/wave8-gates-test.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+set -uo pipefail
+#
+# Wave-8 "tighten the gates" regression test.
+#
+# Every promoted gate must demonstrably BLOCK on bad input and PASS on good:
+#   * apply-baseline.sh blocking mode: unbaselined high/critical finding fails;
+#     baselined finding passes; EXPIRED baseline entry no longer suppresses.
+#   * Mustfile PR gate: the exact commands registry-verify.yml runs succeed on
+#     this repo, and a broken Mustfile fails them (via the wave-1 runner).
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+AB="$ROOT/scripts/apply-baseline.sh"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+pass=0 fail=0
+ok()  { echo "  ✅ $1"; pass=$((pass + 1)); }
+bad() { echo "  ❌ $1"; fail=$((fail + 1)); }
+expect() { if [ "$2" -eq "$1" ]; then ok "$3 (exit $2)"; else bad "$3 (wanted $1, got $2)"; fi; }
+
+echo "== apply-baseline.sh blocking gate =="
+cat > "$TMP/findings.json" <<'EOF'
+[{"severity":"high","rule_module":"cicd_rules","type":"test_finding","file":"a/b.sh"}]
+EOF
+
+# (1) unbaselined high finding in blocking mode -> exit 1
+printf '[]' > "$TMP/empty-baseline.json"
+bash "$AB" "$TMP/findings.json" "$TMP/empty-baseline.json" blocking >/dev/null 2>&1
+expect 1 $? "unbaselined high finding BLOCKS"
+
+# (2) same finding, advisory mode -> exit 0 (reported, not gating)
+bash "$AB" "$TMP/findings.json" "$TMP/empty-baseline.json" advisory >/dev/null 2>&1
+expect 0 $? "advisory mode does not gate"
+
+# (3) baselined finding (unexpired) -> suppressed, blocking passes
+cat > "$TMP/baseline.json" <<'EOF'
+[{"severity":"high","rule_module":"cicd_rules","type":"test_finding","file":"a/b.sh","expires_at":"9999-12-31","note":"acknowledged for test"}]
+EOF
+bash "$AB" "$TMP/findings.json" "$TMP/baseline.json" blocking >/dev/null 2>&1
+expect 0 $? "baselined finding passes blocking gate"
+
+# (4) EXPIRED baseline entry no longer suppresses -> blocks again
+cat > "$TMP/expired.json" <<'EOF'
+[{"severity":"high","rule_module":"cicd_rules","type":"test_finding","file":"a/b.sh","expires_at":"2000-01-01","note":"expired"}]
+EOF
+bash "$AB" "$TMP/findings.json" "$TMP/expired.json" blocking >/dev/null 2>&1
+expect 1 $? "expired baseline entry stops suppressing (blocks)"
+
+# (5) low-severity unbaselined finding stays below the blocking threshold
+cat > "$TMP/low.json" <<'EOF'
+[{"severity":"low","rule_module":"cicd_rules","type":"test_finding","file":"a/b.sh"}]
+EOF
+bash "$AB" "$TMP/low.json" "$TMP/empty-baseline.json" blocking >/dev/null 2>&1
+expect 0 $? "low-severity finding stays below blocking threshold"
+
+echo "== Mustfile PR gate (exact registry-verify.yml commands) =="
+( cd "$ROOT" && bash scripts/check-mustfile-structure.sh >/dev/null 2>&1 )
+expect 0 $? "structural check passes on this repo"
+( cd "$ROOT" && bash scripts/run-mustfile.sh >/dev/null 2>&1 )
+expect 0 $? "invariant execution passes on this repo"
+# and it CAN fail: a Mustfile with a failing critical invariant blocks
+printf '### x\n- run: test -f /nonexistent-wave8\n- severity: critical\n' > "$TMP/bad-must.a2ml"
+( cd "$ROOT" && bash scripts/run-mustfile.sh "$TMP/bad-must.a2ml" >/dev/null 2>&1 )
+expect 1 $? "failing critical invariant blocks"
+
+echo "== affinescript-verify workflow shape =="
+WF="$ROOT/.github/workflows/affinescript-verify.yml"
+# job-level continue-on-error removed (the job can now fail)
+if awk '/^  verify:/,/^    steps:/' "$WF" | grep -q 'continue-on-error: true'; then
+  bad "job-level continue-on-error still present"
+else
+  ok "job-level continue-on-error removed"
+fi
+# added-file failures exit 1 (blocking branch exists)
+grep -q 'exit 1' "$WF" && grep -q 'ADDED file — blocking' "$WF" \
+  && ok "added-file blocking branch present" || bad "added-file blocking branch missing"
+# toolchain-unavailable skip is loud (never silent green)
+grep -q 'SKIPPED, not passed' "$WF" && ok "toolchain skip is loud" || bad "toolchain skip not loud"
+
+echo
+echo "Wave-8 gates regression: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]
