|
| 1 | +# SPDX-License-Identifier: PMPL-1.0-or-later |
| 2 | +# Estate-wide Reusable-Workflow Convergence Campaign — 2026-05-26 (closeout) |
| 3 | +# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) |
| 4 | +# |
| 5 | +# Machine-readable companion to audit-reusables-convergence-2026-05-26.adoc. |
| 6 | +# Schema follows the existing docs/audits/ a2ml convention. |
| 7 | + |
| 8 | +[manifest] |
| 9 | +schema = "audit/reusables-convergence/v1" |
| 10 | +date = "2026-05-26" |
| 11 | +session_id = "20f9dd81-1ded-474b-b579-61e1b8aba08b" |
| 12 | +campaign_kind = "estate_reusable_convergence + stale_BP_cleanup + stuck_PR_recovery" |
| 13 | +authoring_actor = "claude-opus-4-7 (1M context)" |
| 14 | +authorising_actor = "hyperpolymath (org admin)" |
| 15 | +human_companion = "audit-reusables-convergence-2026-05-26.adoc" |
| 16 | +supersedes_section = "standards#199 inventory (its survey methodology remains canonical)" |
| 17 | + |
| 18 | +[motivation] |
| 19 | +primary = "Land the remaining 5 reusable-workflow extractions identified by standards#199 (mirror, secret-scanner, codeql, hypatia-scan, scorecard) plus their per-repo wrapper sweeps." |
| 20 | +secondary = "Unblock the standards/main PR queue (~19 PRs reporting state=blocked despite green CI)." |
| 21 | +tertiary = "Recover the 7 still-open rust-ci wrapper PRs from the prior session (project_rust_ci_wrapper_sweep_2026_05_26)." |
| 22 | +pattern = "estate-template-propagation-pattern" |
| 23 | +prior_applications = ["standards#168 governance/language-policy", "standards#174 rust-ci + elixir-ci"] |
| 24 | + |
| 25 | +[branch_protection_discovery] |
| 26 | +finding = "standards/main required a status-check context ('Check Required Files') that no workflow produces; every open PR examined was mergeable=true mergeable_state=blocked." |
| 27 | +prs_unblocked = 19 |
| 28 | +fix_method = "gh api -X DELETE repos/hyperpolymath/standards/branches/main/protection/required_status_checks/contexts -f 'contexts[]=Check Required Files'" |
| 29 | +permanent_change = true |
| 30 | +post_fix_required_contexts = 14 |
| 31 | +pre_fix_required_contexts = 15 |
| 32 | + |
| 33 | +[outcome] |
| 34 | +reusables_merged = 2 # #187, #190 |
| 35 | +reusables_ci_burnin = 3 # #192, #193, #205 |
| 36 | +wrapper_prs_filed_total = 569 |
| 37 | +wrapper_prs_filed_mirror = 288 |
| 38 | +wrapper_prs_filed_secret = 281 |
| 39 | +wrapper_prs_admin_merged = 0 |
| 40 | +auto_merge_on_pct = 100.0 |
| 41 | +stuck_pr_recovery_total = 7 |
| 42 | +stuck_pr_recovery_landed = 7 |
| 43 | +bp_rule_cleanups_total = 7 |
| 44 | + |
| 45 | +[reusables.187_mirror] |
| 46 | +state = "merged" |
| 47 | +squash_sha = "e6b2884722350515934d443daf23442f2195796f" |
| 48 | +sweep_filed = 288 |
| 49 | +sweep_ok = 288 |
| 50 | +sweep_fatal = 0 |
| 51 | +rate_limit_triggered = false |
| 52 | + |
| 53 | +[reusables.190_secret_scanner] |
| 54 | +state = "merged" |
| 55 | +squash_sha = "3e4bd4c93911750727e2e4c66dff859e00079da0" |
| 56 | +sweep_filed = 281 |
| 57 | +sweep_ok_initial = 208 |
| 58 | +sweep_rate_limited = 72 |
| 59 | +sweep_recovered_slow = 58 |
| 60 | +sweep_recovered_final = 14 |
| 61 | +sweep_ok_final = 281 |
| 62 | +sweep_fatal_final = 0 |
| 63 | +incident_carryover = "Carries the shell-secrets guardrail added after the 2026-05-21 Cloudflare API-token leak." |
| 64 | + |
| 65 | +[reusables.192_codeql] |
| 66 | +state = "ci_burnin" |
| 67 | +estate_deploys = 273 |
| 68 | +worker_path = "/tmp/codeql-worker.sh" |
| 69 | +inventory_path = "/tmp/codeql-deploys-noforks.tsv" |
| 70 | +pin_sha_pending = true |
| 71 | + |
| 72 | +[reusables.193_hypatia_scan] |
| 73 | +state = "ci_burnin" |
| 74 | +estate_deploys = 180 |
| 75 | +worker_path = "/tmp/hypatia-worker.sh" |
| 76 | +inventory_path = "/tmp/hypatia-deploys-noforks.tsv" |
| 77 | +pin_sha_pending = true |
| 78 | +note = "Down from ~264 because the prior admin-merge wave landed those wrappers." |
| 79 | + |
| 80 | +[reusables.205_scorecard] |
| 81 | +state = "ci_burnin" |
| 82 | +estate_deploys = 258 |
| 83 | +worker_path = "/tmp/scorecard-worker.sh" |
| 84 | +inventory_path = "/tmp/scorecard-deploys-noforks.tsv" |
| 85 | +pin_sha_pending = true |
| 86 | + |
| 87 | +[rate_limit_incident] |
| 88 | +api = "GitHub GraphQL createPullRequest" |
| 89 | +limit_type = "secondary" |
| 90 | +hit_at_pr_count = 208 |
| 91 | +affected_branches = 72 |
| 92 | +remediation_strategy_1 = "Fast-retry — ineffective (limit sticky)" |
| 93 | +remediation_strategy_2 = "Slow-serial retry @ 30s/call → 58/72 recovered as limit lifted partway" |
| 94 | +remediation_strategy_3 = "Final batch retry @ 4s/call → 14/14 recovered" |
| 95 | +empirical_threshold = "~5 createPullRequest calls per 30s sustainable; ~280 in <30 min triggers the block" |
| 96 | +recommendation = "Future bulk-PR sweeps: throttle to 5 calls per 30s steady-state." |
| 97 | + |
| 98 | +[stuck_pr_recovery.rust_ci] |
| 99 | +total = 7 |
| 100 | +landed = 7 |
| 101 | +bp_cleared = 3 # 007#17, presswerk#41, rsr-template-repo#70 |
| 102 | +refiled = 4 # absolute-zero, kategoria-pipeline, nextgen-typing, proof-burrower |
| 103 | +secondary_bp_clears = 3 # kategoria-pipeline, nextgen-typing, proof-burrower (same stale cluster) |
| 104 | +worker_path = "/tmp/wrapper-rebase/refile-one.sh" |
| 105 | + |
| 106 | +[[stuck_pr_recovery.rust_ci.bp_cleared]] |
| 107 | +repo = "hyperpolymath/007" |
| 108 | +old_pr = 17 |
| 109 | +dropped_contexts = ["check-critical", ".github/dependabot.yml", "rhodibot", "validate"] |
| 110 | +final_state = "merged" |
| 111 | + |
| 112 | +[[stuck_pr_recovery.rust_ci.bp_cleared]] |
| 113 | +repo = "hyperpolymath/presswerk" |
| 114 | +old_pr = 41 |
| 115 | +dropped_contexts = ["gitleaks", "governance / Code quality + docs", "governance / Guix primary / Nix fallback policy", "governance / Language / package anti-pattern policy", "governance / Security policy checks", "governance / Well-Known (RFC 9116 + RSR)", "governance / Workflow security linter", "Hypatia Neurosymbolic Analysis", "rust-secrets", "trufflehog"] |
| 116 | +final_state = "merged" |
| 117 | + |
| 118 | +[[stuck_pr_recovery.rust_ci.bp_cleared]] |
| 119 | +repo = "hyperpolymath/rsr-template-repo" |
| 120 | +old_pr = 70 |
| 121 | +dropped_contexts = ["analysis", "antipattern-check", "check", "dispatch", "docs", ".github/dependabot.yml", "lint", "mirror-codeberg", "mirror-gitlab", "mirror-sourcehut", "validate"] |
| 122 | +final_state = "merged" |
| 123 | + |
| 124 | +[[stuck_pr_recovery.rust_ci.refiled]] |
| 125 | +repo = "hyperpolymath/absolute-zero" |
| 126 | +old_pr = 45 |
| 127 | +new_pr = 53 |
| 128 | +final_state = "merged" |
| 129 | +merge_method = "manual (no required-checks BP, so auto-merge unavailable)" |
| 130 | + |
| 131 | +[[stuck_pr_recovery.rust_ci.refiled]] |
| 132 | +repo = "hyperpolymath/kategoria-pipeline" |
| 133 | +old_pr = 12 |
| 134 | +new_pr = 16 |
| 135 | +final_state = "merged" |
| 136 | +merge_method = "auto-merge after secondary BP cleanup" |
| 137 | + |
| 138 | +[[stuck_pr_recovery.rust_ci.refiled]] |
| 139 | +repo = "hyperpolymath/nextgen-typing" |
| 140 | +old_pr = 9 |
| 141 | +new_pr = 15 |
| 142 | +final_state = "merged" |
| 143 | +merge_method = "auto-merge after secondary BP cleanup" |
| 144 | + |
| 145 | +[[stuck_pr_recovery.rust_ci.refiled]] |
| 146 | +repo = "hyperpolymath/proof-burrower" |
| 147 | +old_pr = 15 |
| 148 | +new_pr = 21 |
| 149 | +final_state = "merged" |
| 150 | +merge_method = "auto-merge after secondary BP cleanup" |
| 151 | + |
| 152 | +[stale_bp_context_clusters] |
| 153 | +note = "Each cluster is a set of required-status-check contexts that no workflow currently produces; dropping them is a no-op for actual gating but unblocks the queue." |
| 154 | + |
| 155 | +[stale_bp_context_clusters.standards_main] |
| 156 | +context = "Check Required Files" |
| 157 | + |
| 158 | +[stale_bp_context_clusters.governance_legacy] |
| 159 | +contexts = ["governance / Code quality + docs", "governance / Guix primary / Nix fallback policy", "governance / Language / package anti-pattern policy", "governance / Security policy checks", "governance / Well-Known (RFC 9116 + RSR)", "governance / Workflow security linter", "Hypatia Neurosymbolic Analysis", "gitleaks", "rust-secrets", "trufflehog"] |
| 160 | + |
| 161 | +[stale_bp_context_clusters.rust_ci_legacy] |
| 162 | +contexts = ["check-critical", ".github/dependabot.yml", "rhodibot", "validate"] |
| 163 | + |
| 164 | +[stale_bp_context_clusters.mirror_legacy] |
| 165 | +contexts = ["mirror-codeberg", "mirror-gitlab", "mirror-sourcehut"] |
| 166 | + |
| 167 | +[stale_bp_context_clusters.rsr_template_legacy] |
| 168 | +contexts = ["analysis", "antipattern-check", "check", "dispatch", "docs", "lint"] |
| 169 | + |
| 170 | +[follow_up_NOT_discharged] |
| 171 | +reusables_ci_burnin = "#192/#193/#205 will auto-merge when CI greens. Their wrapper sweeps then fire via the pre-built workers + inventories on /tmp." |
| 172 | +stale_bp_estate_sweep = "Only 7 repos had stale BP contexts dropped this session. A future sweep enumerating gh api repos/<o>/<r>/branches/main/protection/required_status_checks across the estate would surface the rest." |
| 173 | +cloudflare_token_leak = "Status unverified at Cloudflare. Code fix #161 merged. History rewrite paused pending user confirmation of rotation." |
| 174 | + |
| 175 | +[provenance] |
| 176 | +session_log_jsonl = "~/.claude/projects/-home-hyperpolymath-developer-repos/20f9dd81-1ded-474b-b579-61e1b8aba08b.jsonl" |
| 177 | +sweep_workers = ["/tmp/mirror-wrapper-worker.sh", "/tmp/secret-scanner-worker.sh", "/tmp/codeql-worker.sh", "/tmp/hypatia-worker.sh", "/tmp/scorecard-worker.sh"] |
| 178 | +recovery_workers = ["/tmp/wrapper-rebase/refile-one.sh", "/tmp/retry-pr-create.sh", "/tmp/slow-retry-72.sh"] |
| 179 | +sweep_logs = ["/tmp/mirror-sweep-logs/", "/tmp/secret-sweep-logs/", "/tmp/wrapper-rebase/"] |
| 180 | +inventories = ["/tmp/{mirror,secret,codeql,hypatia,scorecard}-deploys-noforks.tsv"] |
| 181 | + |
| 182 | +[memory_references] |
| 183 | +session_campaign = "session_2026_05_26_reusables_campaign.md" |
| 184 | +session_metadata = "session_2026_05_26_estate_metadata_campaign.md" |
| 185 | +admin_merge_predecessor = "project_admin_merge_wrappers_2026_05_26.md" |
| 186 | +rust_ci_predecessor = "project_rust_ci_wrapper_sweep_2026_05_26.md" |
| 187 | +auto_merge_policy = "feedback_always_automerge_prs.md" |
| 188 | +fanout_rule = "feedback_fanout_needs_bash_allowlist.md" |
| 189 | +rate_limit_lesson = "feedback_github_secondary_rate_limit_burst.md" |
| 190 | +gpg_signing_rule = "feedback_all_commits_gpg_signed.md" |
| 191 | +template_pattern = "estate-template-propagation-pattern" |
| 192 | + |
| 193 | +[sibling_reusables] |
| 194 | +landed_prior = ["standards#168 governance + deno-ci", "standards#174 rust-ci + elixir-ci"] |
| 195 | +landed_this_session = ["standards#187 mirror", "standards#190 secret-scanner"] |
| 196 | +ci_burnin_this_session = ["standards#192 codeql", "standards#193 hypatia-scan", "standards#205 scorecard"] |
| 197 | +remaining_unclassified = [] |
0 commit comments