From 058dd61ce6f2efa17d377766e4840773c5148136 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 20:42:55 +0000 Subject: [PATCH] fix(k9): bring the 18 K9 files to the validator's contract Validate K9 contracts failed on main with 20 errors in 18 files (scaffold debt from the template, not from any recent change). Brought to 0 errors and 0 warnings, also under INPUT_STRICT=true, by the same moves systemet already made: - K9! magic line first, on the 8 contractile, arrival-pack and coaptation files and on methodology-guard. - signature_required = true in the security block of the four Hunt-tier contractiles (must, bust, intend, trust), as validator rule K9-S008 asks. - methodology-guard gains a Yard-leash pedigree block. - coordination.k9 and session/custom-checks.k9 were YAML under a K9 extension, so they could not carry a magic line. They become coordination.k9.ncl and session/custom-checks.k9.ncl, Nickel records with a Kennel pedigree and the same content, copied from systemet. - container/stapeln/deploy.k9.ncl still holds unfilled {{PLACEHOLDERS}}, so it is a template, not a contract: renamed to deploy.k9.ncl.in, as systemet did. - root-allow.txt and session/README.adoc follow the renames. Deliberately not changed: the methodology-guard copyright line still carries {{CURRENT_YEAR}} {{AUTHOR}} placeholders. Filling it is a licence-header edit, which is manual and owner-only. The SPDX line is present, so the validator is satisfied. The comments in PLAYBOOK.a2ml and the historical governance docs still say coordination.k9; they are canon-derived or dated records. No consumer in this repo evaluates the .k9.ncl files with nickel (the arrival pack and coaptation scripts read a2ml and the deed, not these), so a leading K9! line cannot break a runtime path here. validate-template.sh output is identical before and after; the arrival-pack and coaptation drift gates and the root-shape check pass. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01J1XmMC49T8sZ3uUuvrgB7y --- .../arrival-pack/claude-md.k9.ncl | 1 + .machine_readable/coaptation/coapt.k9.ncl | 1 + .../contractiles/adjust/adjust.k9.ncl | 1 + .../contractiles/bust/bust.k9.ncl | 2 + .../contractiles/dust/dust.k9.ncl | 1 + .../contractiles/intend/intend.k9.ncl | 2 + .../contractiles/must/must.k9.ncl | 2 + .../contractiles/trust/trust.k9.ncl | 2 + .machine_readable/root-allow.txt | 4 +- .../self-validating/methodology-guard.k9.ncl | 13 +++++ .../{deploy.k9.ncl => deploy.k9.ncl.in} | 1 + coordination.k9 | 43 --------------- coordination.k9.ncl | 50 ++++++++++++++++++ session/README.adoc | 2 +- session/custom-checks.k9 | 15 ------ session/custom-checks.k9.ncl | 52 +++++++++++++++++++ 16 files changed, 131 insertions(+), 61 deletions(-) rename container/stapeln/{deploy.k9.ncl => deploy.k9.ncl.in} (99%) delete mode 100644 coordination.k9 create mode 100644 coordination.k9.ncl delete mode 100644 session/custom-checks.k9 create mode 100644 session/custom-checks.k9.ncl diff --git a/.machine_readable/arrival-pack/claude-md.k9.ncl b/.machine_readable/arrival-pack/claude-md.k9.ncl index 8fa81f8..652f795 100644 --- a/.machine_readable/arrival-pack/claude-md.k9.ncl +++ b/.machine_readable/arrival-pack/claude-md.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.machine_readable/coaptation/coapt.k9.ncl b/.machine_readable/coaptation/coapt.k9.ncl index 6c00e95..3239ad4 100644 --- a/.machine_readable/coaptation/coapt.k9.ncl +++ b/.machine_readable/coaptation/coapt.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) # diff --git a/.machine_readable/contractiles/adjust/adjust.k9.ncl b/.machine_readable/contractiles/adjust/adjust.k9.ncl index 9ff26c9..513a6e3 100644 --- a/.machine_readable/contractiles/adjust/adjust.k9.ncl +++ b/.machine_readable/contractiles/adjust/adjust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # adjust.k9.ncl — K9 trust-tier component of the adjust trident # Author: Jonathan D.A. Jewell diff --git a/.machine_readable/contractiles/bust/bust.k9.ncl b/.machine_readable/contractiles/bust/bust.k9.ncl index c60a0ae..a29a6a8 100644 --- a/.machine_readable/contractiles/bust/bust.k9.ncl +++ b/.machine_readable/contractiles/bust/bust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # bust.k9.ncl — K9 trust-tier component of the bust trident # Author: Jonathan D.A. Jewell @@ -49,6 +50,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt probe_scope = 'read_only, }, }, diff --git a/.machine_readable/contractiles/dust/dust.k9.ncl b/.machine_readable/contractiles/dust/dust.k9.ncl index ef21668..f19cdd4 100644 --- a/.machine_readable/contractiles/dust/dust.k9.ncl +++ b/.machine_readable/contractiles/dust/dust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # dust.k9.ncl — K9 trust-tier component of the dust trident # Author: Jonathan D.A. Jewell diff --git a/.machine_readable/contractiles/intend/intend.k9.ncl b/.machine_readable/contractiles/intend/intend.k9.ncl index 5b0c295..0df05a6 100644 --- a/.machine_readable/contractiles/intend/intend.k9.ncl +++ b/.machine_readable/contractiles/intend/intend.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # intend.k9.ncl — K9 trust-tier component of the intend trident # Author: Jonathan D.A. Jewell @@ -63,6 +64,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, # evidence sinks are indirected allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt }, }, diff --git a/.machine_readable/contractiles/must/must.k9.ncl b/.machine_readable/contractiles/must/must.k9.ncl index 6bb51fc..1361ddd 100644 --- a/.machine_readable/contractiles/must/must.k9.ncl +++ b/.machine_readable/contractiles/must/must.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # must.k9.ncl — K9 trust-tier component of the must trident # Author: Jonathan D.A. Jewell @@ -57,6 +58,7 @@ let base = import "../_base.ncl" in allow_network = false, allow_filesystem_write = false, allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt probe_scope = 'read_only, # must probes NEVER mutate probe_kinds_allowed = [ 'file_existence, diff --git a/.machine_readable/contractiles/trust/trust.k9.ncl b/.machine_readable/contractiles/trust/trust.k9.ncl index 6e61ed3..c89fd29 100644 --- a/.machine_readable/contractiles/trust/trust.k9.ncl +++ b/.machine_readable/contractiles/trust/trust.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # trust.k9.ncl — K9 trust-tier component of the trust trident # Author: Jonathan D.A. Jewell @@ -75,6 +76,7 @@ let base = import "../_base.ncl" in allow_network = false, # verifications offline by default allow_filesystem_write = false, # evidence sinks are indirected allow_subprocess = true, + signature_required = true, # K9-S008: required at 'Hunt authorised_probes_only = true, # probe section explicitly lists allowed targets + probe classes probe_scope_enforcement = 'this_repo_only, # probes NEVER hit external systems }, diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index 01201a9..4b6407e 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -31,7 +31,7 @@ CITATION.cff # citation metadata (surfaced at root by #96) # ─── Build entry points (must live at root for their tooling) ──────────────── Justfile # delegates phases to build/just/*.just -coordination.k9 # repo-local session binding (template-mandated) +coordination.k9.ncl # repo-local session binding (template-mandated) # ─── Conventional dotfiles (tool-required at root) ─────────────────────────── .editorconfig @@ -57,7 +57,7 @@ ci/ # .gitlab-ci.yml, .pre-commit-config.yaml (root shims docs/ # onboarding/, status/, governance/, ... docs-template/ # template-only: scaffolding docs copied into new repos machine-readable-design/ # template-only: design rationale for .machine_readable/ layout -session/ # dispatch.sh, custom-checks.k9, local-hooks.sh +session/ # dispatch.sh, custom-checks.k9.ncl, local-hooks.sh # Source / test / artifact trees (project-specific but conventional) src/ diff --git a/.machine_readable/self-validating/methodology-guard.k9.ncl b/.machine_readable/self-validating/methodology-guard.k9.ncl index c0b21c6..59b4232 100644 --- a/.machine_readable/self-validating/methodology-guard.k9.ncl +++ b/.machine_readable/self-validating/methodology-guard.k9.ncl @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> # @@ -12,6 +13,18 @@ let methodology_guard = { version = "1.0.0", description = "Validates that agent work respects declared methodology constraints", + pedigree = { + schema_version = "1.0.0", + component_type = "validator:methodology-guard", + metadata = { + name = "methodology-guard", + version = "1.0.0", + }, + security = { + leash = 'Yard, + }, + }, + checks = { divergent_invariant_language = { description = "No files in languages violating the divergent language invariant", diff --git a/container/stapeln/deploy.k9.ncl b/container/stapeln/deploy.k9.ncl.in similarity index 99% rename from container/stapeln/deploy.k9.ncl rename to container/stapeln/deploy.k9.ncl.in index 02b7df4..8182fe8 100644 --- a/container/stapeln/deploy.k9.ncl +++ b/container/stapeln/deploy.k9.ncl.in @@ -1,3 +1,4 @@ +K9! # SPDX-License-Identifier: MPL-2.0 # deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) # diff --git a/coordination.k9 b/coordination.k9 deleted file mode 100644 index ba31125..0000000 --- a/coordination.k9 +++ /dev/null @@ -1,43 +0,0 @@ -# Thin coordination bindings for central session-management standards - -session_management: - source_of_truth: "standards/session-management-standards" - canonical_commands: - - "intake repo " - - "checkpoint change " - - "verify maintenance " - - "verify substantial " - - "verify release " - - "close planned " - - "close urgent " - - "recover repo " - - "handover full " - - "handover split " - - "handover model " - - "handover human " - -signals: - - name: "session.intake" - command: "intake repo " - - name: "session.checkpoint" - command: "checkpoint change " - - name: "session.verify.maintenance" - command: "verify maintenance " - - name: "session.verify.substantial" - command: "verify substantial " - - name: "session.verify.release" - command: "verify release " - - name: "session.close.planned" - command: "close planned " - - name: "session.close.urgent" - command: "close urgent " - - name: "session.recover" - command: "recover repo " - - name: "session.handover.full" - command: "handover full " - - name: "session.handover.split" - command: "handover split " - - name: "session.handover.model" - command: "handover model " - - name: "session.handover.human" - command: "handover human " diff --git a/coordination.k9.ncl b/coordination.k9.ncl new file mode 100644 index 0000000..69721f8 --- /dev/null +++ b/coordination.k9.ncl @@ -0,0 +1,50 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Thin coordination bindings for central session-management standards + +{ + pedigree = { + schema_version = "1.0.0", + component_type = "session:coordination-binding", + metadata = { + name = "session-coordination", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, + + session_management = { + source_of_truth = "standards/3-practice/session-management-standards", + canonical_commands = [ + "intake repo ", + "checkpoint change ", + "verify maintenance ", + "verify substantial ", + "verify release ", + "close planned ", + "close urgent ", + "recover repo ", + "handover full ", + "handover split ", + "handover model ", + "handover human ", + ], + }, + + signals = [ + { name = "session.intake", command = "intake repo " }, + { name = "session.checkpoint", command = "checkpoint change " }, + { name = "session.verify.maintenance", command = "verify maintenance " }, + { name = "session.verify.substantial", command = "verify substantial " }, + { name = "session.verify.release", command = "verify release " }, + { name = "session.close.planned", command = "close planned " }, + { name = "session.close.urgent", command = "close urgent " }, + { name = "session.recover", command = "recover repo " }, + { name = "session.handover.full", command = "handover full " }, + { name = "session.handover.split", command = "handover split " }, + { name = "session.handover.model", command = "handover model " }, + { name = "session.handover.human", command = "handover human " }, + ], +} diff --git a/session/README.adoc b/session/README.adoc index d14a6d7..a6b1de7 100644 --- a/session/README.adoc +++ b/session/README.adoc @@ -11,7 +11,7 @@ Authoritative protocols live in: This repo keeps only thin bindings: * `+dispatch.sh+` maps canonical commands to central protocol paths. -* `+custom-checks.k9+` defines repo-local policy checks. +* `+custom-checks.k9.ncl+` defines repo-local policy checks as a Nickel record. * `+local-hooks.sh+` provides optional repo-specific hook behavior. === Canonical Commands diff --git a/session/custom-checks.k9 b/session/custom-checks.k9 deleted file mode 100644 index bd932fa..0000000 --- a/session/custom-checks.k9 +++ /dev/null @@ -1,15 +0,0 @@ -# Local repository session checks (thin policy layer) -version: "0.1" - -checks: - - id: "session-state-has-next-action" - applies_to: ["close planned", "close urgent", "handover full", "handover split", "handover model", "handover human"] - requirement: "LAST-CANONICAL-COMMAND.md contains next intended action" - - - id: "session-state-has-residual-risks" - applies_to: ["verify maintenance", "verify substantial", "verify release", "recover repo"] - requirement: "Residual risks field is not left blank" - - - id: "session-state-has-recommended-next-protocol" - applies_to: ["intake repo", "checkpoint change", "recover repo", "handover full"] - requirement: "Recommended next protocol is set" diff --git a/session/custom-checks.k9.ncl b/session/custom-checks.k9.ncl new file mode 100644 index 0000000..7f6c01a --- /dev/null +++ b/session/custom-checks.k9.ncl @@ -0,0 +1,52 @@ +K9! +# SPDX-License-Identifier: MPL-2.0 +# Local repository session checks (thin policy layer) + +{ + pedigree = { + schema_version = "1.0.0", + component_type = "session:custom-checks", + metadata = { + name = "custom-session-checks", + version = "0.1.0", + }, + security = { + leash = 'Kennel, + }, + }, + + checks = [ + { + id = "session-state-has-next-action", + applies_to = [ + "close planned", + "close urgent", + "handover full", + "handover split", + "handover model", + "handover human", + ], + requirement = "LAST-CANONICAL-COMMAND.md contains next intended action", + }, + { + id = "session-state-has-residual-risks", + applies_to = [ + "verify maintenance", + "verify substantial", + "verify release", + "recover repo", + ], + requirement = "Residual risks field is not left blank", + }, + { + id = "session-state-has-recommended-next-protocol", + applies_to = [ + "intake repo", + "checkpoint change", + "recover repo", + "handover full", + ], + requirement = "Recommended next protocol is set", + }, + ], +}