ci: 3 self-contained workflows, after the estate template by hyperpolymath · Pull Request #85 · hyperpolymath/anytype

hyperpolymath · 2026-11-10T21:27:08Z

Summary

hypatia-scan.yml, rust-ci.yml and scorecard.yml call reusable workflows of the standards repository. The Actions rule of this repository refuses a reusable workflow of a different owner, so each run fails with no job (for example Rust CI run 42890465211, startup_failure).

This PR makes the 3 files self-contained, after the estate template (hyperpolymath/rsr-template-repo at 0dfde85). system-et has the same form (hyperpolymath/system-et#92). No Actions setting is necessary for them.

Changes

hypatia-scan.yml: builds Hypatia from hyperpolymath/hypatia at the pinned commit, writes JSON and SARIF, uploads the SARIF (category hypatia), and fails on a critical finding.
rust-ci.yml: compiles scripts/*.rs with -D warnings, and runs cargo check and cargo test when a Cargo.toml exists. This repository has no Rust file today, so the job has nothing to compile.
scorecard.yml: OSSF Scorecard with SARIF upload. The schedule and dispatch triggers are the same as before.
README.adoc (workflows): a new section on these 3 files.

Each uses: is a step-level action with a full commit SHA. The text outside comments is the template text, with 1 exception: the step name Upload Hypatia findings (the template says ... for the verdict grid, and this repository has no verdict grid).

What changes in behaviour

A new check appears on each pull request: Hypatia Neurosymbolic Analysis. It fails when Hypatia reports a critical finding. The run on this pull request shows the count for this repository.
HYPATIA_SCAN_PAT is no longer passed. The template uses the job token only. With the job token, Hypatia reads code-scanning and Dependabot alerts. It cannot read secret-scanning alerts.
Triggers: hypatia-scan.yml now runs on each pull request (before: pull requests to main and master only). rust-ci.yml gets workflow_dispatch.
Not in this PR: governance.yml and mirror.yml. Their template forms do less than the reusable workflows that they would replace (governance: 1 job in place of 14; mirror: no push to a forge). That is a decision for the owner.

RSR Quality Checklist

Required

Tests pass: tests/workflows/validate_workflows_test.sh passes (0 errors, 2 recommendations, same as before)
Code is formatted (just fmt or equivalent): not run, the change is 3 workflow files and 1 document
Linter is clean (no new warnings or errors): not run locally, the PR checks give the result
No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
No unsafe blocks without // SAFETY: comments
No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
SPDX license headers present on all new/modified source files
No secrets, credentials, or .env files included

As Applicable

Documentation updated: .github/workflows/README.adoc

Testing

A diff of each file against the template, with comment lines removed, shows 0 differences for rust-ci.yml and scorecard.yml, and the 1 step name for hypatia-scan.yml.
yq parses the 3 files. Line 1 of each is the SPDX line (the lint rule of this repository reads line 1).
0 tag references: each action has a full commit SHA.

Not verified before the push:

The runs of Hypatia Security Scan and Rust CI on this pull request are the first evidence.
scorecard.yml does not run on a pull request. Its first run is the next schedule (04:00 UTC) or a manual dispatch after the merge. actions/cache, github/codeql-action/upload-sarif and ossf/scorecard-action are new in this repository; if the Actions rule refuses one of them, the run fails at creation.

Generated by Claude Code

hypatia-scan.yml, rust-ci.yml and scorecard.yml called reusable workflows of the standards repository. The Actions rule of this repository refuses a reusable workflow of a different owner, so each run failed with no job. Each file is now the workflow of the estate template (hyperpolymath/rsr-template-repo at 0dfde85), with step-level actions that are pinned to full commit SHAs. The text outside comments is the template text, except 1 step name in hypatia-scan.yml (no verdict grid in this repository). - hypatia-scan.yml: builds Hypatia at the pinned commit, uploads SARIF, fails on a critical finding. It uses the job token only, so the secret HYPATIA_SCAN_PAT is no longer passed. - rust-ci.yml: compiles scripts/*.rs and runs cargo when Cargo.toml exists. This repository has no Rust file today. - scorecard.yml: same schedule and dispatch triggers as before. - README.adoc (workflows): new section on these 3 files. governance.yml and mirror.yml stay callers: their template forms do less than the reusable workflows, and the owner decides on them. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK

coderabbitai · 2026-11-10T21:27:17Z

Caution

Review failed

The pull request is closed.

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

sonarqubecloud · 2026-11-10T21:27:25Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

chatgpt-codex-connector · 2026-11-10T21:30:54Z

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-10T21:30:51.823371Z We couldn’t complete this review. Comment `@codex review` to try again.	`e36dafb`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-11-10T21:30:56Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

…descriptiles (#87) ## Summary The check `Hypatia Neurosymbolic Analysis` is red on `main` since #85 made the Hypatia scan run. It reports 5 critical findings, all rule `structural_drift/SD004`, "Descriptile in retired location -- must be in .machine_readable/descriptiles/": `META.a2ml`, `ECOSYSTEM.a2ml`, `AGENTIC.a2ml`, `NEUROSYM.a2ml` and `PLAYBOOK.a2ml` in `.machine_readable/6a2/`. This PR moves the folder to the estate layout. system-et has the same layout (hyperpolymath/system-et#92). > **Known drift after this PR (owner decision of 2026-11-10): the coaptation receipt is stale.** > `Mustfile.a2ml` must change: its check `test -d .machine_readable/6a2 ...` names the folder. The receipt has the hash of that file in line 89 (`must@20748d123686`). The extract script of the repository now gives `must@fbbcf90bc87f`. > `receipts/latest.a2ml` is generated and is not touched here. **Run `just coapt` on a machine that has Nickel**, then `just validate-coapt`. No CI job runs that check, so nothing goes red to say so. ## Changes - `git mv .machine_readable/6a2 .machine_readable/descriptiles`: 11 files, with `anchors/`. 8 are pure renames; 3 also change 1 or 2 lines of their own text (`0-AI-MANIFEST.a2ml`, `PLAYBOOK.a2ml`, `README.adoc`). - 34 other files that name the old path get the new path: - scripts: arrival pack (`extract.sh`, `generate.sh`, `verify.sh`), coaptation (`coapt.sh`, `extract-facts.sh`, `verify.sh`), `scripts/validate-template.sh`, `tests/e2e/template_instantiation_test.sh` - contracts: the 6 contractiles, `Mustfile.a2ml`, `coapt.k9.ncl`, `claude-md.k9.ncl`, `witness-map.ncl` - configuration: `openssf-compliance.yml`, `.pre-commit-config.yaml`, the 2 AI manifests, 2 maintenance policies, `root-allow.txt` (comment) - documents and the pull request template - The wording of each changed line is the wording that system-et has. Not changed, on purpose: - `anytype_chora.deed`: 2 comment lines still say `6a2`. The arrival pack has the hash of this file (`DEED@f8d9d5bbaba0` in `CLAUDE.md`), and `CLAUDE.md` can be made again only with Nickel. With the deed unchanged, `CLAUDE.md` stays in sync. - `.machine_readable/archive/state-v1.a2ml`: its note says where the archived file was. That is history. - `user_6a2_is_contractile_ought.md` in 2 comments is the name of a note, not a path. ## RSR Quality Checklist ### Required - [x] Tests pass: see Testing - [ ] Code is formatted (`just fmt` or equivalent): not run - [ ] Linter is clean (no new warnings or errors): not run locally, the PR checks give the result - [x] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) - [x] No `unsafe` blocks without `// SAFETY:` comments - [x] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) - [x] SPDX license headers present on all new/modified source files - [x] No secrets, credentials, or `.env` files included ### As Applicable - [x] `.machine_readable/descriptiles/ECOSYSTEM.a2ml` and `META.a2ml`: moved, content not changed - [x] Documentation updated: each document that names the path ## Testing Run in a clone, with the scripts of this repository: - `.github/hooks/validate-k9.sh`: 17 files, 0 errors. - The 2 Must checks that name the folder (`six-directory-present`, `anchors-directory`): both pass. - `tests/workflows/validate_workflows_test.sh`: passes. - Inputs of the generated files, before and after the move: - arrival pack data (`extract.sh`): byte-identical. So `CLAUDE.md` is still in sync. - coaptation facts (`extract-facts.sh`): byte-identical. - coaptation clauses (`extract-clauses.sh`): 2 descriptions and the hash of `Mustfile.a2ml` differ. That is the drift above. - `git grep 6a2`: the only lines left are the ones listed under "Not changed", and 1 commit hash that has those 3 characters. Not verified before the push: - The Hypatia result. I cannot run Hypatia here. The run of `Hypatia Neurosymbolic Analysis` on this pull request must show `Critical: 0`. - `just validate-claude-md` and `just validate-coapt`: both need Nickel. --- _Generated by [Claude Code](https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK)_ Co-authored-by: Claude <noreply@anthropic.com>

hyperpolymath marked this pull request as ready for review November 10, 2026 21:30

hyperpolymath merged commit 3cfbd36 into main Nov 10, 2026
29 of 30 checks passed

hyperpolymath assigned Copilot Nov 10, 2026

hyperpolymath deleted the claude/self-contained-gates branch November 10, 2026 21:30

hyperpolymath mentioned this pull request Nov 10, 2026

chore(descriptiles): move .machine_readable/6a2 to .machine_readable/descriptiles #87

Merged

8 of 10 tasks

Navigation Menu

Repository navigation

ci: 3 self-contained workflows, after the estate template - #85

ci: 3 self-contained workflows, after the estate template#85
hyperpolymath merged 1 commit into
mainfrom
claude/self-contained-gates

hyperpolymath commented Nov 10, 2026

Uh oh!

coderabbitai Bot commented Nov 10, 2026 •

edited

Loading

Review failed

Uh oh!

sonarqubecloud Bot commented Nov 10, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

hyperpolymath commented Nov 10, 2026

Summary

Changes

What changes in behaviour

RSR Quality Checklist

Required

As Applicable

Testing

Uh oh!

coderabbitai Bot commented Nov 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Uh oh!

sonarqubecloud Bot commented Nov 10, 2026

Quality Gate passed

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

chatgpt-codex-connector Bot commented Nov 10, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Nov 10, 2026 •

edited

Loading