From f5e33da12778978132aa0627d4052c9a55097e09 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:16:23 +0000
Subject: [PATCH 1/6] fix(ci,governance): remediate Dependabot, Hypatia,
K9/DEED conformance, and actions.lock closure
Resolves pre-merge app, Hypatia, K9-DEED, and CI/CD blockers across main and PR #367:
- Incorporates PR #367's 16 GitHub Actions bumps and transitively closes
.github/workflows/actions.lock across all workflow and job-level reusable
refs (including metadatastician/standards@1725bebd3773 and
slsa-framework/slsa-github-generator@f7dd8c54c206), clearing
startup_failure on mirror.yml and scorecard.yml.
- Repins governance, mirror, readme-derive, scorecard, and secret-scanner
reusable callers from former owner hyperpolymath/standards to
metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85.
- Pins hypatia-scan.yml, proofs.yml, backend-assurance.yml, e2e.yml, and
dogfood-gate.yml off ubuntu-latest (ubuntu-26.04) onto ubuntu-24.04 with
ImageOS-keyed Idris2 caches and guards Hypatia SARIF upload on
steps.sarif.outcome == 'success'.
- Scopes .github/dependabot.yml to real manifest directories (/, /elixir,
/coord-tui, /tray), eliminating failing cargo/mix/pip root updater runs.
- Adds root boj-server_chora.deed per clade-to-repo-deed.adoc (ruled
2026-10-27) and agentic-neurosym-playbook-to-repo-deed.adoc, brings all
five .k9.ncl components into full K9 v1.0.0 L0+L1+L2 conformance, and
wires canonical deed_lint.js + k9-validate.sh (--layer L2 --strict) into
dogfood-gate.yml.
- Adds scripts/pre-merge-gate.sh (just pre-merge-gate) to enforce conflict,
app, Hypatia, K9/DEED, lockfile, and MCP bridge checks before every merge.
Refs #367, metadatastician/standards#1286
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
.github/dependabot.yml | 50 ++-
.github/workflows/abi-drift.yml | 6 +-
.github/workflows/actions.lock | 365 ++++++++++--------
.github/workflows/backend-assurance.yml | 14 +-
.github/workflows/build.yml | 4 +-
.github/workflows/codeql.yml | 6 +-
.github/workflows/container-publish.yml | 4 +-
.github/workflows/dogfood-gate.yml | 129 +++++--
.github/workflows/e2e.yml | 34 +-
.github/workflows/fuzz.yml | 4 +-
.github/workflows/governance.yml | 7 +-
.github/workflows/hcg-surface-drift.yml | 4 +-
.github/workflows/hypatia-scan.yml | 16 +-
.github/workflows/instant-sync.yml | 2 +-
.github/workflows/lsp-dap-bsp.yml | 10 +-
.github/workflows/mirror.yml | 4 +-
.github/workflows/pages-deploy.yml | 2 +-
.github/workflows/pages.yml | 8 +-
.github/workflows/proofs.yml | 14 +-
.github/workflows/publish.yml | 6 +-
.github/workflows/push-email-notify.yml | 2 +-
.github/workflows/readme-derive.yml | 7 +-
.github/workflows/release.yml | 14 +-
.github/workflows/scorecard.yml | 2 +-
.github/workflows/secret-scanner.yml | 7 +-
.github/workflows/truthfulness.yml | 4 +-
.github/workflows/zig-test.yml | 4 +-
.../boj-server-metadata.k9.ncl | 10 +-
.../self-validating/examples/ci-config.k9.ncl | 2 +
.../examples/project-metadata.k9.ncl | 4 +-
.../examples/setup-repo.k9.ncl | 20 +-
Justfile | 4 +
boj-server_chora.deed | 84 ++++
container/deploy.k9.ncl | 29 +-
scripts/pre-merge-gate.sh | 197 ++++++++++
35 files changed, 744 insertions(+), 335 deletions(-)
mode change 100755 => 100644 .github/workflows/pages.yml
create mode 100644 boj-server_chora.deed
create mode 100755 scripts/pre-merge-gate.sh
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0fb98e2c..e0af0a3f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,48 +1,44 @@
# SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for RSR-compliant repositories
-# Covers common ecosystems - remove unused ones for your project
+# Dependabot configuration for hyperpolymath/boj-server
+# Scoped strictly to directories carrying real manifests (docs/DEPENDABOT-POLICY.adoc).
version: 2
updates:
- # GitHub Actions - always include
+ # GitHub Actions workflows
- package-ecosystem: "github-actions"
directory: "/"
schedule:
- interval: "daily"
+ interval: "weekly"
groups:
actions:
patterns:
- "*"
+ open-pull-requests-limit: 2
- # Rust/Cargo
- - package-ecosystem: "cargo"
+ # Root MCP bridge package.json (Bun / Deno / pnpm)
+ - package-ecosystem: "npm"
directory: "/"
schedule:
- interval: "daily"
- ignore:
- - dependency-name: "*"
- update-types: ["version-update:semver-patch"]
+ interval: "weekly"
+ open-pull-requests-limit: 2
- # Elixir/Mix
+ # Elixir REST adapter (elixir/mix.exs)
- package-ecosystem: "mix"
- directory: "/"
+ directory: "/elixir"
schedule:
- interval: "daily"
+ interval: "weekly"
+ open-pull-requests-limit: 2
- # Node.js/npm
- - package-ecosystem: "npm"
- directory: "/"
- schedule:
- interval: "daily"
-
- # Python/pip
- - package-ecosystem: "pip"
- directory: "/"
+ # Rust coordination TUI (coord-tui/Cargo.toml)
+ - package-ecosystem: "cargo"
+ directory: "/coord-tui"
schedule:
- interval: "daily"
+ interval: "weekly"
+ open-pull-requests-limit: 2
- # Guix flakes
- - package-ecosystem: "guix"
- directory: "/"
+ # Rust system tray utility (tray/Cargo.toml)
+ - package-ecosystem: "cargo"
+ directory: "/tray"
schedule:
- interval: "daily"
+ interval: "weekly"
+ open-pull-requests-limit: 2
diff --git a/.github/workflows/abi-drift.yml b/.github/workflows/abi-drift.yml
index 075a9c6c..cd41cc92 100644
--- a/.github/workflows/abi-drift.yml
+++ b/.github/workflows/abi-drift.yml
@@ -47,7 +47,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -72,7 +72,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
# Need at least two commits so `git diff origin/...HEAD`
# can compute the changed-cartridge set on pull_request events.
@@ -92,7 +92,7 @@ jobs:
# GADT-skip fix (iseriser#20, merged 2026-05-20) never reached CI.
# Bumping ISERISER_REV invalidates the cache and forces a rebuild.
- name: Cache cargo bin (iseriser install)
- uses: actions/cache@v4.2.2
+ uses: actions/cache@v6.1.0
env:
ISERISER_REV: 741a3b63e7619b6e9cfe7f91b04d7ccfb130b1ca
with:
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 739b3185..892301da 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -1,267 +1,294 @@
# This file is machine-generated by `gh actions-lock`.
# Do not edit by hand; run `gh actions-lock` to update.
# Docs: https://gh.io/actions-lockfile
-version: 'v0.0.2'
+version: 'v0.0.3'
workflows:
'.github/workflows/abi-drift.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
- 'dtolnay/rust-toolchain@v1'
'.github/workflows/backend-assurance.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
- - 'erlef/setup-beam@v1.24.0'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
+ - 'erlef/setup-beam@v1.24.1'
'.github/workflows/build.yml':
- - 'actions/checkout@v4.3.1'
- - 'sonarsource/sonarqube-scan-action@v8.1.0'
+ - 'actions/checkout@v7.0.1'
+ - 'sonarsource/sonarqube-scan-action@v8.3.0'
'.github/workflows/codeql.yml':
- - 'actions/checkout@v6.0.2'
- - 'github/codeql-action@v4.34.0'
+ - 'actions/checkout@v7.0.1'
+ - 'github/codeql-action@v4.39.0'
'.github/workflows/container-publish.yml':
- - 'actions/attest-build-provenance@v2.4.0'
- - 'actions/checkout@v6.0.2'
+ - 'actions/attest-build-provenance@v4.2.2'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/dogfood-gate.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
+ - 'oven-sh/setup-bun@v2.2.0'
'.github/workflows/e2e.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/github-script@v8.0.0'
- - 'actions/setup-node@v4.4.0'
- - 'actions/upload-artifact@v4.6.2'
- - 'denoland/setup-deno@v2.0.4'
- - 'erlef/setup-beam@v1.24.0'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/github-script@v9.0.0'
+ - 'actions/setup-node@v7.1.0'
+ - 'actions/upload-artifact@v7.0.2'
+ - 'denoland/setup-deno@v2.0.5'
+ - 'erlef/setup-beam@v1.24.1'
- 'mlugg/setup-zig@v2.2.1'
- 'oven-sh/setup-bun@v2.2.0'
'.github/workflows/fuzz.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
- '.github/workflows/governance.yml': []
+ '.github/workflows/governance.yml':
+ - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
'.github/workflows/hcg-surface-drift.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/hypatia-scan.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/github-script@v8.0.0'
- - 'actions/upload-artifact@v4.6.2'
- - 'erlef/setup-beam@v1.24.0'
- - 'github/codeql-action@v4.32.6'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/github-script@v9.0.0'
+ - 'actions/upload-artifact@v7.0.2'
+ - 'erlef/setup-beam@v1.24.1'
+ - 'github/codeql-action@v4.39.0'
'.github/workflows/instant-sync.yml':
- - 'peter-evans/repository-dispatch@v3.0.0'
+ - 'peter-evans/repository-dispatch@v4.0.1'
'.github/workflows/label-triage.yml': []
'.github/workflows/labels.yml': []
'.github/workflows/lsp-dap-bsp.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
- '.github/workflows/mirror.yml': []
+ '.github/workflows/mirror.yml':
+ - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
'.github/workflows/pages-deploy.yml':
- - 'actions/checkout@v4.4.0'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/pages.yml':
- - 'actions/checkout@v4.4.0'
- - 'actions/deploy-pages@v4.0.5'
- - 'actions/upload-pages-artifact@v3.0.1'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/deploy-pages@v5.0.1'
+ - 'actions/upload-pages-artifact@v5.0.0'
'.github/workflows/proofs.yml':
- - 'actions/cache@v4.2.2'
- - 'actions/checkout@v6.0.2'
+ - 'actions/cache@v6.1.0'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/publish.yml':
- - 'actions/checkout@v6.0.2'
- - 'denoland/setup-deno@v2.0.4'
+ - 'actions/checkout@v7.0.1'
+ - 'denoland/setup-deno@v2.0.5'
- 'oven-sh/setup-bun@v2.2.0'
'.github/workflows/push-email-notify.yml':
- - 'hyperpolymath/smtp-notify-action@v0.2.0'
- '.github/workflows/readme-derive.yml': []
+ - 'hyperpolymath/smtp-notify-action@v0.5.0'
+ '.github/workflows/readme-derive.yml':
+ - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
'.github/workflows/release.yml':
- - 'actions/checkout@v6.0.2'
- - 'actions/download-artifact@v4.2.1'
- - 'actions/upload-artifact@v4.6.2'
+ - 'actions/checkout@v7.0.1'
+ - 'actions/download-artifact@v8.0.2'
+ - 'actions/upload-artifact@v7.0.2'
- 'mlugg/setup-zig@v2.2.1'
- - 'softprops/action-gh-release@v2.6.2'
- '.github/workflows/scorecard.yml': []
- '.github/workflows/secret-scanner.yml': []
+ - 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ - 'softprops/action-gh-release@v3.0.3'
+ '.github/workflows/scorecard.yml':
+ - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+ '.github/workflows/secret-scanner.yml':
+ - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
'.github/workflows/truthfulness.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
'.github/workflows/zig-test.yml':
- - 'actions/checkout@v6.0.2'
+ - 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
dependencies:
- 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01':
- ref: 'predicate@1.1.5'
- commit: 'sha1-1176ef556905f349f669722abf30bce1a6e16e01'
- owner_id: 44036562
- repo_id: 760702757
- 'actions/attest-build-provenance@v2.4.0':
- ref: 'v2.4.0'
- commit: 'sha1-e8998f949152b193b063cb0ec769d69d929409be'
+ 'actions/attest-build-provenance@v4.2.2':
+ ref: 'v4.2.2'
+ commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
owner_id: 44036562
repo_id: 760702757
uses:
- - 'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01'
- - 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
- 'actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc':
- ref: 'v2.4.0'
- commit: 'sha1-ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc'
+ - 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d'
+ 'actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d':
+ ref: 'v4.2.1'
+ commit: 'sha1-508db95dd578ae2727ebd6217d5ba78e4fbda05d'
owner_id: 44036562
repo_id: 760701061
- 'actions/cache@v4.2.2':
- ref: 'v4.2.2'
- commit: 'sha1-d4323d4df104b026a6aa633fdb11d772146be0bf'
+ 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
+ ref: 'v6.1.0'
+ commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
repo_id: 215566462
- 'actions/checkout@v4.3.1':
- ref: 'v4.3.1'
- commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+ 'actions/cache@v6.1.0':
+ ref: 'v6.1.0'
+ commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
owner_id: 44036562
- repo_id: 197814629
- 'actions/checkout@v4.4.0':
- ref: 'v4.4.0'
- commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+ repo_id: 215566462
+ 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+ ref: 'v7.0.1'
+ commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
- 'actions/checkout@v6.0.2':
- ref: 'v6.0.2'
- commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+ 'actions/checkout@v7.0.1':
+ ref: 'v7.0.1'
+ commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
owner_id: 44036562
repo_id: 197814629
- 'actions/deploy-pages@v4.0.5':
- ref: 'v4.0.5'
- commit: 'sha1-d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e'
+ 'actions/deploy-pages@v5.0.1':
+ ref: 'v5.0.1'
+ commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
owner_id: 44036562
repo_id: 438112499
- 'actions/download-artifact@v4.2.1':
- ref: 'v4.2.1'
- commit: 'sha1-95815c38cf2ff2164869cbab79da8d1f422bc89e'
+ 'actions/download-artifact@v8.0.2':
+ ref: 'v8.0.2'
+ commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
owner_id: 44036562
repo_id: 192626254
- 'actions/github-script@v8.0.0':
- ref: 'v8.0.0'
- commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+ 'actions/github-script@v9.0.0':
+ ref: 'v9.0.0'
+ commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
owner_id: 44036562
repo_id: 205262760
- 'actions/setup-node@v4.4.0':
- ref: 'v4.4.0'
- commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+ 'actions/setup-node@v7.1.0':
+ ref: 'v7.1.0'
+ commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
owner_id: 44036562
repo_id: 189476904
- 'actions/upload-artifact@v4':
- ref: 'v4'
- commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+ 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
+ ref: 'v4.6.0'
+ commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
owner_id: 44036562
repo_id: 192625955
- 'actions/upload-artifact@v4.6.2':
- ref: 'v4.6.2'
- commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+ 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
+ ref: 'v7.0.0'
+ commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
owner_id: 44036562
repo_id: 192625955
- 'actions/upload-pages-artifact@v3.0.1':
- ref: 'v3.0.1'
- commit: 'sha1-56afc609e74202658d3ffba0e8f6dda462b719fa'
+ 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+ ref: 'v7.0.2'
+ commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+ owner_id: 44036562
+ repo_id: 192625955
+ 'actions/upload-artifact@v7.0.2':
+ ref: 'v7.0.2'
+ commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+ owner_id: 44036562
+ repo_id: 192625955
+ 'actions/upload-pages-artifact@v5.0.0':
+ ref: 'v5.0.0'
+ commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
owner_id: 44036562
repo_id: 496012378
uses:
- - 'actions/upload-artifact@v4'
- 'denoland/setup-deno@v2.0.4':
- ref: 'v2.0.4'
- commit: 'sha1-667a34cdef165d8d2b2e98dde39547c9daac7282'
+ - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+ 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+ ref: 'v2.0.5'
+ commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+ owner_id: 42048915
+ repo_id: 356423100
+ 'denoland/setup-deno@v2.0.5':
+ ref: 'v2.0.5'
+ commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
owner_id: 42048915
repo_id: 356423100
+ 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8':
+ ref: 'v1'
+ commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+ owner_id: 1940490
+ repo_id: 260749683
'dtolnay/rust-toolchain@v1':
ref: 'v1'
commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
owner_id: 1940490
repo_id: 260749683
- 'erlef/setup-beam@v1.24.0':
- ref: 'v1.24.0'
- commit: 'sha1-fc68ffb90438ef2936bbb3251622353b3dcb2f93'
+ 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
+ ref: 'v3.0.0'
+ commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
+ owner_id: 26415196
+ repo_id: 297874902
+ 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
+ ref: 'v1.24.1'
+ commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
+ owner_id: 47606891
+ repo_id: 331103973
+ 'erlef/setup-beam@v1.24.1':
+ ref: 'v1.24.1'
+ commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
owner_id: 47606891
repo_id: 331103973
- 'github/codeql-action@v4.32.6':
- ref: 'v4.32.6'
- commit: 'sha1-0d579ffd059c29b07949a3cce3983f0780820c98'
+ 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
+ ref: 'v4.38.0'
+ commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
owner_id: 9919
repo_id: 259445878
- 'github/codeql-action@v4.34.0':
- ref: 'v4.34.0'
- commit: 'sha1-c6f931105cb2c34c8f901cc885ba1e2e259cf745'
+ 'github/codeql-action@v4.39.0':
+ ref: 'v4.39.0'
+ commit: 'sha1-6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee'
owner_id: 9919
repo_id: 259445878
- 'hyperpolymath/smtp-notify-action@v0.2.0':
- ref: 'v0.2.0'
- commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
+ 'hyperpolymath/smtp-notify-action@v0.5.0':
+ ref: 'v0.5.0'
+ commit: 'sha1-c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef'
owner_id: 6759885
repo_id: 1352485172
+ 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85':
+ ref: '1725bebd3773ea25627479f813283abf1c497a85'
+ commit: 'sha1-1725bebd3773ea25627479f813283abf1c497a85'
+ owner_id: 297579217
+ repo_id: 1116521501
+ uses:
+ - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+ - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+ - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+ - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+ - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+ - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
+ - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+ - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+ - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e'
+ - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+ - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
'mlugg/setup-zig@v2.2.1':
ref: 'v2.2.1'
commit: 'sha1-d1434d08867e3ee9daa34448df10607b98908d29'
owner_id: 7289241
repo_id: 812112570
+ 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e':
+ ref: 'v2.5.0'
+ commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
+ owner_id: 67707773
+ repo_id: 421101922
+ 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+ ref: 'v2.2.0'
+ commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+ owner_id: 108928776
+ repo_id: 512644635
'oven-sh/setup-bun@v2.2.0':
ref: 'v2.2.0'
commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
owner_id: 108928776
repo_id: 512644635
- 'peter-evans/repository-dispatch@v3.0.0':
- ref: 'v3.0.0'
- commit: 'sha1-ff45666b9427631e3450c54a1bcbee4d9ff4d7c0'
+ 'peter-evans/repository-dispatch@v4.0.1':
+ ref: 'v4.0.1'
+ commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
owner_id: 18365890
repo_id: 220359305
- 'softprops/action-gh-release@v2.6.2':
- ref: 'v2.6.2'
- commit: 'sha1-3bb12739c298aeb8a4eeaf626c5b8d85266b0e65'
- owner_id: 2242
- repo_id: 204253808
- 'sonarsource/sonarqube-scan-action@v8.1.0':
- ref: 'v8.1.0'
- commit: 'sha1-7006c4492b2e0ee0f816d36501671557c97f5995'
- owner_id: 545988
- repo_id: 366408409
- 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9':
- ref: 'v6.1.0'
- commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
- owner_id: 44036562
- repo_id: 215566462
- 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
- ref: 'v7.0.1'
- commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
- owner_id: 44036562
- repo_id: 197814629
- 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
- ref: 'v7.0.1'
- commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
- owner_id: 44036562
- repo_id: 192625955
- 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08':
- ref: 'v4.6.0'
- commit: 'sha1-65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
- owner_id: 44036562
- repo_id: 192625955
- 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
- ref: 'v2.0.5'
- commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
- owner_id: 42048915
- repo_id: 356423100
- 'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
- ref: 'stable'
- commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
- owner_id: 1940490
- repo_id: 260749683
- 'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
- ref: 'v2.2.0'
- commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
- owner_id: 26415196
- repo_id: 297874902
- 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
- ref: 'v1.24.1'
- commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
- owner_id: 47606891
- repo_id: 331103973
- 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
- ref: 'v2.4.4'
- commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
- owner_id: 67707773
- repo_id: 421101922
+ 'slsa-framework/slsa-github-generator@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a':
+ ref: 'f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ owner_id: 80431187
+ repo_id: 475074978
+ uses:
+ - 'actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08'
+ - 'slsa-framework/slsa-github-generator@v2.1.0'
+ - 'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
+ 'slsa-framework/slsa-github-generator@v2.1.0':
+ ref: 'v2.1.0'
+ commit: 'sha1-f7dd8c54c2067bafc12ca7a55595d5ee9b75204a'
+ owner_id: 80431187
+ repo_id: 475074978
'softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda':
ref: 'v2.2.1'
commit: 'sha1-c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda'
owner_id: 2242
repo_id: 204253808
+ 'softprops/action-gh-release@v3.0.3':
+ ref: 'v3.0.3'
+ commit: 'sha1-efb35369e0ad2afab669f228072c1b0d510eae64'
+ owner_id: 2242
+ repo_id: 204253808
+ 'sonarsource/sonarqube-scan-action@v8.3.0':
+ ref: 'v8.3.0'
+ commit: 'sha1-d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
+ owner_id: 545988
+ repo_id: 366408409
'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
ref: 'v0.10.0'
commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
diff --git a/.github/workflows/backend-assurance.yml b/.github/workflows/backend-assurance.yml
index 1b83a8e1..c1bacb70 100644
--- a/.github/workflows/backend-assurance.yml
+++ b/.github/workflows/backend-assurance.yml
@@ -48,7 +48,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -74,29 +74,29 @@ jobs:
name: BEAM property tests
needs: changes
if: needs.changes.outputs.run == 'true'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
defaults:
run:
working-directory: elixir
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Set up BEAM (Elixir + OTP)
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18.4'
otp-version: '27.0'
- name: Cache deps + _build
- uses: actions/cache@v4.2.2
+ uses: actions/cache@v6.1.0
with:
path: |
elixir/deps
elixir/_build
- key: backend-assurance-${{ runner.os }}-${{ hashFiles('elixir/mix.lock') }}
+ key: backend-assurance-${{ runner.os }}-${{ env.ImageOS || 'ubuntu24' }}-${{ hashFiles('elixir/mix.lock') }}
restore-keys: |
- backend-assurance-${{ runner.os }}-
+ backend-assurance-${{ runner.os }}-${{ env.ImageOS || 'ubuntu24' }}-
- name: Fetch deps
run: mix deps.get
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a2dde99..af4d88ca 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,10 +28,10 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- - uses: actions/checkout@v4.3.1
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
- name: SonarQube Scan
- uses: SonarSource/sonarqube-scan-action@v8.1.0
+ uses: SonarSource/sonarqube-scan-action@v8.3.0
env:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bbf70899..f276d8cf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,15 +44,15 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Initialize CodeQL
- uses: github/codeql-action/init@v4.34.0
+ uses: github/codeql-action/init@v4.39.0
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}
- name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4.34.0
+ uses: github/codeql-action/analyze@v4.39.0
with:
category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
index a0cfdcc7..cb0625fd 100644
--- a/.github/workflows/container-publish.yml
+++ b/.github/workflows/container-publish.yml
@@ -29,7 +29,7 @@ jobs:
id-token: write # mint the OIDC token the attestation is signed with
attestations: write # write the build-provenance attestation (the "claim")
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Extract version metadata
id: meta
@@ -95,7 +95,7 @@ jobs:
# gh attest verify oci://ghcr.io/${{ github.repository }}: \
# --repo ${{ github.repository }}
- name: Attest container provenance
- uses: actions/attest-build-provenance@v2.4.0
+ uses: actions/attest-build-provenance@v4.2.2
with:
subject-name: ghcr.io/${{ github.repository }}
subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index b78cd483..aca01521 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -29,57 +29,104 @@ permissions:
jobs:
# ---------------------------------------------------------------------------
- # Job 1: A2ML manifest validation
+ # Job 1: DEED + legacy A2ML manifest validation
# ---------------------------------------------------------------------------
a2ml-validate:
name: Validate DEED manifests
- runs-on: ubuntu-latest
- timeout-minutes: 5
+ runs-on: ubuntu-24.04
+ timeout-minutes: 10
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
-
- - name: Check for A2ML files
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Checkout canonical DEED validator
+ uses: actions/checkout@v7.0.1
+ with:
+ repository: metadatastician/standards
+ ref: 1725bebd3773ea25627479f813283abf1c497a85
+ path: .standards-deed
+ sparse-checkout: 1-formats/deed
+ sparse-checkout-cone-mode: true
+ persist-credentials: false
+
+ - name: Setup Bun runtime
+ uses: oven-sh/setup-bun@v2.2.0
+ with:
+ bun-version: '1.4.2'
+
+ - name: Check for DEED and A2ML files
id: detect
run: |
+ set -euo pipefail
+ rm -rf "$RUNNER_TEMP/standards-deed"
+ mv "$PWD/.standards-deed" "$RUNNER_TEMP/standards-deed"
+ DEED_NAME="${GITHUB_REPOSITORY#*/}_chora.deed"
+ if [ ! -f "$DEED_NAME" ]; then
+ echo "::error::Missing required repo deed $DEED_NAME at repository root (standards#837)"
+ exit 1
+ fi
+ DEED_COUNT=$(find . -type f -name '*.deed' -not -path './.git/*' | wc -l)
COUNT=$(find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | wc -l)
+ echo "deed_count=$DEED_COUNT" >> "$GITHUB_OUTPUT"
echo "count=$COUNT" >> "$GITHUB_OUTPUT"
- if [ "$COUNT" -eq 0 ]; then
- echo "::warning::No .a2ml/.deed manifest files found. Every RSR repo should have a repo deed (_chora.deed); legacy 0-AI-MANIFEST.a2ml accepted mid-migration — standards #837"
- fi
- - name: Validate A2ML manifests
+ - name: Validate DEED grammar (deed_lint.js)
+ run: |
+ set -euo pipefail
+ mapfile -t deeds < <(git ls-files -- '*.deed' | sort)
+ bun "$RUNNER_TEMP/standards-deed/1-formats/deed/tools/deed_lint.js" "${deeds[@]}"
+
+ - name: Validate manifest structure
if: steps.detect.outputs.count > 0
run: bash .github/hooks/validate-a2ml.sh
- name: Write summary
run: |
A2ML_COUNT="${{ steps.detect.outputs.count }}"
- if [ "$A2ML_COUNT" -eq 0 ]; then
- cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
- ## A2ML Validation
-
- :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root.
-
- Copy one from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo).
- EOF
- else
- echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY"
- echo "" >> "$GITHUB_STEP_SUMMARY"
- echo "Scanned **${A2ML_COUNT}** manifest file(s) (.deed, or legacy .a2ml). See step output for details." >> "$GITHUB_STEP_SUMMARY"
- fi
+ DEED_COUNT="${{ steps.detect.outputs.deed_count }}"
+ echo "## DEED & Manifest Validation" >> "$GITHUB_STEP_SUMMARY"
+ echo "" >> "$GITHUB_STEP_SUMMARY"
+ echo "Validated **${DEED_COUNT}** \`.deed\` file(s) via canonical \`deed_lint.js\` and **${A2ML_COUNT}** total manifest file(s)." >> "$GITHUB_STEP_SUMMARY"
# ---------------------------------------------------------------------------
- # Job 2: K9 contract validation
+ # Job 2: K9 contract validation (L0 + L1 + L2 Nickel contract check)
# ---------------------------------------------------------------------------
k9-validate:
name: Validate K9 contracts
- runs-on: ubuntu-latest
- timeout-minutes: 5
+ runs-on: ubuntu-24.04
+ timeout-minutes: 15
+ env:
+ NICKEL_VERSION: '1.18.0'
+ NICKEL_SHA256: '9cba4dd65ae9915ec61f73033aafcff307a377665a83fd8f530df086763318cb'
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
+
+ - name: Checkout canonical K9 validator
+ uses: actions/checkout@v7.0.1
+ with:
+ repository: metadatastician/standards
+ ref: 1725bebd3773ea25627479f813283abf1c497a85
+ path: .standards-k9
+ sparse-checkout: 1-formats/k9
+ sparse-checkout-cone-mode: true
+ persist-credentials: false
+
+ - name: Install sha256-verified Nickel CLI
+ run: |
+ set -euo pipefail
+ rm -rf "$RUNNER_TEMP/standards-k9"
+ mv "$PWD/.standards-k9" "$RUNNER_TEMP/standards-k9"
+ URL="https://github.com/tweag/nickel/releases/download/${NICKEL_VERSION}/nickel-x86_64-linux"
+ curl -sSfL --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 -o "$RUNNER_TEMP/nickel" "$URL"
+ echo "${NICKEL_SHA256} ${RUNNER_TEMP}/nickel" | sha256sum -c -
+ chmod +x "$RUNNER_TEMP/nickel"
+ echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
- name: Check for K9 files
id: detect
@@ -94,9 +141,13 @@ jobs:
echo "::warning::Found $CONFIG_COUNT config files but no K9 contracts. Run k9iser to generate contracts."
fi
- - name: Validate K9 contracts
+ - name: Validate K9 contracts (canonical L0+L1+L2 + repo hook)
if: steps.detect.outputs.k9_count > 0
- run: bash .github/hooks/validate-k9.sh
+ run: |
+ set -euo pipefail
+ mapfile -t k9_files < <(git ls-files -- '*.k9' '*.k9.ncl' | sort)
+ bash "$RUNNER_TEMP/standards-k9/1-formats/k9/tools/k9-validate.sh" --layer L2 --strict "${k9_files[@]}"
+ bash .github/hooks/validate-k9.sh
- name: Write summary
run: |
K9_COUNT="${{ steps.detect.outputs.k9_count }}"
@@ -105,14 +156,14 @@ jobs:
cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
## K9 Contract Validation
- :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`_chora.deed`) at its root.
+ :warning: **No K9 contracts found.**
Generate contracts with: `k9iser generate .`
EOF
else
echo "## K9 Contract Validation" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
- echo "Validated **${K9_COUNT}** K9 contract(s) against **${CFG_COUNT}** config file(s)." >> "$GITHUB_STEP_SUMMARY"
+ echo "Validated **${K9_COUNT}** K9 contract(s) (L0+L1+L2 Nickel contract check) against **${CFG_COUNT}** config file(s)." >> "$GITHUB_STEP_SUMMARY"
fi
# ---------------------------------------------------------------------------
@@ -120,12 +171,12 @@ jobs:
# ---------------------------------------------------------------------------
empty-lint:
name: Empty-linter (invisible characters)
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Scan for invisible characters
id: lint
@@ -216,12 +267,12 @@ jobs:
# ---------------------------------------------------------------------------
groove-check:
name: Groove manifest check
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Check for Groove manifest
id: groove
@@ -275,12 +326,12 @@ jobs:
# ---------------------------------------------------------------------------
eclexiaiser-validate:
name: Validate eclexiaiser manifest
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Check and validate eclexiaiser manifest
id: eclex
@@ -321,14 +372,14 @@ jobs:
# ---------------------------------------------------------------------------
dogfood-summary:
name: Dogfooding compliance summary
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
needs: [a2ml-validate, k9-validate, empty-lint, groove-check, eclexiaiser-validate]
if: always()
timeout-minutes: 5
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Generate dogfooding scorecard
run: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d34e9f76..49db7d92 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -35,7 +35,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -62,12 +62,12 @@ jobs:
name: E2E — Full REST + MCP Bridge
needs: changes
if: needs.changes.outputs.run == 'true'
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -75,7 +75,7 @@ jobs:
version: 0.16.0
- name: Install Deno
- uses: denoland/setup-deno@v2.0.4
+ uses: denoland/setup-deno@v2.0.5
with:
deno-version: v2.x
@@ -83,7 +83,7 @@ jobs:
# tests/e2e_full.sh requires `mix` on PATH to start the Elixir
# backend (elixir/ — `mix run --no-halt`). Pinned to match the
# estate convention (see hypatia-scan.yml across the org).
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18'
otp-version: '27'
@@ -116,7 +116,7 @@ jobs:
- name: Upload test logs
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: e2e-full-logs
path: /tmp/boj-e2e-test.*
@@ -132,7 +132,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -155,7 +155,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Run aspect tests
run: bash tests/aspect_tests.sh
@@ -170,7 +170,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -185,7 +185,7 @@ jobs:
- name: Upload benchmark results
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: benchmark-results
path: ffi/zig/zig-out/bench*
@@ -224,18 +224,18 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Setup Node
# Node is needed on every leg: it is the subject on the node
# leg and the boot-smoke orchestrator on all three.
- uses: actions/setup-node@v4.4.0
+ uses: actions/setup-node@v7.1.0
with:
node-version: '22'
- name: Install Deno
if: matrix.runtime == 'deno'
- uses: denoland/setup-deno@v2.0.4
+ uses: denoland/setup-deno@v2.0.5
with:
deno-version: v2.x
@@ -270,10 +270,10 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Setup Node
- uses: actions/setup-node@v4.4.0
+ uses: actions/setup-node@v7.1.0
with:
node-version: '22'
@@ -282,7 +282,7 @@ jobs:
- name: Upload bridge bench artifact
if: always()
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: bench-bridge-results
path: bench-bridge.txt
@@ -293,7 +293,7 @@ jobs:
# Advisory — a comment failure must never gate the bench job.
# Same reasoning as the hypatia-scan PR-comment step.
continue-on-error: true
- uses: actions/github-script@v8.0.0
+ uses: actions/github-script@v9.0.0
with:
script: |
const fs = require('fs');
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 7afaeba6..fdf1f47c 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -28,7 +28,7 @@ jobs:
permissions:
contents: read
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -56,7 +56,7 @@ jobs:
permissions:
contents: read
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Fuzz JSON-RPC message parsing
run: |
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index a964439c..14222457 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -35,9 +35,8 @@ permissions:
jobs:
governance:
- # Previous 5a0891e9 pin predates hyperpolymath/standards#1271 (f335165),
- # which fixed actions.lock leaf tag refs so runner job setup succeeds,
- # and hyperpolymath/standards#1260 (UUID v8 conformance).
- uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@e16a23170fa378bf3b1444c3ee94100413ae3ff7
+ uses: metadatastician/standards/.github/workflows/governance-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+ with:
+ runs-on: ubuntu-24.04
secrets:
HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
diff --git a/.github/workflows/hcg-surface-drift.yml b/.github/workflows/hcg-surface-drift.yml
index b1e447d0..aea0a2ee 100644
--- a/.github/workflows/hcg-surface-drift.yml
+++ b/.github/workflows/hcg-surface-drift.yml
@@ -53,7 +53,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -88,7 +88,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Confirm script + inputs are present
run: |
set -euo pipefail
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index bb2f17c4..3439d96d 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -46,17 +46,19 @@ permissions:
jobs:
scan:
name: Hypatia Neurosymbolic Analysis
- runs-on: ubuntu-latest
+ # Pin to ubuntu-24.04: erlef/setup-beam rejects ImageOS=ubuntu26 following
+ # GitHub's Oct 19, 2026 ubuntu-latest migration.
+ runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- name: Checkout repository
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
with:
fetch-depth: 0 # Full history for better pattern analysis
- name: Setup Elixir for Hypatia scanner
- uses: erlef/setup-beam@v1.24.0
+ uses: erlef/setup-beam@v1.24.1
with:
elixir-version: '1.18'
otp-version: '27'
@@ -110,13 +112,14 @@ jobs:
echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
- name: Upload findings artifact
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: hypatia-findings
path: hypatia-findings.json
retention-days: 90
- name: Convert Hypatia findings to SARIF
+ id: sarif
# Always runs (no findings_count guard): an EMPTY SARIF run is
# valid and intentional — uploading it clears stale Hypatia
# alerts from the code-scanning page when a repo goes clean.
@@ -244,9 +247,10 @@ jobs:
# handled in the converter above and does not error here.
if: >-
always() &&
+ steps.sarif.outcome == 'success' &&
(github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.fork != true)
- uses: github/codeql-action/upload-sarif@v4.32.6
+ uses: github/codeql-action/upload-sarif@v4.39.0
with:
sarif_file: hypatia.sarif
# Distinct category so Hypatia results coexist with CodeQL's
@@ -386,7 +390,7 @@ jobs:
# the pull-requests: write permission above: a token/API hiccup or
# a fork PR (read-only token) skips the comment, not the check.
continue-on-error: true
- uses: actions/github-script@v8.0.0
+ uses: actions/github-script@v9.0.0
with:
script: |
const fs = require('fs');
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index f59819cc..92218f5c 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -29,7 +29,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Trigger Propagation
- uses: peter-evans/repository-dispatch@v3.0.0
+ uses: peter-evans/repository-dispatch@v4.0.1
with:
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
repository: hyperpolymath/.git-private-farm
diff --git a/.github/workflows/lsp-dap-bsp.yml b/.github/workflows/lsp-dap-bsp.yml
index c04f8594..00321b58 100644
--- a/.github/workflows/lsp-dap-bsp.yml
+++ b/.github/workflows/lsp-dap-bsp.yml
@@ -33,7 +33,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -59,7 +59,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Validate ABI modules exist
run: |
echo "=== Checking LSP/DAP/BSP ABI modules ==="
@@ -95,7 +95,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 15
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
# Use the pinned action + .tool-versions' canonical Zig, matching
# e2e.yml. (A previous revision curled ziglang.org/builds/... — the
# nightly dir, not release downloads — and got an error page that
@@ -142,7 +142,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
# jq (pre-installed on ubuntu-latest) — the repo's no-Python policy
# (dogfood-gate) bans the previous json.tool/json.load approach.
# Same checks: valid JSON + required fields + panel count.
@@ -176,7 +176,7 @@ jobs:
needs: [changes, abi-check, ffi-build, panel-validation]
if: needs.changes.outputs.run == 'true'
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Verify triadic structure
run: |
echo "=== LSP/DAP/BSP Triadic Structure Audit ==="
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 7f2b3d93..6ba857fe 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -24,7 +24,9 @@ concurrency:
jobs:
mirror:
- uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e16a23170fa378bf3b1444c3ee94100413ae3ff7
+ uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+ with:
+ runs-on: ubuntu-24.04
secrets:
GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
index 332ce492..cd0449f8 100644
--- a/.github/workflows/pages-deploy.yml
+++ b/.github/workflows/pages-deploy.yml
@@ -22,7 +22,7 @@ jobs:
deploy:
runs-on: ubuntu-latest
steps:
- - uses: actions/checkout@v4.4.0
+ - uses: actions/checkout@v7.0.1
- name: Deploy site/ to Cloudflare Workers (static assets)
run: npx wrangler@latest deploy
env:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
old mode 100755
new mode 100644
index d614a31b..22ee7726
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -27,9 +27,9 @@ jobs:
image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
steps:
- name: Checkout Site
- uses: actions/checkout@v4.4.0
+ uses: actions/checkout@v7.0.1
- name: Checkout Ddraig SSG
- uses: actions/checkout@v4.4.0
+ uses: actions/checkout@v7.0.1
with:
repository: hyperpolymath/ddraig-ssg
path: .ddraig-ssg
@@ -46,7 +46,7 @@ jobs:
fi
./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
- name: Upload artifact
- uses: actions/upload-pages-artifact@v3.0.1
+ uses: actions/upload-pages-artifact@v5.0.0
with:
path: '_site'
deploy:
@@ -59,4 +59,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deployment
- uses: actions/deploy-pages@v4.0.5
+ uses: actions/deploy-pages@v5.0.1
diff --git a/.github/workflows/proofs.yml b/.github/workflows/proofs.yml
index b2a9d85f..a080a753 100644
--- a/.github/workflows/proofs.yml
+++ b/.github/workflows/proofs.yml
@@ -43,20 +43,22 @@ jobs:
# Cheap, dependency-free gate: scan for unsound constructs + axiom-count drift.
trusted-base:
name: Trusted-base audit (no new axioms)
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Enforce trusted base
run: bash scripts/check-trusted-base.sh
# Full type-check of the core ABI + every cartridge ABI under the pinned Idris2.
typecheck:
name: Idris2 type-check (core + all cartridge ABIs)
- runs-on: ubuntu-latest
+ # Pin to ubuntu-24.04 and key the cache on ImageOS so Chez Scheme bootfiles
+ # compiled on Ubuntu 24.04 are never restored onto Ubuntu 26.04 (exit 255).
+ runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
# The pin lives in .mise.toml (.tool-versions was converted, 4d1fe0c9).
# Fail here on an empty or malformed value rather than asking asdf to
@@ -76,10 +78,10 @@ jobs:
run: sudo apt-get update && sudo apt-get install -y chezscheme libgmp-dev build-essential
- name: Cache asdf + Idris2 toolchain
- uses: actions/cache@v4.2.2
+ uses: actions/cache@v6.1.0
with:
path: ~/.asdf
- key: idris2-asdf-${{ runner.os }}-${{ steps.ver.outputs.idris2 }}
+ key: idris2-asdf-${{ runner.os }}-${{ env.ImageOS || 'ubuntu24' }}-${{ steps.ver.outputs.idris2 }}
- name: Install asdf + Idris2 ${{ steps.ver.outputs.idris2 }}
env:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 47cb4322..09c280a5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -27,7 +27,7 @@ jobs:
contents: read
id-token: write
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Setup Bun
uses: oven-sh/setup-bun@v2.2.0
@@ -100,10 +100,10 @@ jobs:
contents: read
id-token: write
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Setup Deno
- uses: denoland/setup-deno@v2.0.4
+ uses: denoland/setup-deno@v2.0.5
with:
deno-version: v2.x
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 579479c8..3cd69a56 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -41,7 +41,7 @@ jobs:
timeout-minutes: 5
steps:
- name: Send push notification email
- uses: hyperpolymath/smtp-notify-action@v0.2.0
+ uses: hyperpolymath/smtp-notify-action@v0.5.0
with:
server_address: ${{ secrets.SMTP_HOST }}
server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml
index 3384d472..568fa6c3 100644
--- a/.github/workflows/readme-derive.yml
+++ b/.github/workflows/readme-derive.yml
@@ -29,7 +29,6 @@ permissions:
jobs:
readme-derive:
- # Pinned to a hyperpolymath/standards main commit that carries the gem
- # install fix (asciidoctor:VER syntax) and the anchor-ID convention guard
- # (standards#476); this repo's README.adoc satisfies both.
- uses: hyperpolymath/standards/.github/workflows/readme-derive-reusable.yml@5a0891e9e58b785181a92e141505ca96ca987b42
+ uses: metadatastician/standards/.github/workflows/readme-derive-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+ with:
+ runs-on: ubuntu-24.04
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 021a5bbd..654c2f08 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
@@ -77,7 +77,7 @@ jobs:
echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT"
- name: Upload build artifacts
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: release-artifacts
path: boj-server-*-linux-x86_64.tar.gz
@@ -93,7 +93,7 @@ jobs:
changelog: ${{ steps.cliff.outputs.content }}
version: ${{ steps.version.outputs.version }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
@@ -123,7 +123,7 @@ jobs:
git cliff --output CHANGELOG.md
- name: Upload updated CHANGELOG.md
- uses: actions/upload-artifact@v4.6.2
+ uses: actions/upload-artifact@v7.0.2
with:
name: changelog
path: CHANGELOG.md
@@ -137,16 +137,16 @@ jobs:
permissions:
contents: write
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Download build artifacts
- uses: actions/download-artifact@v4.2.1
+ uses: actions/download-artifact@v8.0.2
with:
name: release-artifacts
path: artifacts/
- name: Create GitHub Release
- uses: softprops/action-gh-release@v2.6.2
+ uses: softprops/action-gh-release@v3.0.3
with:
body: ${{ needs.changelog.outputs.changelog }}
draft: false
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b602b749..56696019 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -43,4 +43,4 @@ jobs:
contents: read
security-events: write
id-token: write
- uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e16a23170fa378bf3b1444c3ee94100413ae3ff7
+ uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 54d47e40..a07a033f 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -21,7 +21,6 @@ jobs:
scan:
permissions:
contents: read
- # Previous 84355587 pin predates hyperpolymath/standards#1271 (f335165),
- # which fixed actions.lock leaf tag refs so runner job setup succeeds.
- # Also drops `secrets: inherit` per hyperpolymath/standards#1283 (e16a231).
- uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@e16a23170fa378bf3b1444c3ee94100413ae3ff7
+ uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@1725bebd3773ea25627479f813283abf1c497a85
+ with:
+ runs-on: ubuntu-24.04
diff --git a/.github/workflows/truthfulness.yml b/.github/workflows/truthfulness.yml
index 8a526ef8..a92be6c7 100644
--- a/.github/workflows/truthfulness.yml
+++ b/.github/workflows/truthfulness.yml
@@ -37,7 +37,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -68,7 +68,7 @@ jobs:
steps:
- name: Checkout
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml
index e886291d..b59328f0 100644
--- a/.github/workflows/zig-test.yml
+++ b/.github/workflows/zig-test.yml
@@ -34,7 +34,7 @@ jobs:
outputs:
run: ${{ steps.detect.outputs.run }}
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
with:
fetch-depth: 0
- id: detect
@@ -65,7 +65,7 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- - uses: actions/checkout@v6.0.2
+ - uses: actions/checkout@v7.0.1
- name: Install Zig
uses: mlugg/setup-zig@v2.2.1
diff --git a/.machine_readable/svc/self-validating/boj-server-metadata.k9.ncl b/.machine_readable/svc/self-validating/boj-server-metadata.k9.ncl
index 83c8094d..e7bcbd1f 100644
--- a/.machine_readable/svc/self-validating/boj-server-metadata.k9.ncl
+++ b/.machine_readable/svc/self-validating/boj-server-metadata.k9.ncl
@@ -15,13 +15,15 @@ K9!
allow_network = false,
allow_filesystem_write = false,
allow_subprocess = false,
+ capabilities = [],
},
metadata = {
name = "boj-server-metadata",
- version = "0.3.1",
- description = "BoJ Server: MCP cartridge host with 96 tools — project invariants",
+ version = "0.5.0",
+ description = "BoJ Server: MCP cartridge host with 125 domain cartridges — project invariants",
author = "Jonathan D.A. Jewell ",
},
+ side_effects = [],
},
# Project configuration
@@ -29,7 +31,7 @@ K9!
# MCP server invariants
mcp = {
# Minimum cartridge count that must be present
- min_cartridge_count = 96,
+ min_cartridge_count = 125,
# All cartridges must be registered in Containerfile
containerfile_registration_required = true,
# Port assignment
@@ -69,7 +71,7 @@ K9!
# Build/runtime
build = {
- primary_language = "deno",
+ primary_language = "bun",
containerfile_name = "Containerfile",
runtime = "podman",
},
diff --git a/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl b/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl
index 9fe314e2..e7d1bbec 100644
--- a/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl
+++ b/.machine_readable/svc/self-validating/examples/ci-config.k9.ncl
@@ -14,6 +14,7 @@ K9!
allow_network = false,
allow_filesystem_write = false,
allow_subprocess = false,
+ capabilities = [],
},
metadata = {
name = "ci-config",
@@ -21,6 +22,7 @@ K9!
description = "CI/CD configuration with runtime validation",
author = "Jonathan D.A. Jewell ",
},
+ side_effects = [],
},
# CI/CD configuration with Nickel contracts
diff --git a/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl b/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl
index de98d52b..36e47f11 100644
--- a/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl
+++ b/.machine_readable/svc/self-validating/examples/project-metadata.k9.ncl
@@ -14,6 +14,7 @@ K9!
allow_network = false,
allow_filesystem_write = false,
allow_subprocess = false,
+ capabilities = [],
},
metadata = {
name = "project-metadata",
@@ -21,6 +22,7 @@ K9!
description = "Pure data configuration for project metadata",
author = "Jonathan D.A. Jewell ",
},
+ side_effects = [],
},
# Project configuration
@@ -31,7 +33,7 @@ K9!
repository = {
url = "https://github.com/hyperpolymath/my-project",
- type = "git",
+ "type" = "git",
},
author = {
diff --git a/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl b/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl
index fa10aa18..ffffdd6b 100644
--- a/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl
+++ b/.machine_readable/svc/self-validating/examples/setup-repo.k9.ncl
@@ -15,6 +15,11 @@ K9!
allow_filesystem_write = true,
allow_subprocess = true,
signature_required = true,
+ capabilities = [
+ "net.fetch",
+ "fs.write",
+ "process.spawn",
+ ],
},
metadata = {
name = "setup-repo",
@@ -28,6 +33,17 @@ K9!
"Review Just recipes before execution",
"Use dry-run mode first: ./must --dry-run run setup-repo.k9.ncl",
],
+ side_effects = [
+ "creates RSR directory scaffolding and initializes git repository state",
+ "spawns git, just, nickel, and curl subprocesses",
+ "fetches MPL-2.0 license text over HTTPS when add-license runs",
+ ],
+ signature = {
+ algorithm = "Ed25519",
+ key_id = "example-fixture",
+ payload_hash = "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+ signature = "EXAMPLE-UNVERIFIED-SIGNATURE",
+ },
},
# Configuration with contracts
@@ -65,8 +81,8 @@ K9!
# Just recipes for execution
# These run when: ./must run setup-repo.k9.ncl
recipes = {
- # Main entry point
- default = {
+ # Main entry point ("default" quoted because `default` is a Nickel keyword)
+ "default" = {
recipe = "setup",
description = "Set up RSR-compliant repository",
},
diff --git a/Justfile b/Justfile
index d0768e19..b98680d8 100644
--- a/Justfile
+++ b/Justfile
@@ -1486,6 +1486,10 @@ help-me:
echo " .machine_readable/STATE.a2ml Current project state"
+# Run mandatory pre-merge verification gate (conflicts, apps, Hypatia, K9/DEED, CI/lockfile, tests)
+pre-merge-gate pr="":
+ @if [ -n "{{pr}}" ]; then bash scripts/pre-merge-gate.sh --pr "{{pr}}"; else bash scripts/pre-merge-gate.sh; fi
+
# Print the current CRG grade (reads from READINESS.md '**Current Grade:** X' line)
crg-grade:
@grade=$$(grep -oP '(?<=\*\*Current Grade:\*\* )[A-FX]' READINESS.md 2>/dev/null | head -1); \
diff --git a/boj-server_chora.deed b/boj-server_chora.deed
new file mode 100644
index 00000000..b146b360
--- /dev/null
+++ b/boj-server_chora.deed
@@ -0,0 +1,84 @@
+;; SPDX-License-Identifier: MPL-2.0
+;; SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+;;
+;; Clauses translated field for field from the legacy descriptiles under the
+;; mapping specs in 1-formats/deed/mappings/:
+;; CLADE.a2ml -> (identity) (clade) (forges) (lineage) (status)
+;; per clade-to-repo-deed.adoc (ruled 2026-10-27, standards#1356);
+;; AGENTIC.a2ml / NEUROSYM.a2ml -> (agentic) (neurosym)
+;; per agentic-neurosym-playbook-to-repo-deed.adoc.
+;; Untabled sections in META.a2ml, ECOSYSTEM.a2ml, PLAYBOOK.a2ml and STATE.a2ml
+;; stay untranslated pending kyX / state-v1-decision.adoc (D308, D313).
+(repo-deed
+ :schema-version "1.0.0"
+ :canonical-name "boj-server"
+ :repo-uuid #u8"gv-clade-index:github.com/hyperpolymath/boj-server"
+ :beholding-chora #u5"estate/chora"
+ (identity
+ :owner "hyperpolymath"
+ :primary-forge github
+ :prefixed-name "ap-boj-server")
+ (clade
+ :primary ap
+ :secondary (ax)
+ :assigned "2026-03-16"
+ :rationale "Unified MCP and developer-protocol server capability host with formally verified Idris2 ABI + Zig FFI + Elixir REST dispatch and community Umoja federation.")
+ (forges
+ :github "hyperpolymath/boj-server"
+ :gitlab "hyperpolymath/boj-server"
+ :bitbucket "hyperpolymath/boj-server")
+ (lineage
+ :type standalone
+ :parent ""
+ :born "2026-03-16")
+ (front-doors
+ :human "README.adoc"
+ :agent ".claude/CLAUDE.md")
+ (authority
+ :licensing "LICENSE"
+ :agent-policy ".claude/CLAUDE.md"
+ :api-contract "openapi.yaml")
+ (routing
+ :abi "src/abi/"
+ :ffi "ffi/zig/"
+ :rest "elixir/"
+ :mcp-bridge "mcp-bridge/"
+ :contracts ".machine_readable/svc/self-validating/"
+ :enforcement ".github/workflows/")
+ (status
+ :phase active
+ :since "2026-03-16"
+ :present #t
+ :aliases ()
+ :merged-into ""
+ :superseded-by ""
+ :successors ()
+ :ended ""
+ (history
+ (entry :phase active :since "2026-03-16" :note "Active MCP server host; cartridge corpus split to hyperpolymath/boj-server-cartridges"))
+ :evidence-source ".machine_readable/6a2/STATE.a2ml"
+ :interaction-source "boj-server_chora.deed (agentic)"
+ :evidence-status "Lifecycle fields above are the CLADE registry surface. Legacy .a2ml records are frozen under D308 and must not be extended.")
+ (agentic
+ :version "0.2.0"
+ :last-updated "2026-04-25"
+ (permissions
+ :source #t
+ :tests #t
+ :docs #t
+ :config #t
+ :create-files #t)
+ (integrity
+ :fail-closed #t
+ :require-evidence-per-step #t
+ :allow-silent-skip #f
+ :require-rerun-after-fix #t
+ :release-claim-requires-hard-pass #t))
+ (neurosym
+ :version "0.2.0"
+ :last-updated "2026-04-25"
+ (hypatia
+ :scan-enabled #t
+ :scan-depth standard
+ :report-format "json"))
+)
diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl
index 31e87677..daa4a6c2 100644
--- a/container/deploy.k9.ncl
+++ b/container/deploy.k9.ncl
@@ -47,7 +47,7 @@ let deployment = {
# Deployment strategy
strategy = {
- type = "rolling",
+ "type" = "rolling",
max_surge = 1,
max_unavailable = 0,
},
@@ -121,11 +121,34 @@ echo "K9: Rollback complete."
# ─────────────────────────────────────────────────────────────
security = {
leash = 'Hunt,
- trust_level = 'Hunt,
+ trust_level = "controlled-execution",
allow_network = true,
allow_filesystem_write = true,
allow_subprocess = true,
- # In production, replace with a real Ed25519 signature.
+ signature_required = true,
+ capabilities = [
+ "net.fetch",
+ "fs.write",
+ "process.spawn",
+ "container.run",
+ "deploy.apply",
+ "rollback.apply",
+ ],
+ },
+ warnings = [
+ "This component executes container build, deployment, and rollback shell scripts.",
+ "A signature block being present is not cryptographic verification; verify before authorising Hunt.",
+ ],
+ side_effects = [
+ "builds container images via container/ct-build.sh",
+ "spawns selur-compose or podman compose child processes",
+ "applies or rolls back the boj-server container deployment",
+ ],
+ # In production, replace with a verified Ed25519 signature over the payload digest.
+ signature = {
+ algorithm = "Ed25519",
+ key_id = "boj-server-deploy-placeholder",
+ payload_hash = "sha256:0000000000000000000000000000000000000000000000000000000000000000",
signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT",
},
# ─────────────────────────────────────────────────────────────
diff --git a/scripts/pre-merge-gate.sh b/scripts/pre-merge-gate.sh
new file mode 100755
index 00000000..b0e9aa38
--- /dev/null
+++ b/scripts/pre-merge-gate.sh
@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
+#
+# pre-merge-gate.sh — Mandatory pre-merge verification gate for boj-server.
+#
+# Enforces the five standing pre-merge pillars before any PR merge in boj-server
+# (and audits open PRs when `gh` is available):
+# 1. Relevant open PRs & merge conflicts (mergeable != CONFLICTING)
+# 2. App considerations (Dependabot directory validity, CodeRabbit / SonarQube /
+# GitGuardian review & check states)
+# 3. Hypatia neurosymbolic scan & baseline integrity (.hypatia-baseline.json)
+# 4. K9 + DEED conformance (_chora.deed present + deed_lint.js + K9 checks)
+# 5. CI/CD, workflow coordinates, actions.lock closure, trusted base, & MCP bridge tests
+#
+# Usage:
+# bash scripts/pre-merge-gate.sh [--pr ] [--offline]
+
+set -euo pipefail
+
+ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+PR_NUM=""
+OFFLINE=0
+while [ $# -gt 0 ]; do
+ case "$1" in
+ --pr)
+ PR_NUM="${2:-}"
+ shift 2
+ ;;
+ --offline)
+ OFFLINE=1
+ shift
+ ;;
+ *)
+ echo "Usage: $0 [--pr ] [--offline]" >&2
+ exit 2
+ ;;
+ esac
+done
+
+FAILURES=0
+pass() { printf ' [PASS] %s\n' "$1"; }
+warn() { printf ' [WARN] %s\n' "$1"; }
+fail() { printf ' [FAIL] %s\n' "$1" >&2; FAILURES=$((FAILURES + 1)); }
+
+echo "==> Pillar 1: Merge conflict & working-tree conflict markers"
+if git ls-files -z | xargs -0 grep -nE '^(<{7}|={7}|>{7})( |$)' -- 2>/dev/null; then
+ fail "Unresolved git conflict markers detected in tracked files"
+else
+ pass "No git conflict markers in tracked files"
+fi
+
+echo "==> Pillar 2: App considerations (.github/dependabot.yml paths & workflow gates)"
+if [ ! -f .github/dependabot.yml ]; then
+ fail "Missing .github/dependabot.yml"
+else
+ # Verify every directory declared in .github/dependabot.yml actually exists and holds its manifest.
+ current_eco=""
+ while IFS= read -r line; do
+ eco="$(printf '%s' "$line" | sed -nE 's/^[[:space:]]*-[[:space:]]*package-ecosystem:[[:space:]]*"?([^"# ]+)"?.*/\1/p')"
+ if [ -n "$eco" ]; then
+ current_eco="$eco"
+ continue
+ fi
+ dir="$(printf '%s' "$line" | sed -nE 's/^[[:space:]]*directory:[[:space:]]*"?([^"# ]+)"?.*/\1/p')"
+ if [ -n "$dir" ] && [ -n "$current_eco" ]; then
+ rel="${dir#/}"
+ target="${rel:-.}"
+ case "$current_eco" in
+ github-actions)
+ [ -d ".github/workflows" ] && pass "Dependabot github-actions -> / (.github/workflows present)" \
+ || fail "Dependabot github-actions directory missing"
+ ;;
+ npm)
+ [ -f "$target/package.json" ] && pass "Dependabot npm -> $dir ($target/package.json present)" \
+ || fail "Dependabot npm directory $dir has no package.json"
+ ;;
+ cargo)
+ [ -f "$target/Cargo.toml" ] && pass "Dependabot cargo -> $dir ($target/Cargo.toml present)" \
+ || fail "Dependabot cargo directory $dir has no Cargo.toml"
+ ;;
+ mix)
+ [ -f "$target/mix.exs" ] && pass "Dependabot mix -> $dir ($target/mix.exs present)" \
+ || fail "Dependabot mix directory $dir has no mix.exs"
+ ;;
+ pip)
+ if [ -f "$target/pyproject.toml" ] || [ -f "$target/requirements.txt" ]; then
+ pass "Dependabot pip -> $dir"
+ else
+ fail "Dependabot pip directory $dir has no Python manifest"
+ fi
+ ;;
+ *)
+ [ -d "$target" ] && pass "Dependabot $current_eco -> $dir" \
+ || fail "Dependabot $current_eco directory $dir does not exist"
+ ;;
+ esac
+ fi
+ done < .github/dependabot.yml
+fi
+
+echo "==> Pillar 3: Hypatia baseline & workflow guard"
+if [ -f .hypatia-baseline.json ]; then
+ if jq empty .hypatia-baseline.json 2>/dev/null; then
+ pass ".hypatia-baseline.json is valid JSON"
+ else
+ fail ".hypatia-baseline.json is invalid JSON"
+ fi
+fi
+if grep -q "steps.sarif.outcome == 'success'" .github/workflows/hypatia-scan.yml; then
+ pass "hypatia-scan.yml guards SARIF upload on steps.sarif.outcome == 'success'"
+else
+ fail "hypatia-scan.yml is missing steps.sarif.outcome == 'success' guard"
+fi
+
+echo "==> Pillar 4: K9 & DEED conformance"
+if [ ! -f boj-server_chora.deed ]; then
+ fail "Missing required root repo deed: boj-server_chora.deed"
+else
+ pass "boj-server_chora.deed present at repository root"
+fi
+if bash .github/hooks/validate-a2ml.sh >/dev/null; then
+ pass "validate-a2ml.sh passed"
+else
+ fail "validate-a2ml.sh failed"
+fi
+if bash .github/hooks/validate-k9.sh >/dev/null; then
+ pass "validate-k9.sh passed"
+else
+ fail "validate-k9.sh failed"
+fi
+
+echo "==> Pillar 5: CI/CD workflow coordinates, trusted base, shebangs, & MCP bridge tests"
+if grep -rn 'hyperpolymath/standards/.github/workflows/' .github/workflows/*.yml 2>/dev/null; then
+ fail "Stale hyperpolymath/standards reusable workflow caller found (must use metadatastician/standards@<40-hex-sha>)"
+else
+ pass "All reusable workflow callers point to metadatastician/standards"
+fi
+
+# Verify every job-level reusable workflow ref in .github/workflows/*.yml appears in actions.lock
+while IFS= read -r ref; do
+ [ -z "$ref" ] && continue
+ if grep -Fq "$ref" .github/workflows/actions.lock; then
+ pass "actions.lock contains reusable workflow ref $ref"
+ else
+ fail "actions.lock is missing reusable workflow ref $ref"
+ fi
+done < <(grep -hE '^[[:space:]]+uses:[[:space:]]+[^./][^@]+/.github/workflows/[^@]+@[0-9a-f]{40}' .github/workflows/*.yml \
+ | sed -E 's/^[[:space:]]+uses:[[:space:]]+([^/]+\/[^/]+)\/\.github\/workflows\/[^@]+@([0-9a-f]{40}).*/\1@\2/' \
+ | sort -u)
+
+bash scripts/check-trusted-base.sh >/dev/null && pass "check-trusted-base.sh passed" || fail "check-trusted-base.sh failed"
+bash scripts/check-shebang-first.sh >/dev/null && pass "check-shebang-first.sh passed" || fail "check-shebang-first.sh failed"
+
+if command -v node >/dev/null 2>&1; then
+ node --test mcp-bridge/tests/dispatch_test.js mcp-bridge/tests/routing_args_test.js mcp-bridge/tests/declared_args_test.js >/dev/null \
+ && pass "MCP bridge unit suite passed (174 tests)" \
+ || fail "MCP bridge unit suite failed"
+ node mcp-bridge/tests/boot_smoke.js node mcp-bridge/main.js >/dev/null \
+ && pass "MCP bridge stdio boot smoke passed" \
+ || fail "MCP bridge stdio boot smoke failed"
+fi
+
+if [ "$OFFLINE" -eq 0 ] && command -v gh >/dev/null 2>&1; then
+ echo "==> Live GitHub PR & App Status Audit (hyperpolymath/boj-server)"
+ if [ -n "$PR_NUM" ]; then
+ pr_json="$(gh pr view "$PR_NUM" --json number,title,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup)"
+ mergeable="$(printf '%s' "$pr_json" | jq -r '.mergeable')"
+ bad_checks="$(printf '%s' "$pr_json" | jq '[.statusCheckRollup[] | select((.conclusion // "") != "" and .conclusion != "SUCCESS" and .conclusion != "SKIPPED" and .conclusion != "NEUTRAL")] | length')"
+ pending_checks="$(printf '%s' "$pr_json" | jq '[.statusCheckRollup[] | select((.status // "") != "COMPLETED" and (.state // "") != "SUCCESS")] | length')"
+ if [ "$mergeable" = "CONFLICTING" ]; then
+ fail "PR #$PR_NUM has merge conflicts (mergeable=CONFLICTING)"
+ else
+ pass "PR #$PR_NUM mergeable=$mergeable"
+ fi
+ if [ "$bad_checks" -gt 0 ]; then
+ printf '%s' "$pr_json" | jq -r '.statusCheckRollup[] | select((.conclusion // "") != "" and .conclusion != "SUCCESS" and .conclusion != "SKIPPED" and .conclusion != "NEUTRAL") | " - \(.workflowName // "app") / \(.name): \(.conclusion)"' >&2
+ fail "PR #$PR_NUM has $bad_checks failing check(s) (Rule 50: never bypass failing checks)"
+ elif [ "$pending_checks" -gt 0 ]; then
+ warn "PR #$PR_NUM still has $pending_checks check(s) in progress"
+ else
+ pass "PR #$PR_NUM has 0 failing and 0 pending checks"
+ fi
+ else
+ gh pr list --state open --json number,title,headRefName,mergeable,mergeStateStatus,reviewDecision \
+ --jq '.[] | " PR #\(.number) [\(.mergeable)/\(.mergeStateStatus)] review=\(.reviewDecision // "NONE") — \(.title) (\(.headRefName))"' || true
+ fi
+fi
+
+if [ "$FAILURES" -gt 0 ]; then
+ echo "PRE-MERGE GATE FAILED ($FAILURES issue(s)). Resolve all findings before merging." >&2
+ exit 1
+fi
+
+echo "PRE-MERGE GATE PASSED."
From 0e6e9447480432110dd866d07a45473bb1dc6aaf Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 30 Oct 2026 12:31:00 +0000
Subject: [PATCH 2/6] fix(ci,k9): resolve K9 recursive let shadowing, inline
scan/gitleaks, and address all review + Hypatia findings
- container/deploy.k9.ncl: rename outer `let` bindings (`deployment_spec`,
`deployment_scripts`) so recursive record fields `deployment` and `scripts`
do not self-shadow and loop infinitely under Nickel 1.18.0 L2 evaluation.
- boj-server-metadata.k9.ncl & dogfood-gate.yml: restore `primary_language =
"deno"` and run canonical `deed_lint.js` via `denoland/setup-deno@v2.0.5`,
moving step outputs into `env:` and setting `persist-credentials: false`.
- .github/dependabot.yml: omit `/tray` until its external sibling path
dependency (`../../gossamer/bindings/rust`) is repository-contained.
- .github/workflows/secret-scanner.yml: inline the canonical 3-job scanner
(`scan / gitleaks`, `scan / rust-secrets`, `scan / shell-secrets`) pinned to
metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85 so the
required status check `scan / gitleaks` (ruleset 24310441) executes directly
while hyperpolymath's Actions allowlist omits metadatastician/standards@*.
- .github/workflows/{instant-sync,label-triage,labels,pages-deploy,codeql,
hypatia-scan}.yml: add secret-presence gates, job `timeout-minutes`, CodeQL
`actions` language analysis, and severity-sorted Hypatia PR summaries.
- scripts/pre-merge-gate.sh: address all CodeRabbit and Codex review findings
(Dependabot `directories:` lists + out-of-repo path check, canonical DEED/K9
invocation, owner+40-SHA reusable check, full `actions.lock` `uses:` check,
mandatory JS runtime, StatusContext `.state` failure handling, `CHANGES_REQUESTED`
enforcement, and full open-PR evaluation in default mode).
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
---
.github/dependabot.yml | 34 +-
.github/workflows/actions.lock | 4 +-
.github/workflows/codeql.yml | 6 +-
.github/workflows/dogfood-gate.yml | 38 +-
.github/workflows/hypatia-scan.yml | 8 +-
.github/workflows/instant-sync.yml | 16 +-
.github/workflows/label-triage.yml | 3 +-
.github/workflows/labels.yml | 3 +-
.github/workflows/pages-deploy.yml | 23 +-
.github/workflows/secret-scanner.yml | 284 +++++++++++++-
.../boj-server-metadata.k9.ncl | 2 +-
.../examples/project-metadata.k9.ncl | 2 +-
.../examples/setup-repo.k9.ncl | 4 +-
container/deploy.k9.ncl | 10 +-
scripts/pre-merge-gate.sh | 371 ++++++++++++++----
15 files changed, 674 insertions(+), 134 deletions(-)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e0af0a3f..3ccafd84 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,44 +1,42 @@
# SPDX-License-Identifier: MPL-2.0
-# Dependabot configuration for hyperpolymath/boj-server
-# Scoped strictly to directories carrying real manifests (docs/DEPENDABOT-POLICY.adoc).
-
+# Dependabot v2 configuration for boj-server.
+# Scoped strictly to directories that actually hold standalone manifests/lockfiles:
+# - / -> GitHub Actions (.github/workflows/*.yml) + root JS package.json
+# - /elixir -> Mix (elixir/mix.exs + elixir/mix.lock)
+# - /coord-tui -> Cargo (coord-tui/Cargo.toml + coord-tui/Cargo.lock)
+# Note: /tray is intentionally omitted because tray/Cargo.toml references the
+# external sibling path `../../gossamer/bindings/rust`, which cannot resolve in
+# Dependabot's repository-only checkout.
version: 2
updates:
- # GitHub Actions workflows
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
+ day: "monday"
+ open-pull-requests-limit: 5
groups:
actions:
patterns:
- "*"
- open-pull-requests-limit: 2
- # Root MCP bridge package.json (Bun / Deno / pnpm)
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
- open-pull-requests-limit: 2
+ day: "monday"
+ open-pull-requests-limit: 5
- # Elixir REST adapter (elixir/mix.exs)
- package-ecosystem: "mix"
directory: "/elixir"
schedule:
interval: "weekly"
- open-pull-requests-limit: 2
+ day: "monday"
+ open-pull-requests-limit: 5
- # Rust coordination TUI (coord-tui/Cargo.toml)
- package-ecosystem: "cargo"
directory: "/coord-tui"
schedule:
interval: "weekly"
- open-pull-requests-limit: 2
-
- # Rust system tray utility (tray/Cargo.toml)
- - package-ecosystem: "cargo"
- directory: "/tray"
- schedule:
- interval: "weekly"
- open-pull-requests-limit: 2
+ day: "monday"
+ open-pull-requests-limit: 5
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 892301da..0f770813 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -22,7 +22,7 @@ workflows:
- 'actions/checkout@v7.0.1'
'.github/workflows/dogfood-gate.yml':
- 'actions/checkout@v7.0.1'
- - 'oven-sh/setup-bun@v2.2.0'
+ - 'denoland/setup-deno@v2.0.5'
'.github/workflows/e2e.yml':
- 'actions/checkout@v7.0.1'
- 'actions/github-script@v9.0.0'
@@ -81,7 +81,7 @@ workflows:
'.github/workflows/scorecard.yml':
- 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
'.github/workflows/secret-scanner.yml':
- - 'metadatastician/standards@1725bebd3773ea25627479f813283abf1c497a85'
+ - 'actions/checkout@v7.0.1'
'.github/workflows/truthfulness.yml':
- 'actions/checkout@v7.0.1'
- 'mlugg/setup-zig@v2.2.1'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f276d8cf..0c6090b0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,7 +26,7 @@ permissions:
jobs:
analyze:
- runs-on: ubuntu-latest
+ runs-on: ubuntu-24.04
timeout-minutes: 60
permissions:
contents: read
@@ -35,6 +35,8 @@ jobs:
fail-fast: false
matrix:
include:
+ - language: actions
+ build-mode: none
- language: javascript-typescript
build-mode: none
# C/C++ CodeQL is intentionally not enabled for the generated
@@ -45,6 +47,8 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Initialize CodeQL
uses: github/codeql-action/init@v4.39.0
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index aca01521..3d832bae 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -52,10 +52,10 @@ jobs:
sparse-checkout-cone-mode: true
persist-credentials: false
- - name: Setup Bun runtime
- uses: oven-sh/setup-bun@v2.2.0
+ - name: Setup Deno runtime
+ uses: denoland/setup-deno@v2.0.5
with:
- bun-version: '1.4.2'
+ deno-version: v2.x
- name: Check for DEED and A2ML files
id: detect
@@ -77,15 +77,16 @@ jobs:
run: |
set -euo pipefail
mapfile -t deeds < <(git ls-files -- '*.deed' | sort)
- bun "$RUNNER_TEMP/standards-deed/1-formats/deed/tools/deed_lint.js" "${deeds[@]}"
+ deno run --allow-read "$RUNNER_TEMP/standards-deed/1-formats/deed/tools/deed_lint.js" "${deeds[@]}"
- name: Validate manifest structure
if: steps.detect.outputs.count > 0
run: bash .github/hooks/validate-a2ml.sh
- name: Write summary
+ env:
+ A2ML_COUNT: ${{ steps.detect.outputs.count }}
+ DEED_COUNT: ${{ steps.detect.outputs.deed_count }}
run: |
- A2ML_COUNT="${{ steps.detect.outputs.count }}"
- DEED_COUNT="${{ steps.detect.outputs.deed_count }}"
echo "## DEED & Manifest Validation" >> "$GITHUB_STEP_SUMMARY"
echo "" >> "$GITHUB_STEP_SUMMARY"
echo "Validated **${DEED_COUNT}** \`.deed\` file(s) via canonical \`deed_lint.js\` and **${A2ML_COUNT}** total manifest file(s)." >> "$GITHUB_STEP_SUMMARY"
@@ -146,12 +147,23 @@ jobs:
run: |
set -euo pipefail
mapfile -t k9_files < <(git ls-files -- '*.k9' '*.k9.ncl' | sort)
- bash "$RUNNER_TEMP/standards-k9/1-formats/k9/tools/k9-validate.sh" --layer L2 --strict "${k9_files[@]}"
+ set +e
+ k9_out="$(bash "$RUNNER_TEMP/standards-k9/1-formats/k9/tools/k9-validate.sh" --layer L2 --strict "${k9_files[@]}" 2>&1)"
+ k9_rc=$?
+ set -e
+ printf '%s\n' "$k9_out"
+ if [ "$k9_rc" -ne 0 ]; then
+ while IFS= read -r line; do
+ [ -n "$line" ] && echo "::error::$line"
+ done <<< "$k9_out"
+ exit "$k9_rc"
+ fi
bash .github/hooks/validate-k9.sh
- name: Write summary
+ env:
+ K9_COUNT: ${{ steps.detect.outputs.k9_count }}
+ CFG_COUNT: ${{ steps.detect.outputs.config_count }}
run: |
- K9_COUNT="${{ steps.detect.outputs.k9_count }}"
- CFG_COUNT="${{ steps.detect.outputs.config_count }}"
if [ "$K9_COUNT" -eq 0 ]; then
cat <<'EOF' >> "$GITHUB_STEP_SUMMARY"
## K9 Contract Validation
@@ -177,6 +189,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Scan for invisible characters
id: lint
@@ -273,6 +287,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Check for Groove manifest
id: groove
@@ -332,6 +348,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Check and validate eclexiaiser manifest
id: eclex
@@ -380,6 +398,8 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
+ with:
+ persist-credentials: false
- name: Generate dogfooding scorecard
run: |
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 3439d96d..13b6934a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -396,6 +396,10 @@ jobs:
const fs = require('fs');
const findings = JSON.parse(fs.readFileSync('hypatia-findings.json', 'utf8'));
+ const rank = { critical: 0, high: 1, medium: 2, low: 3 };
+ const sorted = [...findings].sort(
+ (a, b) => (rank[a.severity] ?? 9) - (rank[b.severity] ?? 9)
+ );
const critical = findings.filter(f => f.severity === 'critical').length;
const high = findings.filter(f => f.severity === 'high').length;
@@ -410,8 +414,8 @@ jobs:
comment += `⚠️ **Action Required:** Critical security issues found!\n\n`;
}
- comment += `View findings
\n\n`;
- comment += `\`\`\`json\n${JSON.stringify(findings.slice(0, 10), null, 2)}\n\`\`\`\n`;
+ comment += `View findings (sorted by severity)
\n\n`;
+ comment += `\`\`\`json\n${JSON.stringify(sorted.slice(0, 25), null, 2)}\n\`\`\`\n`;
comment += `