Skip to content

docs(clade): uuid follows the GitHub path; qualify the prefixed-name case - #381

Merged
hyperpolymath merged 1 commit into
mainfrom
docs/clade-uuid-github-path
Nov 11, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
docs/clade-uuid-github-path

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

Comment-only follow-up. An earlier PR replaced "uuid is immortal" in the CLADE status comment with "uuid follows the forge path". This one makes it exact. gv-clade-index ADR 0007 (accepted 2026-11-10) derives the uuid from the GitHub path (UUIDv5 over github.com/<owner>/<name>): a move or rename on GitHub mints a new one, and a mirror move or a phase change never does.

A2ML is retired for new content. Correcting a factually wrong comment in an existing file is an edit, not new content.

Changes

  • .machine_readable/CLADE.a2ml: "uuid follows the forge path" → "uuid follows the GitHub path (a move or rename there mints a new one, gv-clade-index ADR 0007; a mirror move or a phase change never does)"; "A prefixed-name (clade code) change is NOT a phase change" → "A prefixed-name (clade code) change with the GitHub path unchanged is NOT a phase change". The paragraph is re-wrapped at 80 columns. No data values change. The owner approved this wording for the whole estate. It refines the wording merged earlier.

RSR Quality Checklist

Required

  • Tests pass (just test or equivalent): not run locally. Comment-only change, left to CI.
  • Code is formatted (just fmt or equivalent): n/a, no code
  • Linter is clean (no new warnings or errors): n/a, no code
  • No banned language patterns
  • No unsafe blocks without // SAFETY: comments
  • No banned functions
  • SPDX license headers present on all new/modified source files (not touched)
  • No secrets, credentials, or .env files included

Testing

The diff is one comment paragraph in one file. Every line is ≤80 characters. The commit is signed.


Generated by Claude Code

The uuid is UUIDv5 over github.com/<owner>/<name> (gv-clade-index ADR
0007), so say "GitHub path" rather than "forge path": a move or rename on
GitHub mints a new uuid, a mirror move does not. Scope the "not a phase
change" sentence to a prefixed-name change with the GitHub path unchanged.

Correcting a factually wrong comment in an existing A2ML file is an edit,
not new A2ML content.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0136P7ZmTcNdC1jL1Vp3qW9H
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Explain Change →

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

  • Documentation
    • Clarified that a GitHub move or rename results in a new UUID, while moving a mirror or changing a lifecycle phase leaves the UUID unchanged.
    • Clarified that changing a prefixed name without changing the GitHub path adds the previous name to the aliases, without changing the UUID or lifecycle phase.

The lifecycle-status comment now states that GitHub moves or renames mint a new UUID. It also states that mirror moves do not change the UUID, and that a prefixed-name change with an unchanged GitHub path updates aliases[] without changing the UUID or phase.

Changes: Lifecycle identity rules

Layer / File(s) Summary
Document UUID and alias rules
.machine_readable/CLADE.a2ml
The comment identifies the GitHub path as the basis for UUID identity. It distinguishes GitHub moves or renames from mirror moves, and specifies how a prefixed-name change affects aliases[], UUID, and phase.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

  • hyperpolymath/boj-server#380: Changes the same lifecycle-status comment. This PR further specifies the GitHub path and when a prefixed-name change updates aliases[].
Merge Risk: Minimal · up to 8c0a6

The change clarifies lifecycle identity documentation without changing data values. No material merge risk is identified.

Pre-merge checks: Passed 4

Check name Status Explanation
Title check Passed The title clearly identifies the change: it specifies that the UUID follows the GitHub path and qualifies the prefixed-name case.
Description check Passed The description includes the required Summary, Changes, RSR Quality Checklist and Testing sections. It explains the comment change and states that tests were not run locally and will be left to CI. Th…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description includes the required Summary, Changes, RSR Quality Checklist and Testing sections. It explains the comment change and states that tests were not run locally and will be left to CI. The checklist is mostly complete, and the missing Screenshots section is not required when no screenshots apply.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Recent review info

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 722b01ce-9957-4182-8d17-cb94141d649e
Commits

Reviewing files that changed from the base of the PR and between 84014d4 and 8c0a6b7.

Files selected for processing: 1

  • .machine_readable/CLADE.a2ml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Context from checks skipped due to timeout: 13

  • GitHub Check: CodeRabbit
  • GitHub Check: Detect relevant changes
  • GitHub Check: Hypatia Neurosymbolic Analysis
  • GitHub Check: Detect relevant changes
  • GitHub Check: Detect relevant changes
  • GitHub Check: Bridge — node (unit + boot smoke)
  • GitHub Check: Bridge — bun (unit + boot smoke)
  • GitHub Check: Detect relevant changes
  • GitHub Check: Detect relevant changes
  • GitHub Check: Bridge — deno (unit + boot smoke)
  • GitHub Check: Detect relevant changes
  • GitHub Check: Detect relevant changes
  • GitHub Check: semgrep-cloud-platform/scan
Additional context used

Code guidelines: 1

.github/copilot-instructions.md — auto-discovered
Path-based instructions: 1

Source excerpt: State files (.a2ml) live in `.machine_readable/` ONLY, never the root.

CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • .machine_readable/CLADE.a2ml
Additional comments: 1

.machine_readable/CLADE.a2ml: 1

29-35: LGTM!

@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 83 issues detected

Severity Count
🔴 Critical 1
🟠 High 19
🟡 Medium 63

⚠️ Action Required: Critical security issues found!

View findings (sorted by severity)
[
  {
    "line": 70,
    "reason": "believe_me undermines formal verification (4 occurrences, CWE-704, line 70, 269, 279, 289)",
    "type": "believe_me",
    "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
    "level": "epi",
    "rule_module": "code_safety",
    "action": "flag",
    "severity": "critical",
    "evidence": [
      {
        "span": {
          "file": "/home/runner/work/boj-server/boj-server/src/abi/Boj/SafetyLemmas.idr",
          "end_line": 70,
          "start_line": 70
        },
        "rule": "code_safety/believe_me",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "level": "epi",
    "rule_module": "workflow_audit",
    "action": "peter-evans/repository-dispatch",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/instant-sync.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "workflow_audit/secret_action_without_presence_gate",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 29,
    "reason": "job `deploy` in .github/workflows/pages-deploy.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring; it holds the credential next to fetched code (a piped installer or a dependency install/build) in the same step",
    "type": "RE001",
    "file": ".github/workflows/pages-deploy.yml",
    "level": "epi",
    "rule_module": "research_extensions",
    "action": "report",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/pages-deploy.yml",
          "end_line": 29,
          "start_line": 29
        },
        "rule": "research_extensions/RE001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 33,
    "reason": "Shell execution -- validate input before passing to shell (1 occurrences, CWE-78, line 33)",
    "type": "js_exec_sync",
    "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
    "level": "epi",
    "rule_module": "code_safety",
    "action": "flag",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "/home/runner/work/boj-server/boj-server/mcp-bridge/lib/nickel-validator.js",
          "end_line": 33,
          "start_line": 33
        },
        "rule": "code_safety/js_exec_sync",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/secret_action_without_presence_gate -- Hypatia workflow_audit: secret_action_without_presence_gate -- 37 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/instant-sync.yml",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/instant-sync.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_safety/js_exec_sync -- Hypatia code_safety: js_exec_sync -- 40 day(s) old [STALE]",
    "type": "CSA001",
    "file": "mcp-bridge/lib/nickel-validator.js",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "mcp-bridge/lib/nickel-validator.js",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/code_safety/believe_me -- Hypatia code_safety: believe_me -- 40 day(s) old [STALE]",
    "type": "CSA001",
    "file": "src/abi/Boj/SafetyLemmas.idr",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "src/abi/Boj/SafetyLemmas.idr",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/structural_drift/SD007 (medium) at .claude/CLAUDE.md is 34 days old (threshold: 30 days) -- overdue for remediation",
    "type": "CSA003",
    "file": ".claude/CLAUDE.md",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".claude/CLAUDE.md",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/workflow_audit/secret_action_without_presence_gate (high) at .github/workflows/instant-sync.yml is 37 days old (threshold: 7 days) -- overdue for remediation",
    "type": "CSA003",
    "file": ".github/workflows/instant-sync.yml",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/instant-sync.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/workflow_audit/missing_timeout_minutes (medium) at .github/workflows/pages-deploy.yml is 37 days old (threshold: 30 days) -- overdue for remediation",
    "type": "CSA003",
    "file": ".github/workflows/pages-deploy.yml",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/pages-deploy.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/code_safety/zig_bit_cast (medium) at ffi/zig/src/cartridge_shim.zig is 40 days old (threshold: 30 days) -- overdue for remediation",
    "type": "CSA003",
    "file": "ffi/zig/src/cartridge_shim.zig",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "ffi/zig/src/cartridge_shim.zig",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/code_safety/js_exec_sync (high) at mcp-bridge/lib/nickel-validator.js is 40 days old (threshold: 7 days) -- overdue for remediation",
    "type": "CSA003",
    "file": "mcp-bridge/lib/nickel-validator.js",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "mcp-bridge/lib/nickel-validator.js",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert hypatia/code_safety/believe_me (high) at src/abi/Boj/SafetyLemmas.idr is 40 days old (threshold: 7 days) -- overdue for remediation",
    "type": "CSA003",
    "file": "src/abi/Boj/SafetyLemmas.idr",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": "src/abi/Boj/SafetyLemmas.idr",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert PinnedDependenciesID (medium) at .github/workflows/push-email-notify.yml is 50 days old (threshold: 30 days) -- overdue for remediation",
    "type": "CSA003",
    "file": ".github/workflows/push-email-notify.yml",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/push-email-notify.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Code-scanning alert PinnedDependenciesID (medium) at .github/workflows/dogfood-gate.yml is 50 days old (threshold: 30 days) -- overdue for remediation",
    "type": "CSA003",
    "file": ".github/workflows/dogfood-gate.yml",
    "level": "epi",
    "rule_module": "code_scanning_alerts",
    "action": "escalate",
    "severity": "high",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/dogfood-gate.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "code_scanning_alerts/CSA003",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 52,
    "reason": "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
    "type": "SD024",
    "file": "Justfile",
    "level": "epi",
    "category": "RetiredDescriptilePolicy",
    "rule_module": "structural_drift",
    "action": "update_reference",
    "severity": "high",
    "recipe_id": "recipe-retired-descriptile-policy",
    "fix_script": "fix-retired-descriptile-policy.sh",
    "evidence": [
      {
        "span": {
          "file": "Justfile",
          "end_line": 52,
          "start_line": 52
        },
        "rule": "structural_drift/SD024",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 937,
    "reason": "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
    "type": "SD024",
    "file": "Justfile",
    "level": "epi",
    "category": "RetiredDescriptilePolicy",
    "rule_module": "structural_drift",
    "action": "update_reference",
    "severity": "high",
    "recipe_id": "recipe-retired-descriptile-policy",
    "fix_script": "fix-retired-descriptile-policy.sh",
    "evidence": [
      {
        "span": {
          "file": "Justfile",
          "end_line": 937,
          "start_line": 937
        },
        "rule": "structural_drift/SD024",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 959,
    "reason": "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
    "type": "SD024",
    "file": "Justfile",
    "level": "epi",
    "category": "RetiredDescriptilePolicy",
    "rule_module": "structural_drift",
    "action": "update_reference",
    "severity": "high",
    "recipe_id": "recipe-retired-descriptile-policy",
    "fix_script": "fix-retired-descriptile-policy.sh",
    "evidence": [
      {
        "span": {
          "file": "Justfile",
          "end_line": 959,
          "start_line": 959
        },
        "rule": "structural_drift/SD024",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 1041,
    "reason": "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
    "type": "SD024",
    "file": "Justfile",
    "level": "epi",
    "category": "RetiredDescriptilePolicy",
    "rule_module": "structural_drift",
    "action": "update_reference",
    "severity": "high",
    "recipe_id": "recipe-retired-descriptile-policy",
    "fix_script": "fix-retired-descriptile-policy.sh",
    "evidence": [
      {
        "span": {
          "file": "Justfile",
          "end_line": 1041,
          "start_line": 1041
        },
        "rule": "structural_drift/SD024",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 1162,
    "reason": "CI policy requires a retired descriptile path; align the check with .machine_readable/descriptiles/",
    "type": "SD024",
    "file": "Justfile",
    "level": "epi",
    "category": "RetiredDescriptilePolicy",
    "rule_module": "structural_drift",
    "action": "update_reference",
    "severity": "high",
    "recipe_id": "recipe-retired-descriptile-policy",
    "fix_script": "fix-retired-descriptile-policy.sh",
    "evidence": [
      {
        "span": {
          "file": "Justfile",
          "end_line": 1162,
          "start_line": 1162
        },
        "rule": "structural_drift/SD024",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "level": "epi",
    "rule_module": "workflow_audit",
    "action": "flag",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/pages-deploy.yml",
          "end_line": 0,
          "start_line": 0
        },
        "rule": "workflow_audit/missing_timeout_minutes",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 44,
    "reason": "job `build-and-push` in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "level": "epi",
    "rule_module": "research_extensions",
    "action": "report",
    "severity": "medium",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/container-publish.yml",
          "end_line": 44,
          "start_line": 44
        },
        "rule": "research_extensions/RE001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 278,
    "reason": "job `scan` in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring; it holds the credential next to fetched code (a piped installer or a dependency install/build)",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "level": "epi",
    "rule_module": "research_extensions",
    "action": "report",
    "severity": "medium",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/hypatia-scan.yml",
          "end_line": 278,
          "start_line": 278
        },
        "rule": "research_extensions/RE001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 46,
    "reason": "job `notify` in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "level": "epi",
    "rule_module": "research_extensions",
    "action": "report",
    "severity": "medium",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/push-email-notify.yml",
          "end_line": 46,
          "start_line": 46
        },
        "rule": "research_extensions/RE001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  },
  {
    "line": 88,
    "reason": "job `publish-bun` in .github/workflows/publish.yml references `secrets.*` but does not install `step-security/harden-runner` or declare its egress — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/publish.yml",
    "level": "epi",
    "rule_module": "research_extensions",
    "action": "report",
    "severity": "medium",
    "evidence": [
      {
        "span": {
          "file": ".github/workflows/publish.yml",
          "end_line": 88,
          "start_line": 88
        },
        "rule": "research_extensions/RE001",
        "observations": 1,
        "rule_version": "0.1.0"
      }
    ],
    "support": {
      "kind": "pattern"
    }
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@linear-code
linear-code Bot marked this pull request as ready for review November 10, 2026 23:53
@hyperpolymath
hyperpolymath merged commit 646b46f into main Nov 11, 2026
45 checks passed
@hyperpolymath
hyperpolymath deleted the docs/clade-uuid-github-path branch November 11, 2026 00:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants