Repository navigation
fix(k9): validate K9 with the canonical validator; templates are not components - #193
Merged
Merged
Conversation
…components WO-10 for echidnabot, K9 lane (standards#1058). - .github/hooks/validate-k9.sh ran its own grep checks, a second validator that accepts files contract v1.0.0 (D173) rejects. It is replaced by the rsr-template-repo wrapper, as merged in panic-attack#253 (relative STANDARDS_DIR made absolute), which runs 1-formats/k9/tools/k9-validate.sh --strict from a standards checkout. - The dogfood gate's K9 job checks the validator out at standards 8e48b1ca (the template's pin), installs a sha256-pinned Nickel 1.18.0 and runs L0-L2. It fails if the validator or nickel is missing rather than passing at a lower layer. - The three template-*.k9.ncl files and examples/setup-repo.k9.ncl carry unfilled placeholders: renamed *.k9.ncl.in, as the template did in rsr-template-repo#247. The README follows. Both tracked K9 files pass --strict --layer L2 locally. No action is added or removed, so actions.lock is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
Contributor
|
Caution Review failedThe pull request is closed.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
cargo audit (the Dependency audit check) fails on main: - ctutils 0.4.2 -> 0.4.8 (RUSTSEC-2026-0385) - libz-sys 1.1.29 -> 1.1.31 (RUSTSEC-2026-0418) - rustls-webpki 0.103.15 -> 0.103.16 (RUSTSEC-2026-0382) - webpki-roots 1.0.7 -> 1.0.11 (RUSTSEC-2026-0381) Precise cargo update -p for those four only; no other lock entry moves. cargo audit now reports no vulnerabilities (the three allowed warnings remain), and cargo check --locked passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3
…-session-th4e9w-wo10-k9
Owner
Author
|
The same check also fails on The fix is in #194, a precise Generated by Claude Code |
hyperpolymath
marked this pull request as ready for review
November 5, 2026 00:12
hyperpolymath
enabled auto-merge (squash)
November 5, 2026 00:12
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Add Carrot credits or activate Agent usage billing to use Autofix |
|
hyperpolymath
added a commit
that referenced
this pull request
Nov 5, 2026
## Summary The `Dependency audit` check (`cargo audit`) fails on `main` (`eedfdc3c`), and so on every open PR. This PR moves the four affected crates, and only those, to the versions their advisories name as fixed. | Crate | From | To | Advisory | |---|---|---|---| | ctutils | 0.4.2 | 0.4.8 | RUSTSEC-2026-0385 | | libz-sys | 1.1.29 | 1.1.31 | RUSTSEC-2026-0418 | | rustls-webpki | 0.103.15 | 0.103.16 | RUSTSEC-2026-0382 | | webpki-roots | 1.0.7 | 1.0.11 | RUSTSEC-2026-0381 | ## Changes - `Cargo.lock` only: `cargo update -p` for the four crates. No other entry moves. ## Testing - `cargo audit`: no vulnerabilities. The three allowed warnings (event-listener, chacha20, spin) remain as before. - `cargo metadata --locked` and `cargo check --locked`: both pass. The same commit is merged into #193, which was red on this check. --- _Generated by [Claude Code](https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3)_ Co-authored-by: Claude <noreply@anthropic.com>
6 tasks done
hyperpolymath
added a commit
to hyperpolymath/echidna
that referenced
this pull request
Nov 9, 2026
…ord to contract v1.0.0 (#464) ## Summary This is WO-10's K9 lane for echidna (metadatastician/standards#1058). It follows the pattern already merged in hyperpolymath/panic-attack#253, hyperpolymath/echidnabot#193 and hyperpolymath/proof-burrower#124, and matches rsr-template-repo after WO-9. Before this PR, all 14 tracked K9 files failed the canonical validator. The local hook did its own grep checks, which made it a second, looser validator. After this PR, the 10 files that are components all pass layers L0–L2. The other 4 are templates, renamed to `.in`. ## Changes - **`dogfood-gate.yml`, K9 job:** - It runs `metadatastician/standards` `1-formats/k9/tools/k9-validate.sh` at the template's pin `e064539`, using Nickel 1.18.0 pinned by sha256. - It goes through the hardened template hook. - If the validator or `nickel` is missing, the job fails instead of passing at a lower layer. - The `validation` output that the summary job reads is kept. - **`.github/hooks/validate-k9.sh`:** replaced with the template's wrapper. - **The six contractiles (`must`, `trust`, `bust`, `intend`, `adjust`, `dust`):** - Each now has the v1.0.0 pedigree: `schema_version`, `component_type`, `semantics` and `side_effects`. - Each is a `'Yard` declaration, as in the template: the paired runner does the execution, so this record spawns nothing. - The import of `../k9/template-hunt.k9.ncl` is gone. That path never resolved. - `variance_schema` is marked `not_exported`, as in the template. - Echidna's own prose and invariants are unchanged. - **Templates renamed to `.in`:** `svc/k9/template-{kennel,yard,hunt}.k9.ncl` and `examples/setup-repo.k9.ncl`. A template is not a component. The two filled examples now use the template's current text with echidna's values. - **`container/deploy.k9.ncl`:** now a v1.0.0 Hunt component. - It declares capabilities, side effects and a signature block. The signature block is checked for presence only; the validator reports it as present but unverified (`K9-C001`) until the owner signs the file. - The `PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT` string and the `sha256:placeholder` checksum are removed. - Image, port, health check and scripts are unchanged. - **`setup-prover-env.k9.ncl`:** rewritten. It had never been valid Nickel (top-level bindings with no enclosing record). It now provisions provers only through `manifests/live-provers.scm` (Guix, the primary path) and the Wave-3 sealed containers. This drops: - an unpinned `curl … elan-init.sh | sh` from `master`; - `sudo` installs through apt and dnf; - installs through cabal and opam; - a fixed prover count that duplicated `docs/PROVER_COUNT.adoc`. - **k9iser retired:** `k9iser.toml` is deleted. No workflow ran it, so `docs/ENV-VARS.adoc`'s statement that `VERISIMDB_URL` is "enforced by `k9iser.toml:47`" was untrue and has been corrected. - **READMEs:** `contractiles/README.adoc` and `svc/k9/README.adoc` are updated to match. No action was added or removed, so `actions.lock` is unchanged. ## RSR Quality Checklist ### Required - [x] Linter is clean: the edited workflow parses as YAML. - [x] No banned language patterns. - [x] No banned functions. - [x] SPDX headers are present on new or modified source files. - [x] No secrets, credentials or `.env` files. ### As Applicable - [x] Documentation updated: `contractiles/README.adoc`, `svc/k9/README.adoc` and `docs/ENV-VARS.adoc`. ## Testing - With Nickel 1.18.0, `STANDARDS_DIR=<standards@e0645391> bash .github/hooks/validate-k9.sh` checked 10 files, and none failed. The same run against standards `8e48b1ca` also passes. - Nothing else in the repository reads the changed K9 files. The contractile runners (`<verb>.ncl`) import only `_base.ncl`. --- _Generated by [Claude Code](https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is WO-10 for echidnabot, covering the K9 lane only (metadatastician/standards#1058). It follows the same pattern as hyperpolymath/panic-attack#253, which is merged.
Until now,
.github/hooks/validate-k9.shdid its own grep checks. That made it a second validator, and it accepts files that contract v1.0.0 (D173) rejects.Changes
.github/hooks/validate-k9.sh: replaced with rsr-template-repo's wrapper as merged in panic-attack#253. That version turns a relativeSTANDARDS_DIRinto an absolute path. The wrapper runs1-formats/k9/tools/k9-validate.sh --strictfrom a standards checkout.dogfood-gate.yml, K9 job:8e48b1ca, the same pin as the template;template-{hunt,kennel,yard}.k9.nclandexamples/setup-repo.k9.nclcontain unfilled placeholders, so they become*.k9.ncl.in, as the template did in rsr-template-repo#247. The README is updated to match.No action is added or removed, so
actions.lockis unchanged.Dual-truth: these
.machine_readable/renames also need to land inhyperpolymath/echidna'sechidnabot/copy. They will be part of the echidna WO-10 PR.Testing
STANDARDS_DIR=<standards@8e48b1ca> bash .github/hooks/validate-k9.sh: 2 files, 0 failing at L2.STANDARDS_DIRandINPUT_PATH=echidnabot: passes.dogfood-gate.ymlparses as YAML.Generated by Claude Code