Repository navigation
deed: add hypatia_chora.deed with the ADR-009 egress declarations - #1011
Merged
Merged
Conversation
The repo deed of hypatia (one deed per repo, standards#837): - (identity) (clade) (forges) (lineage) (status), translated field for field from .machine_readable/CLADE.a2ml under clade-to-repo-deed.adoc; - :repo-uuid is the ADR-008 v8 derived from the name (spec P-1), not the retired v5 CLADE still holds; - CLADE's [identity] name and project are not in the mapping table. Both repeat canonical-name, so they are not emitted. AGENTIC, NEUROSYM and PLAYBOOK carry sections their mapping table does not list, so a2ml_to_deed.py refuses them. META, ECOSYSTEM and STATE are not translated either. As in standards_chora.deed, they stay live and untranslated, and the header names each one and why. (egress ...) declares the 10 jobs that read a secret other than GITHUB_TOKEN. Each uses :enforcement harden-runner-block, and each :endpoints list is the job's harden-runner allowed-endpoints, byte for byte. The exception is push-email-notify's mail host, which is a secret and so is written secret:SMTP_HOST. Checked against standards main (e0645391): deed_lint.js OK, and deed_lint.js --egress OK with 10 jobs. Hypatia.Deed reads all 10, and RE001 reports 0. A negative control (a wrong secret in one entry) gives one drift finding, so the comparison is live. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J4QvDfStHgMdZGTeqaBgM1
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 48 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
hyperpolymath
marked this pull request as ready for review
November 5, 2026 00:34
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
hyperpolymath
enabled auto-merge
November 5, 2026 00:34
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The last step of the RE001 / governance-gate work (#966, #967, #968, #973, #974). The order was eliminate the credential, then harden the job, then declare what remains. This PR is the declaring step: hypatia's first repo deed, following one-deed-per-repo (standards#837) and modelled on
standards_chora.deed.Translated from
.machine_readable/CLADE.a2mlunderclade-to-repo-deed.adoc:(identity),(clade),(forges),(lineage)and(status).:repo-uuidis the ADR-008 v8 form re-derived from the name (spec §5 P-1), not the retired v5 that CLADE holds.[identity] nameandprojectaren't in the mapping table, and both repeatcanonical-name, so they aren't emitted.Not translated, and named in the header. These records stay live, as standards' are:
max-automation,sprint-patterns,workflow-pin-detection), NEUROSYM (proof-integration) and PLAYBOOK (crg-promotion-criteria) carry sections their mapping table doesn't list, soa2ml_to_deed.pyrefuses them rather than guess.state-v1-decision.adoc.(egress …): all 10 jobs on main that read a secret other thanGITHUB_TOKEN.:enforcement harden-runner-block.:endpointslist is that job's harden-runnerallowed-endpoints, byte for byte, so a later check can test the two for equality.secret:SMTP_HOST.ci-health-sweepsweepHYPATIA_DISPATCH_PATestate-rescanpreflight,publishHYPATIA_DISPATCH_PAThypatia-remediation-sweepsweepHYPATIA_DISPATCH_PATinbox-steward-intakerecord-report,analyze-patterns,update-ruleset,dispatch-to-farmFARM_PATpush-email-notifynotifySMTP_*roadmap-syncsyncHow has this been verified?
e0645391:bun deed_lint.jsOK, andbun deed_lint.js --egressOK with 10 jobs. These are the checks standards'deed-conformance.ymlruns.deed_lint.pyrejects the#u8form, but it rejectsstandards_chora.deedwith the same error, and CI doesn't run it.Hypatia.Deed.egress_declarations/1reads all 10 entries. RE001 reports 0, with no drift, stale, enforcement or computed-key findings.Notes for reviewers
hypatia-remediation-sweep,ci-health-sweepandestate-rescanare still red on main.HYPATIA_DISPATCH_PATreturns 401 (reported 10-27), and there were startup failures on 11-04 while the lock was being repaired. Neither is caused by this PR.Generated by Claude Code