[hyperpolymath]

Why

This closes out, in this repository, the response to hyperpolymath/standards moving to metadatastician/standards (2026-10-25). Hypatia's own pilot is done: on main at 6bd66a7, Governance (run 41932503298), Secret Scanner and Hypatia Security Scan all run and pass against metadatastician/standards@a797d30. Two things were left over:

1. A WF028 defect Codex found on feat(workflow_audit): WF028 — reusable call into a moved repository #965 after it merged.
2. The estate-level decision and its remaining actions existed only in session chat.

What

• fix(workflow_audit): WF028 cut an unquoted flow ref at #. So jobs: { g: { uses: …/x.yml@release#one } } reported current_sha: release and a wrong replacement. In a YAML plain scalar, # opens a comment only after whitespace, and whitespace already ends the scalar. The flow value now stops only at whitespace and the flow indicators , } ]. A spaced trailing comment is still dropped, and a test covers it.
• docs(operations): docs/operations/standards-move-estate-rollout.adoc records:
  • the owner's decision: D, moving the estate into the metadatastician org; a narrow per-repo allow-list stopgap until then; a leaf repository as the D pilot.
  • the facts that shape the rollout:
    • a personal account has no account-wide Actions policy;
    • a transfer empties the allow-list (the gossamer precedent);
    • a transfer breaks inbound uses: calls;
    • a re-point needs a tool-generated lock.
  • the pilot's evidence.
  • each owed action and who owns it.
  • the WF028 limits accepted on feat(workflow_audit): WF028 — reusable call into a moved repository #965, with their shared root cause.
  • acceptance criteria and a "When to update" footer, per the operations-doc convention.
• DEBT-REGISTER gains CI-9, and docs/README.adoc indexes the new page.

Validation

• test/rules/workflow_audit_pins_test.exs: 113 tests, 0 failures. The new test fails on main's code (1 failure) and passes with the fix.
• mix format --check-formatted is clean on the touched files.
• asciidoctor --failure-level WARN builds all three .adoc files with no warnings, the same command the Validate Documentation job runs. git diff --check is clean.
• Caveat: repo.hex.pm is still blocked by this session's network policy, so the rule modules were compiled standalone under Elixir 1.14. CI is the first full-suite run.

Not in this PR (owner or other repos)

• Rotate HYPATIA_DISPATCH_PAT. Every CI-health sweep run from 22 Oct to 3 Nov died with HTTP 401 at repos to scan: 0 (e.g. run 41574487070), so the stopgap and the census can't run from CI.
• Set the metadatastician org's Actions policy before the first D transfer.
• Test whether hyperpolymath/standards can be recreated (option B, as a fallback only).
• Delete zz-one-off-lock-regen.yml. It's a fix(ci): re-point standards callers to metadatastician/standards #958 leftover tied to a finished repair branch.
• gitbot-fleet: an owner re-point fixer. stale-reusable-pins.tsv and fix-stale-reusable-pin.sh still key on the old path.
• standards#1234 A4: record the leaf-first transfer order.
• Mirror to Git Forges: 4 of 9 forge jobs fail inside the job (Bitbucket, Disroot, SourceHut, Gitea). This is separate from the move: the workflow starts.

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d0147835-a9d2-4807-881d-3d48122206ef

Commits

Reviewing files that changed from the base of the PR and between 6bd66a7 and 61d6ce8.

Files selected for processing: 5

• docs/DEBT-REGISTER.adoc
• docs/README.adoc
• docs/operations/standards-move-estate-rollout.adoc
• lib/rules/workflow_audit.ex
• test/rules/workflow_audit_pins_test.exs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T23:52:56.290442Z	61d6ce8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[hyperpolymath]

@coderabbitai review

---

Generated by Claude Code

[coderabbitai]

Rate Limit Exceeded

@hyperpolymath have exceeded the limit for the number of chat messages per hour. Please wait 16 minutes and 15 seconds before sending another message.