Skip to content

ci(abi): gate the Idris2 proofs on every PR, with module-shaped paths - #279

Open
hyperpolymath wants to merge 3 commits into
claude/proof-status-reconcilefrom
claude/abi-idris2-gate
Open

hyperpolymath wants to merge 3 commits into
claude/proof-status-reconcilefrom
claude/abi-idris2-gate

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Stacked on #277.

The Idris2 modules are named PanicAttack.ABI.<M> but lived in src/abi/, so idris2 --check src/abi/<M>.idr failed on a module-name mismatch from any directory. No CI job checked them. That is how Stripping.idr sat on main not compiling while PROOF-NEEDS.adoc called it closed.

Changes

  • File moves: src/abi/*.idr → src/abi/PanicAttack/ABI/, pure renames. New src/abi/panic-attack-abi.ipkg lists the five modules.
  • CI gate: a new abi-proofs job in .github/workflows/proven-tests.yml, on every PR and on pushes to main.
    • It runs idris2 --typecheck src/abi/panic-attack-abi.ipkg, and fails on a non-zero exit or any Error: line. Idris2 0.7.0 can print an error and still exit 0.
    • Its Idris2 0.7.0 comes from the same pinned installer and cache key as the scheduled framework job, so a warm cache makes it a type-check rather than a compiler build.
    • It uses only actions that workflow already locks, so actions.lock is unchanged.
  • Docs:
    • PROOF-NEEDS.adoc: the gate is now the receipt, the first local receipt is kept, and the gate row leaves the open list.
    • EXPLAINME.adoc and PROOF-PROGRAMME.adoc point at the new paths. EXPLAINME's three descriptions also now say what each module actually shows; for PA1 that is "vacuous as stated".
    • CHANGELOG.adoc history and the retired .a2ml files are left as they are.

Verification

All of the following were run locally:

  • idris2 --typecheck src/abi/panic-attack-abi.ipkg passes: 5/5 modules, exit 0, no Error: line.
  • Negative controls: a planted false lemma and a planted missing import each make it exit non-zero with an Error: line.
  • The job's run step passes when executed exactly as written in the workflow.
  • actionlint 1.7.7 is clean.
  • With the checksum-pinned yq v4.54.1 that ci-integrity.yml uses:
    • validate-sha-pins.sh: 0 unpinned refs.
    • check-allowed-actions.sh: 0 tree-policy gaps.
  • .githooks/validate-actions-lock.sh, run on a pristine clone with gh-actions-lock v0.2.0 (checksum-verified) and metadatastician/standards at the pinned 087f6bf, reports that actions.lock is in sync.

Generated by Claude Code

The Idris2 modules are named PanicAttack.ABI.<M> but lived in src/abi/,
so `idris2 --check src/abi/<M>.idr` failed on a module-name mismatch
from any directory. No CI job checked them, which is how Stripping.idr
sat on main not compiling while PROOF-NEEDS called it closed.

- Move src/abi/*.idr to src/abi/PanicAttack/ABI/ (pure renames) and
  add src/abi/panic-attack-abi.ipkg listing the five modules.
- Add the `abi-proofs` job to proven-tests.yml: every PR and push to
  main runs `idris2 --typecheck src/abi/panic-attack-abi.ipkg` and
  fails on a non-zero exit or any `Error:` line. It reuses the
  framework job's pinned installer and Idris2 cache key, and only the
  actions that workflow already locks, so actions.lock is unchanged.
- PROOF-NEEDS.adoc: the gate is now the receipt; the first local
  receipt is kept; the gate row leaves the open list. EXPLAINME and
  PROOF-PROGRAMME point at the new paths. CHANGELOG history and the
  retired .a2ml files are left as they are.

Checked locally: the package type-checks (Idris2 0.7.0); a planted
false lemma and a planted missing import both fail it; the job's run
step passes as written; actionlint 1.7.7 is clean; validate-sha-pins
and check-allowed-actions pass with the checksum-pinned yq v4.54.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jma5ixtpeZyJRmfoSsC98u
@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 55a9eaa1-5157-428b-91c5-fb8232b44ec3
Commits

Reviewing files that changed from the base of the PR and between 4db2497 and 8820e6e.

Files selected for processing: 10

  • .github/workflows/proven-tests.yml
  • EXPLAINME.adoc
  • PROOF-NEEDS.adoc
  • PROOF-PROGRAMME.adoc
  • src/abi/PanicAttack/ABI/AttestationUnforgeability.idr
  • src/abi/PanicAttack/ABI/ClassificationSoundness.idr
  • src/abi/PanicAttack/ABI/PatternCompleteness.idr
  • src/abi/PanicAttack/ABI/Stripping.idr
  • src/abi/PanicAttack/ABI/Types.idr
  • src/abi/panic-attack-abi.ipkg
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@hyperpolymath
hyperpolymath marked this pull request as ready for review November 9, 2026 15:40
@chatgpt-codex-connector

Copy link
Copy Markdown
Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ❌ Failed 2026-11-09T15:40:44.786538Z
We couldn’t complete this review. Comment @codex review to try again.
887d000 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@sonarqubecloud

sonarqubecloud Bot commented Nov 9, 2026

Copy link
Copy Markdown

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants