diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8f43d22..e60b4fb 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -19,4 +19,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 97187a5..05785e9 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -28,4 +28,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 711656f..0b1b65b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,5 +14,15 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a - secrets: inherit + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} + R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }} diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 234e6b9..5f59a23 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,4 +17,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cc0b6e2..327892d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,11 +17,12 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1 # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. permissions: + actions: read contents: read security-events: write id-token: write diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index 0a29d8a..a10ae8e 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -1,6 +1,6 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= AFFIRMATION — Vocarium, as of 2026-10-27T08:17Z += AFFIRMATION — Vocarium, as of 2026-11-04T22:52Z :toc: macro :toclevels: 2 @@ -12,9 +12,10 @@ toc::[] A short, dated, signed snapshot of what hyperpolymath can honestly and verifiably claim about *Vocarium* at one exact commit. Nothing here is marketing or a -promise; those live in the README. Every claim is tied to a command, and where a -command could not be run in the session that wrote this file it says so and names -the run that attests it instead. The anchor (<>) fixes commit, +promise; those live in the README. Every claim is tied to a command or, for a claim +affirmed by reading, to the named source files; where a command could not be run in +the session that wrote this file it says so and names the run that attests it +instead. The anchor (<>) fixes commit, time and toolchain. It is to be landed by a signed commit — the owner signs on landing. @@ -32,35 +33,46 @@ failing run, or a contradicting source. | The store engine `voc` (pure Zig, no C; ADR-0002) builds and its unit tests pass under the pinned Zig 0.16.0. -| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) -| `zig build test` (Zig 0.16.0, `.tool-versions`). The session that wrote this +| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z) +| `zig build test`, then `zig build` (Zig 0.16.0, `.tool-versions`) — the gate +runs both before it uses `zig-out/bin/voc`. The session that wrote this file could not run Zig: ziglang.org and its mirrors were unreachable and a checksummed conda-forge 0.16.0 binary was obtained but not permitted to execute. CI runs it on pushes to `main`, pull requests and manual dispatch: `.github/workflows/vocarium-ci.yml` (mlugg/setup-zig pinned to 0.16.0). On this -branch, at commit 71c43744ca5304cc7c228c5d8273ef92be789a4e: job "invoke-slice gate" of -https://github.com/hyperpolymath/vocarium/actions/runs/40472451463 — success, -2026-10-27T08:17:46Z. +branch, at commit 376d03a (the checker pin already `4ecba4f`): job "invoke-slice +gate" of https://github.com/hyperpolymath/vocarium/actions/runs/41928746295 — +success, 2026-11-04T22:52:47Z. (The 2026-10-27 snapshot cited run 40472451463 on +71c4374 at the old pin.) | The M1 invoke slice holds end to end: the canonical fixture ingests; the same stored trope yields opposite tropecheck verdicts under two use-models (`casual-note` → `p-sufficient`, `critical-paraphrase` → `p-insufficient` with the witness edge named); an unwarranted edge is refused at the store door. -| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) -| `TROPECHECK_BIN=/path/to/tropecheck-rs bash tests/e2e/invoke_slice.sh` (placeholder path) → expected -`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. -Same CI workflow (`./tests/e2e/invoke_slice.sh`), which hard-fails on toolchain -absence or skew. Note: without `TROPECHECK_BIN` the script builds the checker at -its own pin `69221ad6`; with it set, the pin is bypassed. The pin predates the -spec v0.2 consolidation and is to be bumped once Phase 0 lands upstream (issue -filed, not changed here). +| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z) +| CI reproduction, exactly as `.github/workflows/vocarium-ci.yml` runs it: +`./tests/e2e/invoke_slice.sh` (no `TROPECHECK_BIN`) → expected final line +`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. The +script hard-fails on toolchain absence or skew, clones trope-checker at its pin +`4ecba4f` (trope-checker `main` after Phase 0 landed there; bumped from +`69221ad6`, issue #44) and builds `tropecheck-rs` from it. A separate local check, +not the CI reproduction: `TROPECHECK_BIN=/path/to/tropecheck-rs bash +tests/e2e/invoke_slice.sh` (placeholder path) bypasses the pin and accepts any +executable. Probe run here for the pin bump (not the gate — Zig is still absent): +the IR that `src/store/emit.zig` writes for `examples/vocarium-ingest.jsonl`, +reconstructed by hand, was fed to `tropecheck-rs` built from `4ecba4f` and gave +`casual-note` → `p-sufficient` (exit 0) and `critical-paraphrase` → +`p-insufficient witness=e_paraphrase coord=fate.quality` (exit 1), the verdicts +the gate asserts. | The store format is append-only JSONL (one record per line, `"t"` one of `trope`, `edge`, `use_model`, `warrant`) replayed into in-memory indexes; the only external contract is Trope IR v0.2 over process I/O, verified by `tropecheck`. | affirmed (by reading) -| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema -at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary. +| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema at +https://github.com/hyperpolymath/trope-checker/blob/4ecba4f1862aec144ec940b1d8a93ddabd1cb591/schemas/trope-ir.schema.json +(the gate's pinned revision; the gate clones it into `.gate-tools/trope-checker` +when `TROPECHECK_BIN` is unset — it is not vendored here) is the trust boundary. |=== == What we do NOT claim @@ -80,11 +92,12 @@ at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary. |=== | Project | Vocarium | Repository | https://github.com/hyperpolymath/vocarium -| Commit (SHA) tested | 71c43744ca5304cc7c228c5d8273ef92be789a4e (this branch; the commit CI run 40472451463 ran on) -| Affirmed base | 57944e6ad15067a29456096654e4f7dee44dc816 (`main` at the time; differs from the tested commit only in this file and the README, so the gate result carries over to it) -| Landing commit | the signed commit that lands this snapshot on `main` (the file itself predates it as a template); after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA -| Timestamp (UTC) | 2026-10-27T08:17:46Z (completion of the cited CI gate job) -| Toolchain | Zig 0.16.0 pinned in `.tool-versions`, which the gate enforces; `mise.toml` still says `zig = "latest"` — a drift the gate would reject, to be reconciled (issue). Checker for the gate: `tropecheck-rs` from trope-checker (script pin `69221ad6`; the session's binary was built from 44020f9). Zig was not executed in this session (see above). +| Commit (SHA) tested | 376d03a (this branch; the commit CI run 41928746295 ran on, with the checker pin at `4ecba4f`) +| Affirmed base | c9381f10d180969ef343d9cde0179b829627d90d (`main` at the time; differs from the tested commit in `tests/e2e/invoke_slice.sh` (the pin), this file and the README only) +| Previous snapshot | 2026-10-27T08:17Z, tested commit 71c4374, CI run 40472451463, landed on `main` as 297bdd9 (squash of #42; GitHub reports the commit as verified, signed by GitHub's web-flow key on the owner's merge) +| Landing commit | the commit that lands this snapshot on `main`; after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA +| Timestamp (UTC) | 2026-11-04T22:52:47Z (completion of the cited CI gate job) +| Toolchain | Zig 0.16.0 pinned in `.tool-versions`; the gate reads that file and compares it with `zig version`, so an environment in which `mise.toml`'s `zig = "latest"` resolves to anything else fails the gate (the gate does not read `mise.toml` itself; the drift is issue #46). Checker for the gate: `tropecheck-rs` built from trope-checker at the script pin `4ecba4f` (the probe binary in this session was built from the same revision; the 2026-10-27 session's was from 44020f9). Zig was not executed in either session (see above). | Affirmed by | Jonathan D.A. Jewell (owner signs on landing; written by the Phase 0 agent) |=== diff --git a/README.adoc b/README.adoc index aad9920..e67a3c1 100644 --- a/README.adoc +++ b/README.adoc @@ -165,6 +165,8 @@ Vocarium is an experimental database architecture for trope-aware, loss-aware, w Vocabulary track: trope-particularity-workbench → haec → trope-checker (verdict). Store/query track: haec → vocarium → hermeneia → trope-checker (verdict). trope-checker depends on nothing (HC-1); the workbench depends on nothing; vocarium and hermeneia meet at the M2 StoreProvider adapter (vocarium ADR-0002: wire, do not link). +The M2 adapter is planned, not built: a Hermeneia-side Rust `StoreProvider` that drives `voc` as a subprocess over the Trope IR v0.2 JSON contract (see `AFFIRMATION.adoc`, "What we do NOT claim"). The five-repo paragraph above is shared verbatim across the five READMEs; this sentence is Vocarium's own. + ## Relationship to other systems Vocarium is part of a wider language/database ecology: diff --git a/tests/e2e/invoke_slice.sh b/tests/e2e/invoke_slice.sh index 9b18872..27adb6c 100755 --- a/tests/e2e/invoke_slice.sh +++ b/tests/e2e/invoke_slice.sh @@ -17,7 +17,7 @@ set -euo pipefail cd "$(dirname "$0")/../.." ZIG_EXPECTED="$(awk '$1=="zig"{print $2}' .tool-versions)" -TROPECHECK_PIN="69221ad6bec0c9286cb5c917edfad281e7e0089e" +TROPECHECK_PIN="4ecba4f1862aec144ec940b1d8a93ddabd1cb591" fail() { echo "GATE FAIL: $*" >&2; exit 1; }