From cadfae0628311e2f16543cc95d6bf68662011a24 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:49:04 +0000 Subject: [PATCH 1/7] test(e2e): bump TROPECHECK_PIN to trope-checker 4ecba4f, main after Phase 0 landed there What was wrong: the invoke-slice gate built the checker at 69221ad6 (main @ 2026-07-28), which predates the spec v0.2 consolidation (trope-checker #107, merged 2026-10-31) and the decoder fixes of #109. Issue #44 recorded the bump as due once Phase 0 landed upstream; it has. What changed: TROPECHECK_PIN is 4ecba4f1862aec144ec940b1d8a93ddabd1cb591 (trope-checker main, 2026-11-02). Nothing else in the gate changes; it still hard-fails on toolchain absence or skew and still asserts opposite verdicts under the two use-models plus the refused unwarranted edge. What I ran (Zig is still unavailable here, so NOT the gate itself): cargo build --release at trope-checker 4ecba4f -> tropecheck-rs builds; bash tests/conformance/run.sh at that revision with it -> all pass; the IR src/store/emit.zig writes for examples/vocarium-ingest.jsonl, reconstructed by hand and fed to that binary: casual-note -> p-sufficient, exit 0 critical-paraphrase -> p-insufficient witness=e_paraphrase coord=fate.quality, exit 1 which are exactly the verdicts the gate asserts. The schema's required fields are unchanged between the two pins (the file was reformatted and gained explicit type annotations). bash -n tests/e2e/invoke_slice.sh -> ok. What I did not run: zig build test; zig build; the gate. The CI job "invoke-slice gate" on this pull request is the attestation and is cited in AFFIRMATION.adoc once it has run. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- tests/e2e/invoke_slice.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/e2e/invoke_slice.sh b/tests/e2e/invoke_slice.sh index 9b18872..27adb6c 100755 --- a/tests/e2e/invoke_slice.sh +++ b/tests/e2e/invoke_slice.sh @@ -17,7 +17,7 @@ set -euo pipefail cd "$(dirname "$0")/../.." ZIG_EXPECTED="$(awk '$1=="zig"{print $2}' .tool-versions)" -TROPECHECK_PIN="69221ad6bec0c9286cb5c917edfad281e7e0089e" +TROPECHECK_PIN="4ecba4f1862aec144ec940b1d8a93ddabd1cb591" fail() { echo "GATE FAIL: $*" >&2; exit 1; } From e2b247d43432f7f8a226771aaac9df59caf7b8ea Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:49:04 +0000 Subject: [PATCH 2/7] docs(affirmation): review-round accuracy fixes from #42 and the checker pin bump What was wrong (CodeRabbit's review of cb1cf5b on #42, posted twenty minutes before the merge and never answered): the evidence for the build claim named only `zig build test` while the gate also runs `zig build`; the TROPECHECK_BIN override was presented as the CI reproduction although CI runs the script bare and the override bypasses the pin; the toolchain row said the gate would reject mise.toml's `zig = "latest"` although the gate reads .tool-versions and `zig version`, never mise.toml; the introduction said every claim is tied to a command while one row is affirmed by reading; the schema citation did not resolve from this repository. What changed: both commands named; the CI reproduction is the bare script and the override is labelled a separate local check; the toolchain row says what the gate actually compares (issue #46 for the drift); the evidence rule admits a named source for by-reading claims; the schema is cited by URL at the gate's pinned revision with a note that it is cloned, not vendored. The pin rows now say 4ecba4f (bumped from 69221ad6, issue #44) and the probe run from the previous commit is recorded as a probe, not as the gate. The anchor's tested commit, timestamp and CI run still describe the 2026-10-27 attestation; they are updated by a follow-up commit once the gate has run on this change. What I ran: n/a (prose); the probe is described in the previous commit. What I did not run: zig; the gate. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- AFFIRMATION.adoc | 40 ++++++++++++++++++++++++++-------------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index 0a29d8a..862543c 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -12,9 +12,10 @@ toc::[] A short, dated, signed snapshot of what hyperpolymath can honestly and verifiably claim about *Vocarium* at one exact commit. Nothing here is marketing or a -promise; those live in the README. Every claim is tied to a command, and where a -command could not be run in the session that wrote this file it says so and names -the run that attests it instead. The anchor (<>) fixes commit, +promise; those live in the README. Every claim is tied to a command or, for a claim +affirmed by reading, to the named source files; where a command could not be run in +the session that wrote this file it says so and names the run that attests it +instead. The anchor (<>) fixes commit, time and toolchain. It is to be landed by a signed commit — the owner signs on landing. @@ -33,7 +34,8 @@ failing run, or a contradicting source. | The store engine `voc` (pure Zig, no C; ADR-0002) builds and its unit tests pass under the pinned Zig 0.16.0. | NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) -| `zig build test` (Zig 0.16.0, `.tool-versions`). The session that wrote this +| `zig build test`, then `zig build` (Zig 0.16.0, `.tool-versions`) — the gate +runs both before it uses `zig-out/bin/voc`. The session that wrote this file could not run Zig: ziglang.org and its mirrors were unreachable and a checksummed conda-forge 0.16.0 binary was obtained but not permitted to execute. CI runs it on pushes to `main`, pull requests and manual dispatch: @@ -47,20 +49,30 @@ stored trope yields opposite tropecheck verdicts under two use-models (`casual-note` → `p-sufficient`, `critical-paraphrase` → `p-insufficient` with the witness edge named); an unwarranted edge is refused at the store door. | NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) -| `TROPECHECK_BIN=/path/to/tropecheck-rs bash tests/e2e/invoke_slice.sh` (placeholder path) → expected -`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. -Same CI workflow (`./tests/e2e/invoke_slice.sh`), which hard-fails on toolchain -absence or skew. Note: without `TROPECHECK_BIN` the script builds the checker at -its own pin `69221ad6`; with it set, the pin is bypassed. The pin predates the -spec v0.2 consolidation and is to be bumped once Phase 0 lands upstream (issue -filed, not changed here). +| CI reproduction, exactly as `.github/workflows/vocarium-ci.yml` runs it: +`./tests/e2e/invoke_slice.sh` (no `TROPECHECK_BIN`) → expected final line +`GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. The +script hard-fails on toolchain absence or skew, clones trope-checker at its pin +`4ecba4f` (trope-checker `main` after Phase 0 landed there; bumped from +`69221ad6`, issue #44) and builds `tropecheck-rs` from it. A separate local check, +not the CI reproduction: `TROPECHECK_BIN=/path/to/tropecheck-rs bash +tests/e2e/invoke_slice.sh` (placeholder path) bypasses the pin and accepts any +executable. Probe run here for the pin bump (not the gate — Zig is still absent): +the IR that `src/store/emit.zig` writes for `examples/vocarium-ingest.jsonl`, +reconstructed by hand, was fed to `tropecheck-rs` built from `4ecba4f` and gave +`casual-note` → `p-sufficient` (exit 0) and `critical-paraphrase` → +`p-insufficient witness=e_paraphrase coord=fate.quality` (exit 1), the verdicts +the gate asserts; the same binary passes trope-checker's own conformance suite at +that revision. | The store format is append-only JSONL (one record per line, `"t"` one of `trope`, `edge`, `use_model`, `warrant`) replayed into in-memory indexes; the only external contract is Trope IR v0.2 over process I/O, verified by `tropecheck`. | affirmed (by reading) -| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema -at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary. +| `src/store/`, `docs/decisions/0002-pure-zig-wire-boundary.adoc`; the schema at +https://github.com/hyperpolymath/trope-checker/blob/4ecba4f1862aec144ec940b1d8a93ddabd1cb591/schemas/trope-ir.schema.json +(the gate's pinned revision; the gate clones it into `.gate-tools/trope-checker` +when `TROPECHECK_BIN` is unset — it is not vendored here) is the trust boundary. |=== == What we do NOT claim @@ -84,7 +96,7 @@ at `trope-checker/schemas/trope-ir.schema.json` is the trust boundary. | Affirmed base | 57944e6ad15067a29456096654e4f7dee44dc816 (`main` at the time; differs from the tested commit only in this file and the README, so the gate result carries over to it) | Landing commit | the signed commit that lands this snapshot on `main` (the file itself predates it as a template); after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA | Timestamp (UTC) | 2026-10-27T08:17:46Z (completion of the cited CI gate job) -| Toolchain | Zig 0.16.0 pinned in `.tool-versions`, which the gate enforces; `mise.toml` still says `zig = "latest"` — a drift the gate would reject, to be reconciled (issue). Checker for the gate: `tropecheck-rs` from trope-checker (script pin `69221ad6`; the session's binary was built from 44020f9). Zig was not executed in this session (see above). +| Toolchain | Zig 0.16.0 pinned in `.tool-versions`; the gate reads that file and compares it with `zig version`, so an environment in which `mise.toml`'s `zig = "latest"` resolves to anything else fails the gate (the gate does not read `mise.toml` itself; the drift is issue #46). Checker for the gate: `tropecheck-rs` built from trope-checker at the script pin `4ecba4f` (the probe binary in this session was built from the same revision; the 2026-10-27 session's was from 44020f9). Zig was not executed in either session (see above). | Affirmed by | Jonathan D.A. Jewell (owner signs on landing; written by the Phase 0 agent) |=== From 376d03a30c15056228d3725c5538719fa1657812 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:49:04 +0000 Subject: [PATCH 3/7] docs(readme): the M2 adapter is planned, not built What was wrong: the shared five-repo paragraph says vocarium and hermeneia "meet at the M2 StoreProvider adapter", which can read as if the adapter exists (review finding on #42). What changed: one sentence of Vocarium's own after the paragraph, saying the adapter is planned and unimplemented and what it will be (a Hermeneia-side Rust StoreProvider driving voc as a subprocess over the Trope IR v0.2 JSON contract). The shared paragraph itself is untouched so it stays verbatim across the five READMEs. What I ran: n/a (prose). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- README.adoc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.adoc b/README.adoc index aad9920..e67a3c1 100644 --- a/README.adoc +++ b/README.adoc @@ -165,6 +165,8 @@ Vocarium is an experimental database architecture for trope-aware, loss-aware, w Vocabulary track: trope-particularity-workbench → haec → trope-checker (verdict). Store/query track: haec → vocarium → hermeneia → trope-checker (verdict). trope-checker depends on nothing (HC-1); the workbench depends on nothing; vocarium and hermeneia meet at the M2 StoreProvider adapter (vocarium ADR-0002: wire, do not link). +The M2 adapter is planned, not built: a Hermeneia-side Rust `StoreProvider` that drives `voc` as a subprocess over the Trope IR v0.2 JSON contract (see `AFFIRMATION.adoc`, "What we do NOT claim"). The five-repo paragraph above is shared verbatim across the five READMEs; this sentence is Vocarium's own. + ## Relationship to other systems Vocarium is part of a wider language/database ecology: From 54a41c88e77a4e5832e19243cdcc98ab7fce4cb7 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:57:54 +0000 Subject: [PATCH 4/7] ci: point the standards reusable-workflow callers at metadatastician/standards@857ff09 (the repository was transferred) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit What was wrong: every workflow here that calls a hyperpolymath/standards reusable (.github/workflows/governance.yml .github/workflows/hypatia-scan.yml .github/workflows/mirror.yml .github/workflows/rust-ci.yml .github/workflows/scorecard.yml ) has failed before any job was created since 2026-10-26: `hyperpolymath/standards` was transferred to `metadatastician/standards` and GitHub Actions does not follow repository redirects for `jobs..uses` (run annotation: "error parsing called workflow ... workflow was not found"). Because the ruleset's only required status check, `scan / gitleaks`, is a job of the called secret-scanner workflow, no pull request in this repository could satisfy it. The owner has already made the same move in trope-checker (#107, #110), where the scanner has been green on main since 2026-10-31, and in vocarium's own secret-scanner.yml (#48). What changed: only the `uses:` lines — each caller now names metadatastician/standards/.github/workflows/@857ff096af11451841fb10488fed1438523973a1, the commit trope-checker main uses. Every input and secret those reusables declare at that commit is optional, so the callers' with/secrets blocks are left as they were. Nothing else in the files changes. What this does NOT fix (owner-only, repository settings): the Actions policy "Allow select actions and reusable workflows" must also permit `metadatastician/standards/.github/workflows/*@*`; until it does, these runs end in a startup failure that names that policy (as vocarium's re-pointed scanner does today). The re-point is necessary either way. What I ran: actionlint -shellcheck= -pyflakes= over the changed files -> clean. What I did not run: the workflows themselves; the runs on this branch are the test, and the `scan / gitleaks` job appearing is the discriminating signal. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- .github/workflows/governance.yml | 2 +- .github/workflows/hypatia-scan.yml | 2 +- .github/workflows/mirror.yml | 2 +- .github/workflows/rust-ci.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8f43d22..e60b4fb 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -19,4 +19,4 @@ permissions: jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/governance-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 97187a5..05785e9 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -28,4 +28,4 @@ permissions: jobs: scan: - uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 711656f..11cd06a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -14,5 +14,5 @@ permissions: contents: read jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 secrets: inherit diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 234e6b9..5f59a23 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -17,4 +17,4 @@ permissions: contents: read jobs: rust-ci: - uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@857ff096af11451841fb10488fed1438523973a1 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index cc0b6e2..e760c8f 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -17,7 +17,7 @@ permissions: jobs: scorecard: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a + uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@857ff096af11451841fb10488fed1438523973a1 # Reusable called-workflow permissions are CAPPED by the caller's grants; # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. From a54d99272af62e4a8eb5311108c6c3827ce9a205 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 22:58:22 +0000 Subject: [PATCH 5/7] docs(affirmation): cite the green gate run at the new pin; snapshot re-anchored to 2026-11-04 What was wrong: the snapshot's attestation rows still cited the 2026-10-27 CI run at the old checker pin. What changed: the two NOT RUN rows and the anchor cite CI run 41928746295, job "invoke-slice gate", success at 2026-11-04T22:52:47Z on commit 376d03a of this branch with TROPECHECK_PIN=4ecba4f; the title and timestamp move to that instant; "Commit (SHA) tested" is 376d03a and "Affirmed base" is main c9381f1; a "Previous snapshot" row keeps the 2026-10-27 anchor (tested 71c4374, run 40472451463, landed as 297bdd9, which GitHub reports as verified under its web-flow key on the owner's merge). The rows stay NOT RUN here: the attestation is CI's, not this session's. What I ran: nothing new locally (prose); the cited run is CI's. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- AFFIRMATION.adoc | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index 862543c..f0126ff 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -1,6 +1,6 @@ // SPDX-License-Identifier: CC-BY-SA-4.0 // SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= AFFIRMATION — Vocarium, as of 2026-10-27T08:17Z += AFFIRMATION — Vocarium, as of 2026-11-04T22:52Z :toc: macro :toclevels: 2 @@ -33,22 +33,23 @@ failing run, or a contradicting source. | The store engine `voc` (pure Zig, no C; ADR-0002) builds and its unit tests pass under the pinned Zig 0.16.0. -| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) +| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z) | `zig build test`, then `zig build` (Zig 0.16.0, `.tool-versions`) — the gate runs both before it uses `zig-out/bin/voc`. The session that wrote this file could not run Zig: ziglang.org and its mirrors were unreachable and a checksummed conda-forge 0.16.0 binary was obtained but not permitted to execute. CI runs it on pushes to `main`, pull requests and manual dispatch: `.github/workflows/vocarium-ci.yml` (mlugg/setup-zig pinned to 0.16.0). On this -branch, at commit 71c43744ca5304cc7c228c5d8273ef92be789a4e: job "invoke-slice gate" of -https://github.com/hyperpolymath/vocarium/actions/runs/40472451463 — success, -2026-10-27T08:17:46Z. +branch, at commit 376d03a (the checker pin already `4ecba4f`): job "invoke-slice +gate" of https://github.com/hyperpolymath/vocarium/actions/runs/41928746295 — +success, 2026-11-04T22:52:47Z. (The 2026-10-27 snapshot cited run 40472451463 on +71c4374 at the old pin.) | The M1 invoke slice holds end to end: the canonical fixture ingests; the same stored trope yields opposite tropecheck verdicts under two use-models (`casual-note` → `p-sufficient`, `critical-paraphrase` → `p-insufficient` with the witness edge named); an unwarranted edge is refused at the store door. -| NOT RUN here — attested by CI run 40472451463 on commit 71c4374 (success, 2026-10-27T08:17:46Z) +| NOT RUN here — attested by CI run 41928746295 on commit 376d03a (success, 2026-11-04T22:52:47Z) | CI reproduction, exactly as `.github/workflows/vocarium-ci.yml` runs it: `./tests/e2e/invoke_slice.sh` (no `TROPECHECK_BIN`) → expected final line `GATE PASS: invoke slice proven (use-relativity + warrant door + unit tests)`. The @@ -92,10 +93,11 @@ when `TROPECHECK_BIN` is unset — it is not vendored here) is the trust boundar |=== | Project | Vocarium | Repository | https://github.com/hyperpolymath/vocarium -| Commit (SHA) tested | 71c43744ca5304cc7c228c5d8273ef92be789a4e (this branch; the commit CI run 40472451463 ran on) -| Affirmed base | 57944e6ad15067a29456096654e4f7dee44dc816 (`main` at the time; differs from the tested commit only in this file and the README, so the gate result carries over to it) -| Landing commit | the signed commit that lands this snapshot on `main` (the file itself predates it as a template); after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA -| Timestamp (UTC) | 2026-10-27T08:17:46Z (completion of the cited CI gate job) +| Commit (SHA) tested | 376d03a (this branch; the commit CI run 41928746295 ran on, with the checker pin at `4ecba4f`) +| Affirmed base | c9381f10d180969ef343d9cde0179b829627d90d (`main` at the time; differs from the tested commit in `tests/e2e/invoke_slice.sh` (the pin), this file and the README only) +| Previous snapshot | 2026-10-27T08:17Z, tested commit 71c4374, CI run 40472451463, landed on `main` as 297bdd9 (squash of #42; GitHub reports the commit as verified, signed by GitHub's web-flow key on the owner's merge) +| Landing commit | the commit that lands this snapshot on `main`; after landing, `git log --first-parent --show-signature -1 main -- AFFIRMATION.adoc` selects it. A file cannot record its own commit's SHA +| Timestamp (UTC) | 2026-11-04T22:52:47Z (completion of the cited CI gate job) | Toolchain | Zig 0.16.0 pinned in `.tool-versions`; the gate reads that file and compares it with `zig version`, so an environment in which `mise.toml`'s `zig = "latest"` resolves to anything else fails the gate (the gate does not read `mise.toml` itself; the drift is issue #46). Checker for the gate: `tropecheck-rs` built from trope-checker at the script pin `4ecba4f` (the probe binary in this session was built from the same revision; the 2026-10-27 session's was from 44020f9). Zig was not executed in either session (see above). | Affirmed by | Jonathan D.A. Jewell (owner signs on landing; written by the Phase 0 agent) |=== From c8a25239444463e2ce947cb927fa6b3535c81e58 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 23:12:39 +0000 Subject: [PATCH 6/7] docs(affirmation): remove unsupported trope-checker conformance claim --- AFFIRMATION.adoc | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/AFFIRMATION.adoc b/AFFIRMATION.adoc index f0126ff..a10ae8e 100644 --- a/AFFIRMATION.adoc +++ b/AFFIRMATION.adoc @@ -63,8 +63,7 @@ the IR that `src/store/emit.zig` writes for `examples/vocarium-ingest.jsonl`, reconstructed by hand, was fed to `tropecheck-rs` built from `4ecba4f` and gave `casual-note` → `p-sufficient` (exit 0) and `critical-paraphrase` → `p-insufficient witness=e_paraphrase coord=fate.quality` (exit 1), the verdicts -the gate asserts; the same binary passes trope-checker's own conformance suite at -that revision. +the gate asserts. | The store format is append-only JSONL (one record per line, `"t"` one of `trope`, `edge`, `use_model`, `warrant`) replayed into in-memory indexes; the only external contract is Trope IR v0.2 over From fe17091ac40384da667ee6a86f11ecba953d3f8f Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 23:38:17 +0000 Subject: [PATCH 7/7] ci: pass the mirror secrets explicitly and grant actions: read to the scorecard job mirror.yml still said `secrets: inherit`; mirror-reusable.yml at 857ff09 declares ten named optional secrets and says in its header not to use inherit, so the caller now maps exactly those. scorecard.yml's job-level permissions block (which replaces the workflow-level one for that job) omitted `actions: read`, which the called scorecard job requests at 857ff09 for the Packaging check; a caller job that grants less than the called job requests is rejected at startup. Both now match trope-checker's callers on main at the same pin. Evidence: reusable headers at 857ff09; zizmor secrets-inherit (CodeRabbit on hermeneia #80, the same line here); SonarCloud's "C Security Rating on New Code" cleared on workbench #78 at fe3f743 after the identical mirror change and is the failing condition here. actionlint -shellcheck= -pyflakes= on both files: clean. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01J4QvDh3p24SCUjyM9HHT31 --- .github/workflows/mirror.yml | 12 +++++++++++- .github/workflows/scorecard.yml | 1 + 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 11cd06a..0b1b65b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -15,4 +15,14 @@ permissions: jobs: mirror: uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@857ff096af11451841fb10488fed1438523973a1 - secrets: inherit + secrets: + GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} + BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} + CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} + SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} + DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} + GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} + RADICLE_KEY: ${{ secrets.RADICLE_KEY }} + R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} + R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} + R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e760c8f..327892d 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -22,6 +22,7 @@ jobs: # without security-events: write here the scorecard SARIF upload fails with # startup_failure (hypatia WF018). id-token: write enables OIDC publish. permissions: + actions: read contents: read security-events: write id-token: write