You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
ci: repin standards to e064539 (clears Allowlist Preflight); render deploy template from init - #171
Covers governance, hypatia-scan, scorecard, secret-scanner, mirror, all four fork-governance.yml calls plus canon-ref, and dogfood-gate's push-only K9 lane.
Contracts checked: only hypatia-scan-reusable changed, by optional inputs, and no job asks for a permission its caller does not grant.
rust-ci stays on 412a703, which is green.
fork-governance.yml passes hypatia-advisory to the summary job, as standards' ADOPTION template now does.
actions.lock:
The standards record is re-keyed to e064539.
Its nested uses: set is unchanged at e064539, and every leaf record matches standards' own lock.
panel-clades/Justfile:
The render step moves to a private _render-deploy-k9 recipe, called by both init (which already fills the container placeholders) and container-init.
After rendering, it points container/0-AI-MANIFEST.a2ml at deploy.k9.ncl instead of the removed .in.
Verification (local, standards e064539)
Workflow checks:
Every workflow parses.
The duplicate-key and SPDX/permissions checks are clean.
check-actions-lock-gate.sh, validate-actions-lock.sh and update-actions-lock.sh --verify-local all pass.
Allowlist:check-allowed-actions.sh finds 0 of 24 uses: refs uncovered. On main this check is red.
Bring every tracked `*.k9.ncl` / `*.k9` file into line with the K9
contract v1.0.0 that standards' K9-DEED conformance lane enforces:
- 98 panel-clade configs: `K9!` magic line, SPDX header, and a
`pedigree` envelope (schema_version, component_type, security.leash
'Kennel, metadata.name/version/author, side_effects). The old top-level
name/version/magic_number/author/leash keys are folded into it.
Budgets.idr is unchanged (gen-budgets --check is current).
- 4 layout presets: `K9!` envelope with an inline 'Yard pedigree; the
preset is checked against pedigree-layout.ncl's contracts.
pedigree-layout.ncl exports its contracts by explicit binding (a bare
`{ Foo, }` field declares Foo without defining it) and PaneSizesSum100
uses std.contract.from_validator. database-design's `verisim_panel`
is renamed to the schema's `verisimdb_panel`.
- svc/k9 templates and the container deploy template are renamed to
`.k9.ncl.in` (templates are not instances, per the contract); the
setup-repo example is replaced by standards' canonical one, and the
references in the READMEs, manifests and TOPOLOGY are updated.
- generated/k9iser/*.k9 are untracked: .gitignore already ignores them.
Checked with standards' k9-validate.sh --strict --layer L2 at
1fdc61c: 106 pass, 1 routed (coordination.k9), 0 fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
hyperpolymath/standards moved to metadatastician/standards. Every caller
pinned under the old owner failed at startup with "workflow was not
found", because actions.lock recorded the old owner.
- Repin governance, hypatia-scan, scorecard, secret-scanner and mirror
to metadatastician/standards@1fdc61c (standards main), and rust-ci to
metadatastician/standards@412a703 (same commit, new owner).
- Add fork-governance.yml per standards' fork-governance ADOPTION.adoc:
the DEED, K9-DEED and Hypatia lanes plus one PR comment, all at the
same standards commit as canon-ref. DEED runs with
require-files: false, since PanLL has no .deed files yet (standards
#837).
- hypatia-scan.yml loses its pull_request trigger (ADOPTION §3);
fork-governance runs the Hypatia lane on PRs.
- dogfood-gate.yml drops the k9-ecosystem validate-action job, which
rejected the `K9!` envelope that contract v1.0.0 requires; the
K9-DEED lane replaces it.
- actions.lock: standards records re-keyed to metadatastician
(owner_id 297579217), nested uses recomputed over every called file at
1fdc61c, and records nothing references any more are pruned.
Verified with standards' check-actions-lock-gate.sh,
validate-actions-lock.sh and update-actions-lock.sh --verify-local at
1fdc61c.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
These are k9iser output, already ignored by .gitignore. The previous
commit meant to untrack them but the removal was dropped while the
change was split into commits, so the K9-DEED lane still scanned them
and failed (no SPDX header, not Nickel).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
Top-level permissions drop to contents: read; the job gets actions: read,
contents: read and security-events: write, which is what
hypatia-scan-reusable declares. pull-requests: write goes: the workflow
no longer runs on pull_request. Addresses the Scorecard Token-Permissions
alert on this file that fork-governance's Hypatia lane grades.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
…verage
Addresses three review findings on this PR:
- panel-clades/container/deploy.k9.ncl.in is now the v1.0.0-shaped
template ported from rsr-template-repo (K9! envelope, pedigree with
capability grant, side effects and a signature block), adapted to this
layout (container/, compose.toml). `just container-init` renders it to
container/deploy.k9.ncl once no placeholder is left, as rsr-template-repo
does; before, nothing produced the deploy.k9.ncl the docs use. Checked:
rendered with sample values via `just container-init`, it passes
k9-validate --strict --layer L2.
- template-hunt.k9.ncl.in grants net.fetch, fs.write and process.spawn,
which its allow_* flags request (K9-S007), and carries the Ed25519
presence block a Hunt component needs (K9-S009). A copy with its TODOs
filled now passes L2.
- dogfood-gate.yml runs the standards K9-DEED lane on pushes to
main/master, so a direct push is still checked; pull requests keep
running it once, in fork-governance.yml. actions.lock records the call.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
The presets now open with the K9! envelope, which the nickel CLI cannot
read. Document k9-validate.sh for conformance and evaluating the Nickel
body (tail -n +2, run from layouts/ so the relative import resolves) for
the pedigree-layout contracts. Checked: logic-and-proofs exports, and a
preset whose pane sizes do not sum to 100 is still rejected.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
#166 was squash-merged at 85e71b2; this branch carries the two review-fix
commits that landed after it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
# Conflicts:
# .github/workflows/actions.lock
# .github/workflows/dogfood-gate.yml
# panel-clades/container/README.adoc
# panel-clades/container/deploy.k9.ncl.in
Standards main now allows metadatastician/standards/.github/workflows/*@*
in its canonical Actions allowlist, so pinning to it clears the
governance Allowlist Preflight that has been red on main since the
owner transfer.
- Repin governance, hypatia-scan, scorecard, secret-scanner, mirror,
fork-governance (all four lanes and canon-ref) and dogfood-gate's push
K9 lane from 1fdc61c to e064539. Contracts checked: only
hypatia-scan-reusable changed, and only by optional inputs; no job asks
for a permission its caller does not grant. rust-ci stays on 412a703.
- fork-governance passes hypatia-advisory to the summary, as standards'
ADOPTION.adoc template now does.
- actions.lock: the standards record is re-keyed; its nested uses are
unchanged at e064539 and every leaf record matches standards' own lock.
- panel-clades/Justfile: the deploy-template render moves to a private
`_render-deploy-k9` recipe that both `init` and `container-init` call,
since `init` already fills the container placeholders. After rendering
it points container/0-AI-MANIFEST.a2ml at deploy.k9.ncl instead of the
removed .in file. (Codex findings on #167.)
Checked locally against standards e064539: all workflows parse; the
duplicate-key, SPDX/permissions, lock gate, lock validator,
verify-local and allowlist checks pass; K9 corpus 106 pass, 1 routed;
`just init` and `just container-init` with scripted answers both render a
deploy.k9.ncl that passes k9-validate --strict --layer L2 and rewrite the
manifest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
No actionable comments were generated in the recent review.
Summary
Summary by CodeRabbit
Chores
Updated the shared workflows used for conformance, governance, scanning, mirroring and scorecard checks.
Bug Fixes
Improved deployment component rendering during initialisation, including handling unresolved template tokens and existing output files.
Workflow files now reference a newer standards commit, and the fork-governance verdict job receives Hypatia’s advisory output. In panel-clades, init and container-init use a shared helper to check and render the K9 deploy template.
Reusable workflow references now use commit e064539116c2dcfdf282a4749dbd58c69961c7e6. The fork-governance verdict job also passes Hypatia’s advisory output as hypatia-advisory.
init calls _render-deploy-k9 after placeholder substitution, and container-init delegates rendering to it. The helper retains the template if placeholders remain or the output already exists. Otherwise, it renames the template and updates the manifest reference when the manifest exists.
hyperpolymath/panll#167: Adds the k9-conformance job and deploy-template rendering that this PR updates and extends.
Suggested reviewers:metadatastician
Merge Risk: Minimal · previous review e6af8
No merge-blocking issue is established. The workflow updates and shared deployment-template rendering appear ready to merge subject to normal checks.
Pre-merge checks: 5
Check name
Status
Explanation
Title check
The title clearly identifies both primary changes: repinning standards workflows and rendering the deploy template from init. It is specific and related to the changeset.
Description check
The description directly explains the workflow repinning, fork-governance input, lock updates, Justfile changes, verification results, and excluded work. It is clearly related to the changeset.
Docstring Coverage
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 88891918-24b2-4ad5-b9dc-60c687f68446
Commits
Reviewing files that changed from the base of the PR and between aa596c8 and e6af8eb.
Files ignored due to path filters: 1
.github/workflows/actions.lock is excluded by !**/*.lock
Files selected for processing: 8
.github/workflows/dogfood-gate.yml
.github/workflows/fork-governance.yml
.github/workflows/governance.yml
.github/workflows/hypatia-scan.yml
.github/workflows/mirror.yml
.github/workflows/scorecard.yml
.github/workflows/secret-scanner.yml
panel-clades/Justfile
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Source excerpt: **Rule:** Do not introduce Tauri references or dependencies — Gossamer is the desktop backend Source excerpt: **Rule:** All state management uses TEA (Model -> Msg -> Update -> View) — no MVC, Redux, hooks, or other patterns...
On 2026-11-02 at 09:56 the same workflows all started and ran on #169, with the same pins as main. So the repository's Actions policy (Settings → Actions → General → "Allow … selected actions and reusable workflows") was narrowed some time after that. It now seems to allow only GitHub-owned and hyperpolymath/* actions.
The Actions-settings API and the run pages are not reachable from the session that opened this PR. Confirm on any of these runs, for example the Build Validation run. The fix is to re-allow, in the repository or account policy:
metadatastician/standards/.github/workflows/*@* — standards ADOPTION §1.1 requires this for cross-owner reusables;
the third-party actions the lockfile pins: dtolnay/rust-toolchain, goto-bus-stop/setup-zig, swatinem/rust-cache, haskell-actions/setup, peter-evans/repository-dispatch.
standards' scripts/set-allowed-actions.sh applies the canonical list.
This PR's own changes pass every gate locally against standards e064539: lock gate, lock validator, --verify-local, allowlist check, duplicate keys, SPDX/permissions, K9 corpus, and both init paths. I have not re-run anything, because a startup failure re-runs identically until the policy changes.
_render-deploy-k9 rewrote only container/0-AI-MANIFEST.a2ml. The root
0-AI-MANIFEST.a2ml inventory also lists deploy.k9.ncl.in (line 102),
so after rendering it named a file that no longer exists. Rewrite both
manifests, and drop the "(template)" note from the inventory line.
(Codex finding on #171.)
Checked: `just init` and `just container-init` with scripted answers both
render container/deploy.k9.ncl (passes k9-validate --strict --layer L2)
and leave both manifests naming deploy.k9.ncl.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCQeL169ZnUirUVaDXQLA3
SonarCloud Code Analysis fails with "C Security Rating on New Code", the same as on #167. I still can't see which issue.
sonarcloud.io is blocked from the session driving this PR, and neither the check run nor the bot comment names the rule. #167 and this PR share two changed files: .github/workflows/dogfood-gate.yml (the push-only K9 job calling metadatastician/standards/.github/workflows/k9-conformance.yml) and panel-clades/Justfile. #166 passed SonarCloud, and it touched neither of those in that way. So the finding is most likely in one of them, but I won't change code on a guess.
Once sonarcloud.io is allowed in this environment's network settings, or the rule and file:line are posted here, I'll fix it on this PR. I haven't re-run the check, because the analysis is deterministic.
Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Why
governance / Allowlist Preflighthas been red onmainsince ci: repin standards to metadatastician, adopt fork-governance, migrate K9 to contract v1.0.0 #166. Standards' canonical Actions allowlist has since gainedmetadatastician/standards/.github/workflows/*@*, so pinning to current standardsmain(e064539) clears it.What
1fdc61c→e064539:fork-governance.ymlcalls pluscanon-ref, and dogfood-gate's push-only K9 lane.hypatia-scan-reusablechanged, by optional inputs, and no job asks for a permission its caller does not grant.rust-cistays on412a703, which is green.fork-governance.ymlpasseshypatia-advisoryto the summary job, as standards' ADOPTION template now does.actions.lock:e064539.uses:set is unchanged ate064539, and every leaf record matches standards' own lock.panel-clades/Justfile:_render-deploy-k9recipe, called by bothinit(which already fills the container placeholders) andcontainer-init.container/0-AI-MANIFEST.a2mlatdeploy.k9.nclinstead of the removed.in.Verification (local, standards
e064539)check-actions-lock-gate.sh,validate-actions-lock.shandupdate-actions-lock.sh --verify-localall pass.check-allowed-actions.shfinds 0 of 24uses:refs uncovered. Onmainthis check is red.gen-budgets.sh --checkreports current.just initandjust container-init, run with scripted answers, both rendercontainer/deploy.k9.ncland rewrite the manifest.k9-validate.sh --strict --layer L2.Not in this PR
fleetreport-back job that ADOPTION now describes. panll has no.gitbot-fleet/enrolment.json, so it would only add empty rows.Generated by Claude Code