From 569f6b482d2d50ab0debe889228bf74e6c4dc662 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Sat, 29 Aug 2026 09:28:10 +0000 Subject: [PATCH 1/2] Fix CodeRabbit issues in PR #45 --- .machine_readable/bot_directives/methodology.a2ml | 2 +- container/Containerfile | 2 +- container/manifest.toml | 2 +- docs/status/TEST-NEEDS.adoc | 5 +++-- 4 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.machine_readable/bot_directives/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml index dd96ba0..92f1662 100644 --- a/.machine_readable/bot_directives/methodology.a2ml +++ b/.machine_readable/bot_directives/methodology.a2ml @@ -9,7 +9,7 @@ [metadata] version = "1.0.0" -last-updated = "2026-07-27" +last-updated = "2026-08-28" spec = "https://github.com/hyperpolymath/standards/blob/main/agentic-a2ml/docs/ADR-002-methodology-layer.adoc" # ============================================================================ diff --git a/container/Containerfile b/container/Containerfile index f7afd83..2f68ec3 100644 --- a/container/Containerfile +++ b/container/Containerfile @@ -70,7 +70,7 @@ FROM cgr.dev/chainguard/wolfi-base:latest # OCI image labels (compatible with cerro-torre .ctp bundle metadata) LABEL org.opencontainers.image.title="recon-silly-ation" \ - org.opencontainers.image.description="Experimental cross-document consistency reconciler; proposed ForthWall engine not yet implemented or proved." \ + org.opencontainers.image.description="Experimental cross-document consistency reconciler; proposed bounded, capability-restricted ForthWall engine not yet implemented or proved." \ org.opencontainers.image.url="https://github.com/hyperpolymath/recon-silly-ation" \ org.opencontainers.image.source="https://github.com/hyperpolymath/recon-silly-ation" \ org.opencontainers.image.vendor="hyperpolymath" \ diff --git a/container/manifest.toml b/container/manifest.toml index 55d1926..90404d5 100644 --- a/container/manifest.toml +++ b/container/manifest.toml @@ -9,7 +9,7 @@ name = "recon-silly-ation" version = "0.1.0" revision = 1 -summary = "Experimental cross-document consistency reconciler; proposed ForthWall engine not yet implemented or proved." +summary = "Experimental cross-document consistency reconciler; proposed bounded, capability-restricted ForthWall engine not yet implemented or proved." description = """ recon-silly-ation — containerised service packaged as a verified cerro-torre .ctp bundle with Ed25519 signing and full provenance diff --git a/docs/status/TEST-NEEDS.adoc b/docs/status/TEST-NEEDS.adoc index 8fcea7f..ae9b046 100644 --- a/docs/status/TEST-NEEDS.adoc +++ b/docs/status/TEST-NEEDS.adoc @@ -38,7 +38,7 @@ machinery has now been removed as no longer applicable: == Capability Evidence Required -The project purpose is broader than its proposed Forth VM. Each capability +The project purpose is broader than its proposed bounded ForthWall VM. Each capability must have independently reproducible evidence before it may be marked complete or operational: @@ -72,5 +72,6 @@ human review. * [ ] Give `integration_test.zig` real test bodies against the FFI surface. * [ ] Wire `tests/e2e.sh` to a real ForthWall reconcile round-trip via the WASM - build, with bounded capabilities and independent result verification. + build, with bounded capabilities and independent verification of every + applied edit and the final document state. * [ ] Integrate `just test` / `just e2e` / `just aspect` into CI. From 245a0072701292c1d0a2242b67004cf5ed2799ae Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 30 Aug 2026 11:09:20 +0100 Subject: [PATCH 2/2] fix(ci): fix k9 syntax and allowlist --- .github/workflows/boj-build.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/estate-rules.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/guix-nix-policy.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/label-triage.yml | 1 + .github/workflows/labels.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/openssf-compliance.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/quality.yml | 1 + .github/workflows/release.yml | 1 + .github/workflows/rhodibot.yml | 1 + .github/workflows/runtime-policy.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/security-policy.yml | 1 + .github/workflows/static-analysis-gate.yml | 1 + .github/workflows/wellknown-enforcement.yml | 1 + .github/workflows/workflow-linter.yml | 1 + .machine_readable/bot_directives/methodology.a2ml | 2 +- .machine_readable/root-allow.txt | 3 +++ coordination.k9 | 5 +++++ session/custom-checks.k9 | 5 +++++ 30 files changed, 40 insertions(+), 1 deletion(-) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 54e7baa..b17b689 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 3e580d2..4b0cffb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index e7e6485..a07e6ff 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index 68e7c74..07d6b87 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/estate-rules.yml b/.github/workflows/estate-rules.yml index 26d3f86..d880f81 100644 --- a/.github/workflows/estate-rules.yml +++ b/.github/workflows/estate-rules.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index fa4227f..19245cc 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/guix-nix-policy.yml b/.github/workflows/guix-nix-policy.yml index 4b3e1a7..6da8c9a 100644 --- a/.github/workflows/guix-nix-policy.yml +++ b/.github/workflows/guix-nix-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 6074d95..d917112 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 0a03f83..40e1706 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml index 9886e92..814a192 100644 --- a/.github/workflows/label-triage.yml +++ b/.github/workflows/label-triage.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Label Triage diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index c80b676..83ab941 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 name: Labels diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 1da8669..747919b 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml index 5abe965..e61eeba 100644 --- a/.github/workflows/openssf-compliance.yml +++ b/.github/workflows/openssf-compliance.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index f80f5cb..3a0efe1 100644 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4f733f4..587979f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index a2f8a08..2784855 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 66a32c9..366925d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml index afb3563..f334136 100644 --- a/.github/workflows/rhodibot.yml +++ b/.github/workflows/rhodibot.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/runtime-policy.yml b/.github/workflows/runtime-policy.yml index c67f7eb..7d67d18 100644 --- a/.github/workflows/runtime-policy.yml +++ b/.github/workflows/runtime-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index ffeb735..519373d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e8d642a..07b9b44 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 48ca9cc..1be37a2 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml index 6644bae..0793bec 100644 --- a/.github/workflows/security-policy.yml +++ b/.github/workflows/security-policy.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml index e2b8373..e12ff1b 100644 --- a/.github/workflows/static-analysis-gate.yml +++ b/.github/workflows/static-analysis-gate.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/wellknown-enforcement.yml b/.github/workflows/wellknown-enforcement.yml index 9e4af3a..a3904ec 100644 --- a/.github/workflows/wellknown-enforcement.yml +++ b/.github/workflows/wellknown-enforcement.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 3b09bea..66ca7fb 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -1,3 +1,4 @@ +# This workflow is managed by gh actions-lock. # SPDX-License-Identifier: MPL-2.0 # This workflow is managed by gh actions-lock. # This workflow is managed by gh actions-lock. diff --git a/.machine_readable/bot_directives/methodology.a2ml b/.machine_readable/bot_directives/methodology.a2ml index 92f1662..f7fc303 100644 --- a/.machine_readable/bot_directives/methodology.a2ml +++ b/.machine_readable/bot_directives/methodology.a2ml @@ -9,7 +9,7 @@ [metadata] version = "1.0.0" -last-updated = "2026-08-28" +last-updated = "2026-08-29" spec = "https://github.com/hyperpolymath/standards/blob/main/agentic-a2ml/docs/ADR-002-methodology-layer.adoc" # ============================================================================ diff --git a/.machine_readable/root-allow.txt b/.machine_readable/root-allow.txt index 995f2db..4b86195 100644 --- a/.machine_readable/root-allow.txt +++ b/.machine_readable/root-allow.txt @@ -82,3 +82,6 @@ flake.nix # TOLERATED, NOT BLESSED. Nix was retired estate-wide # never written for it. Read from the estate-rules gate's own output. .githooks/ # Top-level component directory of this project. REQUIRES_INITIALISATION.md # Project documentation. +CHANGELOG.adoc +CONTRIBUTING.adoc +SECURITY.adoc diff --git a/coordination.k9 b/coordination.k9 index ba31125..094539f 100644 --- a/coordination.k9 +++ b/coordination.k9 @@ -1,3 +1,8 @@ +K9! +# SPDX-License-Identifier: MIT +pedigree = { + name = "recon-silly-ation" +} # Thin coordination bindings for central session-management standards session_management: diff --git a/session/custom-checks.k9 b/session/custom-checks.k9 index bd932fa..7c7df83 100644 --- a/session/custom-checks.k9 +++ b/session/custom-checks.k9 @@ -1,3 +1,8 @@ +K9! +# SPDX-License-Identifier: MIT +pedigree = { + name = "recon-silly-ation" +} # Local repository session checks (thin policy layer) version: "0.1"