Skip to content

fix(ci): recover standards validation gates - #618

Merged
hyperpolymath merged 3 commits into
mainfrom
codex/standards-ci-recovery
Aug 24, 2026
Merged

fix(ci): recover standards validation gates#618
hyperpolymath merged 3 commits into
mainfrom
codex/standards-ci-recovery

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • make Actions lock refresh and verification transactional while preserving inline SHA pins
  • remove duplicate workflow keys and repair reusable-workflow/local-action expressions
  • bound root Deno CI to explicitly owned source and test scopes
  • repair governance, self-test, language-guide, and canonical-name regressions
  • add a narrow Hypatia SD004 authority-conflict baseline expiring 2026-09-30 and tracked by CI: governance + hypatia-scan red on main — 104 Hypatia findings vs empty baseline #399
  • regenerate the machine-readable registry deterministically

Validation

Notes

The Hypatia suppression is intentionally temporary. It records an authority conflict rather than migrating normative .machine_readable/6a2/*.a2ml files ahead of the generators and canonical documents that still consume them.

The RSR Bronze result remains informational and includes expectations, such as retired Nix packaging, that require policy reconciliation rather than mechanical reintroduction.

@gitar-bot

gitar-bot Bot commented Aug 24, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@sonarqubecloud

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit f451a2b into main Aug 24, 2026
21 of 29 checks passed
@hyperpolymath
hyperpolymath deleted the codex/standards-ci-recovery branch August 24, 2026 11:42
hyperpolymath added a commit that referenced this pull request Aug 24, 2026
## Summary

Follow-up to #618, which was squash-merged while its post-conflict
checks were still failing.

- regenerate registry from staged blobs so CI sees current source hashes
- align Deno detection with the post-Deno root configuration contract
- install scorecard verification dependencies in self-test
- annotate justified Agda axioms for trusted-base enforcement
- repin the nonexistent reusable-workflow SHA and refresh lock coverage
- baseline the narrow cross-repository proof-template SD022
false-positive class

## Validation

- `just validate` passes
- all 23 discovered `scripts/tests/*-test.sh` scripts pass locally
- Mustfile: 16 pass, 1 manual, 0 blocking failures
- scorecards: 82 grounded passes, 0 broken/unrunnable
- 39/39 workflows duplicate-key clean and lockfile-complete
- trusted-base: all 13 escape hatches documented

Ratchet-exception: add narrow, expiring baselines for the 6a2 authority
conflict and cross-repository proof-template path false positives;
tracked by standards#399.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant