fix(k9-svc): evict the implementation, keep the specification (#491) - #650
Merged
Conversation
The removal half of the carve-out. The additive half landed as k9-ecosystem#33 (1,005 files, +57,632/-2,923); this deletes what it received, leaving k9-svc/ as what it was always meant to be — the K9 specification, security analysis and adoption guidance. 1,891 -> 41 files. Every one of the 1,857 deletions was checked against the live k9-ecosystem tree (2,328 blobs, untruncated) before removal: 1,856 have a verified counterpart there. The single exception, scripts/deploy-site.sh, is carried across in k9-ecosystem#34 — this PR must not merge before that one. Load-bearing changes made in the SAME commit, because each would break main on its own: * .machine_readable/scorecards/k9-svc.scorecard.a2ml — all 8 executable `check =` commands pointed at moved paths. They are now status = "manual-only" with the checks removed and provenance kept in `system =`. This scorecard is executed by build-scorecards.sh --check --strict --verify, which IS the required status check "Registry + topology in sync"; leaving the checks in place would have failed every subsequent PR to main, repo-wide. Verified: 0 executable checks reference a moved path; the gate now exits 0 with 74 grounded pass, 0 broken, 0 unrunnable, 0 self-asserted. * Justfile — 6 hardcoded `cd k9-svc/bindings/rust && cargo ...` refs in build/test/fmt/lint/clean removed. 0 residual. * scripts/build-registry.sh + regenerated REGISTRY.a2ml / TOPOLOGY.adoc / COMPLIANCE-DASHBOARD.adoc — the k9-svc row's description now says what the module is rather than what it used to contain. * .hypatia-baseline.json — 18 entries whose target paths no longer exist pruned (122 -> 104). The three register.ncl repeats were kept: they are the same path under three different rule modules, not duplicates. * GUIDE.adoc / TESTING.adoc / README.adoc — 28 relative links into examples/ rewritten to absolute k9-ecosystem URLs. The three image:: embeds were deliberately NOT touched: `:imagesdir: assets` is set at GUIDE.adoc:8 and assets/ stays, so rewriting them to assets/foo.svg would have produced assets/assets/foo.svg. Deliberately NOT done: the "K9-SVC contractile validation" job is not renamed. Despite the name it is repo-wide (Mustfile structural checks, zero k9-svc paths) and is a required status check; renaming it without an atomic ruleset update would block every PR to the repository. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Important Review skippedToo many files! This PR contains 1834 files, which is 1734 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (33)
📒 Files selected for processing (1834)
You can disable this status message by setting the |
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
This PR successfully executes the planned eviction of implementation code from the k9-svc/ module, transitioning it into a specification-only host. The build system, scorecard gates, and security baselines have been adjusted to accommodate the deletion of over 1,800 files. Codacy analysis indicates the changes are technically up to standards, although there is no coverage data for this specification-heavy PR.
A critical risk identified is the merge order dependency: this PR must not be merged until k9-ecosystem#34 is landed to ensure the site publishing path is preserved. Additionally, while the documentation links were updated to absolute URLs, the example shell commands are now broken because the referenced CLI tools (e.g., nickel, file) do not support remote URLs, and the local Justfile recipes they depend on have been removed. These documentation gaps should be addressed to ensure the specification remains usable.
About this PR
- Merge order dependency: This PR must not be merged before k9-ecosystem#34 to ensure
deploy-site.shis preserved in the upstream repository. - Security Debt Visibility: The 18 security debt entries pruned from
.hypatia-baseline.jsonare currently unscanned in the destinationk9-ecosystemrepository, creating a temporary visibility gap for those vulnerabilities.
Test suggestions
- Verify that k9-svc scorecard checks are de-activated to prevent 'Registry + topology in sync' job failure.
- Confirm Justfile build/test tasks for the monorepo no longer attempt to access the deleted Rust bindings.
- Validate that documentation links to examples correctly point to absolute URLs in the k9-ecosystem repo.
- Verify that the security scanner baseline no longer references deleted files like lsp/src/main.rs.
- Check that the generated registry and topology metadata describe k9-svc as a specification module.
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| ---- | ||
| # Check a single component | ||
| just leash-level examples/deploy.k9.ncl | ||
| just leash-level https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl |
There was a problem hiding this comment.
🔴 HIGH RISK
The shell command examples and just recipes are now non-functional. Standard tools like nickel, file, and xdg-mime generally require local file paths rather than HTTPS URLs. Furthermore, the local scripts ./must, ./k9-scan, and the k9-svc/Justfile have been removed. Update the documentation to show how to use these tools with a local clone of the k9-ecosystem repository or provide alternative instructions.
| status = "pass" | ||
| system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: test.sh 'Example Components' section (checks `head -1 examples/hello.k9 | grep K9!`) and mime/k9.xml, mime/k9.magic magic-byte definitions; run in CI job 'test' and 'mime' in .github/workflows/ci.yml." | ||
| status = "manual-only" | ||
| evidence = "/home/user/standards/k9-svc/test.sh lines ~128-219 assert hello.k9, k9.xml and k9.magic all carry the K9! magic; examples/hello.k9 exists on disk and CI job `test`/`mime` in ci.yml executes test.sh and xmllint/file checks on push and PR." |
There was a problem hiding this comment.
🟡 MEDIUM RISK
The evidence fields reference files that have been evicted from this repository (e.g., test.sh, must, leash.ncl). These references should be updated to point to the canonical location in the k9-ecosystem repository or updated to reflect their historical status to avoid contradiction with the new module description.
| * **Self-validation** — The component typechecks itself before deployment. | ||
|
|
||
| See: `examples/container-deploy.k9.ncl` for the complete implementation. | ||
| See: `https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/container-deploy.k9.ncl` for the complete implementation. |
There was a problem hiding this comment.
⚪ LOW RISK
Nitpick: Detected an unbalanced backtick before the URL.
`Registry + topology in sync` was failing on this branch AND on main (6cb237c, 17:44) before this PR existed — it is not a regression here, but it blocks the merge, so it is fixed here. Root cause, and it is a trap worth recording: `source_hash` is computed from `git ls-files -s <home>` — the git INDEX, not the working tree. So the generator has an undocumented ordering constraint: regenerate -> stage gives a DIFFERENT answer than stage -> regenerate Regenerating before `git add` records hashes describing the pre-change index. That is what happened here (the k9-svc hash still described all 1,891 files) and it is also why main carried 16 stale spec hashes: doc edits were merged with the registry regenerated before staging. Regenerating after staging brings all of them back in sync: OK: registry + topology are in sync with the file tree. (exit 0) build-scorecards.sh --check --strict --verify (exit 0) Verified deterministic: two consecutive regenerations are byte-identical. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The only conflict was .machine_readable/REGISTRY.a2ml, a GENERATED file. It was NOT hand-merged. Both sides were discarded and the file was regenerated from scratch after staging, because source_hash is computed from `git ls-files -s` (the index) and so must be produced post-stage. Gates re-verified after the merge: build-registry.sh --check exit 0 build-scorecards.sh --check --strict --verify exit 0 conflict markers in tracked files none Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #491. The removal half of the carve-out — the additive half landed as k9-ecosystem#33 (1,005 files, +57,632/−2,923).
k9-svc/goes 1,891 → 41 files, leaving it as what it was always meant to be: the K9 specification, security analysis and adoption guidance.⛔ Merge order
Do not merge before k9-ecosystem#34. Of the 1,857 deletions here, exactly one —
k9-svc/scripts/deploy-site.sh— has no counterpart ink9-ecosystem. #34 carries it across. Merging this first would leave the site content there with no publishing path.Deletions were verified, not assumed
Every deleted path was checked against the live
k9-ecosystemtree (2,328 blobs,truncated: false) before removal — matching on trailing path suffix so renamed top-level dirs (bindings/rust→rs/,actions/validate→validate-action/) still resolve.This was the explicit hazard flagged in the issue thread:
hyperpolymath/k9-validate-actiondoes not exist (404), so the issue’s instruction to deleteactions/validate/as "exists upstream" would have destroyed 290 files with no original.The four changes that had to be in this same commit
Each would break
mainon its own.1.
k9-svc.scorecard.a2ml— the repo-wide gate. All 8 executablecheck =commands pointed at moved paths. That scorecard is run bybuild-scorecards.sh --check --strict --verify, which is the required status checkRegistry + topology in sync. Left alone, every subsequent PR to main would fail, repo-wide. The 8 rows are nowstatus = "manual-only"with checks removed and provenance preserved insystem =.(The one
stale-failisrhodium-standard-repositories/M2, pre-existing and unrelated.)2.
Justfile— 6 hardcodedcd k9-svc/bindings/rust && cargo …refs inbuild/test/fmt/lint/clean. 0 residual. Every contributor’sjust buildwould have broken the momentbindings/moved.3.
scripts/build-registry.sh+ regeneratedREGISTRY.a2ml/TOPOLOGY.adoc/COMPLIANCE-DASHBOARD.adoc— thek9-svcrow now describes what the module is rather than what it used to contain.4.
.hypatia-baseline.json— 18 entries whose targets no longer exist, pruned (122 → 104). The threeregister.nclrepeats were kept: same path under three different rule modules (code_safety/ncl_http_url,code_scanning_alerts/CSA001,CSA003), not duplicates.Docs: links rewritten, embeds deliberately left alone
28 relative links into
examples/acrossGUIDE.adoc/TESTING.adoc/README.adocnow point at absolutek9-ecosystemURLs.The three
image::embeds were not touched, contrary to the issue’s step 6.:imagesdir: assetsis set atGUIDE.adoc:8andassets/stays, soimage::triad-diagram.svg[]was never a relative path to break — and the naive "fix" would have yieldedassets/assets/triad-diagram.svg. All three SVGs confirmed present.Deliberately not done
The
K9-SVC contractile validationjob is not renamed. Despite the name it is repo-wide (Mustfile structural checks; zerok9-svcpaths) and is a required status check — renaming it without an atomic ruleset update would block every PR to the repository.Known follow-up
k9-ecosystemhas no hypatia workflow and no.hypatia-baseline.json, so the 18 debt entries pruned here arrive there unscanned rather than baselined. Not a regression introduced by this PR — the destination simply never had the scanner — but worth a tracking issue.🤖 Generated with Claude Code