docs: affirm state at 14386f3e (docs/AFFIRMATION.adoc)

[hyperpolymath]

Summary

Adds docs/AFFIRMATION.adoc (the rsr-template profile A "evidential" affirmation), anchored to main at 14386f3e61cdfd324853cca3a36f5c37192d59d7 and verified 2026-10-07T10:20:02Z–10:22:34Z. boj-server didn't have one before.

What the file records:

• Verified by running it at the anchor:
  • 68 unit tests pass: 31 under node and bun, plus 11 and 26 more under bun.
  • The node and bun boot smokes pass.
  • A clean stdio handshake exposes 68 tools (45 boj_* + 23 coord_*), 6 prompts and 7 resources, with serverInfo 0.4.7. That matches the README exactly.
• CI evidence for the anchor SHA (read, not re-run): Idris2 type-check, trusted-base audit, readme-derive and gitleaks are green. The Idris2, trusted-base and Zig rows were upgraded to local runs after merge, in docs(affirmation): affirm Idris2 0.8.0, trusted base and Zig break by local run #352.
• Problems the file states openly:
  • The Justfile doesn't parse (guix-shell redefined, from refactor(root): move root artefacts to their canonical locations #327), so no just recipe runs.
  • ffi/zig/src/bench.zig:27 uses Io.Clock.monotonic, which Zig 0.16 removed. That breaks both E2E jobs and the Bench job.
  • Seven CI checks are red but not required, and all seven were already red on the parent.
  • npm latest 0.4.7 is behind main: it serves 65/6/6 and reports serverInfo 0.4.0.
  • The version strings disagree: Justfile 0.4.6, package.json 0.5.0.
  • The start script uses deno.
  • A2ML files are still present, and there's no _chora.deed.
  • Three Dependabot alerts are open in the Rust tray/coord-tui lockfiles.

Merge timing: the template treats the affirmation as valid only if its anchor is the parent of the commit that lands it. Please squash-merge this before main moves past 14386f3e. If main moves first, the file reads as a draft and I'll re-anchor it.

Type of change

Documentation only (a new doc file).

📌 New pins

Head SHA: 5c0eb80cc26b7d10b456155d54db17fc686cc189 (merged as 3de2f6ff). This PR adds or changes no pins: no action uses:, actions.lock, lockfile or container digest changes.

Changes

• New: docs/AFFIRMATION.adoc.

RSR Quality Checklist

Required

• Tests pass. The bridge suites were run at the anchor, with results in the file. This PR changes no code.
• Code is formatted. N/A: no code changed.
• Linter is clean. N/A: no code changed. Note that just lint can't run at all on main (the Justfile parse error), as the file records.
• No banned language patterns. A single AsciiDoc file.
• No unsafe blocks without // SAFETY: comments. N/A: no code changed.
• No banned functions. N/A: no code changed.
• SPDX license headers present. The new file has CC-BY-SA-4.0 and SPDX-FileCopyrightText.
• No secrets, credentials, or .env files included.

As Applicable

• .machine_readable/* updated. N/A: A2ML is retired (D308), and the file records the leftover A2ML instead of editing it (D313).
• Documentation updated: this is a new doc.
• TOPOLOGY.md updated. N/A: architecture didn't change.
• CHANGELOG updated. N/A: no release.
• New dependencies reviewed. N/A: no dependencies added.
• ABI/FFI changes validated. N/A: ABI and FFI untouched. The file only reports the existing Zig bench compile failure.

Testing

• asciidoctor --failure-level=WARN docs/AFFIRMATION.adoc returned rc 0, and the boj_*, coord_* and {error, hint} passthroughs render correctly.
• Every "affirmed" row lists the exact command and its output. The Reproduce it yourself section in the file repeats them in order.
• CI rows come from gh api …/commits/14386f3e…/check-runs --paginate (47 success, 10 skipped, 7 failure). The failures were confirmed identical on the parent 0e700c9d.

Deferred non-required reds (pre-existing on main, not caused by this PR): governance / UUID v7 conformance and SonarQube → #338. The Zig 0.16 Io.Clock.monotonic break (both E2E jobs and Bench), deploy, and Dependabot → #338. I'm adding those to #338 in a comment with this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P56iYjCwHmbRyfFrpyJzTC

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b227af5d-53b0-4167-827a-e8dc16489758

📥 Commits

Reviewing files that changed from the base of the PR and between 14386f3 and 5c0eb80.

📒 Files selected for processing (1)

• docs/AFFIRMATION.adoc

 ___________________________________________
< Sending Skynet back to the drawing board. >
 -------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 113 issues detected

Severity	Count
🔴 Critical	10
🟠 High	20
🟡 Medium	83

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sonarqube"
  },
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "deploy"
  },
  {
    "reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
    "type": "secret_action_without_presence_gate",
    "file": ".github/workflows/instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_secret_presence_gate"
  },
  {
    "reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
    "type": "codeql_missing_actions_language",
    "file": ".github/workflows/codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "fix_recipe": "add_codeql_actions_language"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 46,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 32,
    "reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/container-publish.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence