Skip to content

fix(ci): Phase-2 fleet submission must not fail the security gate - #4

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-scan-phase2-resync
May 16, 2026
Merged

fix(ci): Phase-2 fleet submission must not fail the security gate#4
hyperpolymath merged 1 commit into
mainfrom
fix/hypatia-scan-phase2-resync

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented May 16, 2026

Copy link
Copy Markdown
Owner

Layer-1 propagation of hyperpolymath/hypatia#252.

This repo carries its own copy of .github/workflows/hypatia-scan.yml.
The "Submit findings to gitbot-fleet (Phase 2)" step hard-failed the
job (exit 127) for any commit with ≥1 finding — it clones gitbot-fleet
and execs scripts/submit-finding.sh, which no longer exists on
gitbot-fleet's default branch. That is the estate-wide "Hypatia
Neurosymbolic Analysis fails regardless of content" symptom.

Phase 2 is the collaborative learning side-channel, not the security
gate (the gate is the separate baseline-aware critical/high step, which
is untouched). Fix mirrors the canonical workflow:

  • continue-on-error: true on the Phase-2 step.
  • Self-healing body: non-fatal clone, probe known submit-script paths,
    skip with ::warning:: if absent or non-zero.

Surgical: only the Phase-2 step changed; every other step preserved.
Security enforcement is unchanged.

Refs hyperpolymath/hypatia#252

🤖 Generated with Claude Code

@hyperpolymath @claude
fix(ci): Phase-2 fleet submission must not fail the security gate
9fd9d03 
Layer-1 propagation of hyperpolymath/hypatia#252. This repo's own copy
of hypatia-scan.yml hard-failed (exit 127) for any commit with >=1
finding: the "Submit findings to gitbot-fleet (Phase 2)" step cloned
gitbot-fleet and exec'd scripts/submit-finding.sh, which no longer
exists on gitbot-fleet's default branch.

Phase 2 is the collaborative LEARNING side-channel, not the security
gate. Fix: continue-on-error + self-healing body (non-fatal clone,
probe known script paths, graceful ::warning:: skip). Security
enforcement (the baseline-aware critical/high step) is unchanged.

Refs hyperpolymath/hypatia#252

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@hyperpolymath
hyperpolymath merged commit 03fdd93 into main May 16, 2026
1 of 21 checks passed
@hyperpolymath
hyperpolymath deleted the fix/hypatia-scan-phase2-resync branch May 16, 2026 13:01
@hyperpolymath hyperpolymath mentioned this pull request Jun 14, 2026
Merged
hyperpolymath added a commit that referenced this pull request Jun 14, 2026
@hyperpolymath @claude
chore(hygiene): SPDX headers, stale links, katagoria invariant + merg…
05f8cfc 
…e main forward (#50)

## Deep checkpoint — safe hygiene fixes only

Draft PR from a read-only-first deep checkpoint of `nextgen-typing`.
**Only clearly-safe, low-risk fixes are included.** Everything ambiguous
(template-instantiation, OQ-001 identity, CI/workflow breakage) is left
to the maintainer and surfaced in the findings report instead. No
CI/workflow YAML edited, no architectural changes, no deletions.

### Branch reconciliation
This branch's earlier checkpoint commit (`2248113`, a 2026-06-05 6a2
STATE refresh) was **fully superseded** by work that landed on `main`
since — the 2026-06-12 estate-standardization and the 2026-06-14
governance/placeholder sweep. Left as-is it would have *reverted* those
improvements (e.g. stripped ADRs from `META.a2ml`, dropped the
echo-types ECOSYSTEM entry, rolled `last-updated` back to 2026-06-05). I
merged `main` forward and resolved every `.machine_readable/6a2/*`
conflict in favour of main's newer content, so the branch contributes
**only** the new hygiene fixes vs main.

### Fixes in this PR (11 files)

**SPDX headers (MPL-2.0) added** to 7 files that lacked them
(banned-language scan was otherwise clean):
- `session/dispatch.sh`, `session/local-hooks.sh`,
`scripts/invariant-path.sh`,
`.machine_readable/scripts/forge/git-cleanup.sh` (inserted after the
shebang)
- `.editorconfig` — also corrects its stale `RSR-template-repo`
self-identifier to `nextgen-typing`
- `.machine_readable/6a2/0-AI-MANIFEST.a2ml`,
`.machine_readable/6a2/anchor/0-AI-MANIFEST.a2ml` (matching the sibling
6a2 STATE/META header convention)

**Broken internal links fixed** (target exists under a different name):
- `GOVERNANCE.adoc`, `MAINTAINERS.adoc`: `CONTRIBUTING.adoc` →
`CONTRIBUTING.md`
- `docs/governance/CRG-CRITERIA.adoc`: `READINESS.adoc` →
`../../READINESS.md`

**Factual correction:**
- `0-AI-MANIFEST.a2ml` invariant #4 said *"katagoria does not exist
yet"*, contradicting `EXPLAINME.adoc`, `ROADMAP.adoc` (marks creation
`[x]` done with landed research artefacts) and
`6a2/{ECOSYSTEM,META}.a2ml` (all record katagoria created 2026-04-11,
active). Corrected the agent-bootstrap manifest to match the five
concurring sources.

### Deliberately NOT changed (flagged for maintainer)
- ~57 files still carrying `{{OWNER}}/{{AUTHOR}}/{{SERVICE_NAME}}/...`
template tokens — bulk `just init` instantiation, gated on **OQ-001**
(docs-only monorepo vs RSR proof scaffold) and already tracked by issues
#35–#37, #42. Filling these is an architectural action, not a safe
one-off; some of the `.github/` set is also being worked on a parallel
branch.
- 2 workflow files (`scorecard.yml`, `secret-scanner.yml`) carry `SPDX:
PMPL-1.0` instead of MPL-2.0 — left untouched per the "no workflow YAML"
guardrail; `rhodibot.yml` hints PMPL-in-dotfiles may be intentional
policy, so this needs a maintainer call.
- Pre-existing CI breakage (reusable-wrapper / scaffold failures)
tracked by **#32** — not touched.

See the session findings report for the full audit (branches, rot,
standards divergences, CI, notes→issues, human-decision items).

https://claude.ai/code/session_01BwV2DWsjkBiNP3oscimMLV

---
_Generated by [Claude
Code](https://claude.ai/code/session_01BwV2DWsjkBiNP3oscimMLV)_

---------

Co-authored-by: Claude <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request Oct 5, 2026
@hyperpolymath
docs(type-connections): register the Secret Types family (nextgen-typ…
5fbf101 
…ing#118)

Adds the Secret Types row to the shared type-family map, derived from the
reviewed and merged Secret Types source change: secret-types PR #4 (merged
2026-10-04, owner confirmation 2026-10-04, rulings D153/D154 recorded in its
docs/secret-types.adoc and ADR-0004). The row wording is the owner-prepared
text attached to that change, not a paraphrase of README text.

- docs/TYPE-CONNECTIONS.adoc: sixth family row (verbatim prepared wording),
  a Where-things-belong entry, a project entry point, and a dated provenance
  note recording that the family is specification-stage and that no
  connection obligation is asserted for it.
- docs/images/type-connections.dot + .svg: Secret Types node with no edges
  (registration only); map date moved to October 2026. The SVG was
  regenerated with the just type-map recipe (dot -Tsvg plus the SPDX lines);
  rendering used Graphviz 16.1.0 (wasm) because no native Graphviz is
  installable in this sandbox, so owners with Graphviz may re-run
  `just type-map` to normalise the generated bytes.
- .machine_readable/bot_directives/placement.a2ml: routing rule for
  confidentiality labels / information-flow control -> secret-types, matching
  the rule every other registered family has.

Checks run: scripts/check-coordination-boundary.sh PASS;
scripts/check-pipeline-drift.sh PASS; placement.a2ml parses as TOML;
invisible-character scan clean on all touched files; table-structure lint
PASS. No asciidoctor exists in this sandbox; CI is the render authority.

Refs: nextgen-typing#118 (secret-types registration checklist item),
secret-types#2.
@hyperpolymath hyperpolymath mentioned this pull request Oct 5, 2026
Merged
9 of 11 tasks
hyperpolymath added a commit that referenced this pull request Oct 5, 2026
@hyperpolymath
docs(type-connections): register the Secret Types family (nextgen-typ…
579c320 
…ing#118) (#124)

## Summary

Registers **Secret Types** in the shared type-family map
(`docs/TYPE-CONNECTIONS.adoc`), completing the *register* step of
nextgen-typing#118's secret-types item ("mint + define + register"). The
row is **not** invented or paraphrased: it is the owner-prepared wording
attached to the reviewed/merged Secret Types source change —
`hyperpolymath/secret-types` PR #4 (commit `906e110f`, merged
2026-10-04T09:07:42Z, owner confirmation 2026-10-04, rulings D153/D154
in `docs/secret-types.adoc` + ADR-0004) — relayed in the 2026-10-04
handoff comment on that PR ("Prepared cross-repo handoff updates …
Proposed row for `TYPE-CONNECTIONS.adoc` … owner wording wins"). No
`TYPE-FAMILY-MAP-ROW.adoc` file exists anywhere in the org (checked by
tree walk + code search on 2026-10-05); that handoff comment is the
canonical prepared row text, and it matches the canonical scope
statement's question and boundary.

This does **not** close #118: the occupancy-types map patch, its `just
type-map` rebuild, and the choreographic-types reviewer item remain open
(audit below).

## Changes

- `docs/TYPE-CONNECTIONS.adoc`
- "What each family means": sixth family row for [Secret
Types](https://github.com/hyperpolymath/secret-types), verbatim
owner-prepared wording (question: which value flows a confidentiality
label permits; boundary: a label is not cryptography and not an
epistemic standpoint; baseline declassifies nothing; no consumer
selected as of 2026-10-04).
- "Where things belong": `secret-types` bullet — specification-stage, no
`Secret` type / IFC calculus / declassification rule / noninterference
theorem yet, **no connection obligation asserted**.
- "Primary project entry points": Secret Types README and scope
statement.
- "Sources and review boundary": dated provenance note (row added
2026-10-05 from secret-types PR #4; specification-stage caveats).
  - Intro: five → six research families; image alt text updated.
- `docs/images/type-connections.dot` — `secret` node added to the
research rank, **no edges** (registration only; no connection has been
proposed, so none is drawn). Map date → October 2026.
- `docs/images/type-connections.svg` — regenerated with the documented
`just type-map` recipe (`dot -Tsvg` + the two SPDX `sed` lines).
**Renderer note:** no native Graphviz is installable in this sandbox (no
distro mirrors); rendering used real Graphviz 16.1.0 via wasm on the
updated `.dot`. Owners with local Graphviz may re-run `just type-map` to
normalise the generated bytes.
- `.machine_readable/bot_directives/placement.a2ml` — routing rule
`confidentiality labels / information-flow control (secret types) →
secret-types`, matching the rule every other registered family already
has; `last-updated` → 2026-10-05.

## RSR Quality Checklist

### Required

- [x] Tests pass (`just test` or equivalent) — docs-only change; the
repo's runnable gates were executed directly (see Testing)
- [x] Code is formatted — AsciiDoc wrapped to the file's existing line
width
- [x] Linter is clean — invisible-character scan clean on all four
touched files
- [x] No banned language patterns — docs + TOML only
- [x] No `unsafe` blocks — n/a
- [x] No banned functions — n/a
- [x] SPDX license headers present on all new/modified source files —
`.dot`/`.adoc`/`.a2ml` headers untouched and intact; SVG SPDX lines
re-inserted by the recipe
- [x] No secrets, credentials, or `.env` files included

### As Applicable

- [ ] `.machine_readable/STATE.a2ml` updated — not changed: no
project-state change (map content change is tracked in #118, and
placement.a2ml carries its own `last-updated`)
- [x] Documentation updated for user-facing changes
- [ ] `CHANGELOG` — left alone deliberately; map receipt history is
recorded in TYPE-CONNECTIONS itself per repo practice (happy to add an
entry if maintainers prefer)

## Testing

- `scripts/check-coordination-boundary.sh` — **PASS** ("Coordination
boundary intact: docs + cross-project proofs only")
- `scripts/check-pipeline-drift.sh .` — **PASS** (no pipeline drift;
date-sync check unaffected by placement.a2ml's own `last-updated`)
- `placement.a2ml` parses as TOML (16 routing rules; new rule present)
- Table-structure lint of `TYPE-CONNECTIONS.adoc`: family table now
header + 6 rows × 3 cells; glossary and connection tables unchanged
- Invisible/zero-width character scan on all four touched files — clean
- `.dot` re-parsed and laid out by real Graphviz (wasm build) — node
positions verified numerically; Secret Types renders in the research
rank beside Residual Evidence and Choreographic, no edges
- **Not run here** (recorded, not claimed): `asciidoctor` render and
native `just type-map` — no Ruby/Graphviz in this sandbox; CI is the
render authority

## nextgen-typing#118 checklist audit (evidence checked 2026-10-05)

| Item | Evidence | Proposed status |
|---|---|---|
| Map patch above lands (occupancy row + glossary + connection rows +
where-things-belong + naming note) | Not landed: `main` (`70df154`) has
no occupancy content in `TYPE-CONNECTIONS.adoc`; no map PR since #120
(2026-09-30). RULING D188 (absolute-zero#175, 2026-09-30) approved the
OND residue-list rename and "the two map rows" in substance, but nothing
has landed. Owner wording in #118 is the source. | stays **open** |
| `type-connections.dot` + SVG rebuilt (`just type-map`) | Not done for
the occupancy patch (no occupancy node at `main`). This PR rebuilds
dot+SVG for the Secret Types registration only. | stays **open**
(occupancy rebuild pending item 1) |
| occupancy-types README/glossary reciprocal links | Verified:
occupancy-types commit `1004e496` "docs: type-family map cross-links
(nextgen-typing TYPE-CONNECTIONS)"; README links the map (checked
2026-10-05). | already **[x]**, still accurate |
| kategoria issue | Filed: kategoria#76 (2026-09-27T16:59:39Z, open, 0
comments). Link never edited into #118's body. | tick **[x]** (filed) +
edit link in |
| typell issue | Filed: typell#62 (2026-09-27T16:59:40Z, open, 0
comments). | tick **[x]** (filed) + edit link in |
| absolute-zero issue | Filed: absolute-zero#175 (2026-09-27T16:59:41Z,
open); RULING D188 (2026-09-30) answers the residue-list rename and
approves the two map rows. | tick **[x]** (filed) + edit link in |
| januskey issue | Filed: januskey#137 (2026-09-27T16:59:42Z, open);
RULING D147 + RULING D204 (2026-09-30, also on #118) answer the
formal-home question (NW-1: one filesystem-reversibility model via
absolute-zero's abstract CNO interface + valence-shell). Issue stays
open in januskey for its own cross-link work. | tick **[x]** (filed) +
edit link in |
| secret-types issue (mint + define + register) | Filed: secret-types#2
(2026-09-27T16:59:43Z, open). Mint + define landed via secret-types PR
#4 (merged 2026-10-04): canonical scope statement, real README,
ADR-0004. Register = **this PR**. #2 stays open for the `just repo-init`
scaffolding sweep ("minted in scope, not in scaffolding"). | tick
**[x]** on merge of this PR |
| choreographic-types: reviewer for the Occupancy→Choreographic row |
Not started: choreographic-types#15 open, 0 comments; zero issues/PRs in
choreographic-types mention occupancy (org search 2026-10-05). Also
blocked on item 1 (row not landed). | stays **open** |

Related, outside the checklist: #115 (TYPE-CONNECTIONS receipts /
Echo→Residual + Epistemic→Residual acceptance criteria) remains open —
untouched by this change. The stale premise in #118 gap 2 ("un-minted,
README still `{{PROJECT_NAME}}`") is superseded by secret-types PR #4;
the owner-prepared replacement text is in the PR #4 handoff comment.

## Prepared update for nextgen-typing#118 — posting blocked by
credentials

This session's token **cannot write issues** (the 2026-10-04 session
recorded `403 Resource not accessible by integration` /
`X-Accepted-Github-Permissions: issues=write`; re-verified from this
session — see below). The prepared comment and body edits are therefore
included here verbatim for anyone with issue-write access:

<details>
<summary>Prepared comment for #118 (not posted)</summary>

**Secret Types registered in the type-family map** (2026-10-05) —
registration PR: <this PR>

The reviewed/merged Secret Types source change is secret-types PR #4
(merged 2026-10-04, owner confirmation 2026-10-04, D153/D154): canonical
scope statement `docs/secret-types.adoc`, real README, ADR-0004. The map
row uses the owner-prepared wording from the PR #4 handoff comment
verbatim.

Landed in the PR: the "What each family means" row; a `secret-types`
"Where things belong" entry; an entry-point link; a dated provenance
note; the `secret` node in `type-connections.dot` with **no edges** (no
connection obligation is asserted — the specification is stage-only: no
`Secret` type, IFC calculus, declassification rule or noninterference
theorem exists yet); the SVG rebuilt by the `just type-map` recipe; and
a `placement.a2ml` routing rule.

Checklist updates in this edit: the five per-repo issues are ticked as
*filed* with links (they were all filed 2026-09-27, ~50s after this
issue, but their links were never edited in); the secret-types item is
ticked (mint + define via secret-types#4; register via the linked PR).
**Still open here:** the occupancy-types map patch (this issue's body is
the source; RULING D188 already approves the OND rows in substance), the
`just type-map` rebuild for the occupancy patch, and the
choreographic-types reviewer for Occupancy→Choreographic
(choreographic-types#15 is the separate overclaim problem; the echo
loss-grade reconciliation stays open in the map). Gap 2's "un-minted"
premise is superseded by secret-types PR #4 (replacement wording in the
PR #4 handoff comment).

This issue stays **open**: registration of one family does not discharge
the remaining estate-wide work.

</details>

<details>
<summary>Prepared body edits for #118 (not applied)</summary>

1. **Gap 2** — replace with the owner-prepared paragraph from the
secret-types#4 handoff comment (2026-10-04), beginning "Owner
confirmation, 2026-10-04: the standalone `secret-types` repository is
the home of the confidentiality-label / information-flow work…", ending
"…minted in scope, not in scaffolding — tracked in secret-types#2."
2. **Proposed patch section** — append the Secret Types row (same
verbatim three cells as landed in this PR).
3. **Checklist** —
- `- [x] kategoria issue (taxonomy non-conflation + reciprocal link) —
filed: kategoria#76 (open there)`
- `- [x] typell issue (reciprocal link + vocabulary alignment) — filed:
typell#62 (open there)`
- `- [x] absolute-zero issue (residue-list collision + proposed OND
connection rows) — filed: absolute-zero#175; RULING D188 (2026-09-30)
approves rename + rows`
- `- [x] januskey issue (cross-link to CNO pillar or IS-NOT) — filed:
januskey#137; formal-home question answered by RULING D204 (NW-1)`
- `- [x] secret-types issue (mint + define + register) — filed:
secret-types#2; mint + define via secret-types#4 (merged 2026-10-04);
register via <this PR> (scaffolding sweep still open in secret-types#2)`
- items 1, 2 (occupancy map patch + its `just type-map` rebuild) and the
choreographic reviewer item stay `- [ ]`.

</details>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath