detect: the Nickel probe matches RSR template boilerplate, silencing the zero-denominator refusal on 9 of 24 sampled repos

[hyperpolymath]

The finding

The detect job's Nickel probe matches RSR template boilerplate, so the
zero-denominator refusal — the pipeline's central anti-vacuity guard — does not
fire on 9 of 24 sampled repositories it was built for.

ci-pipeline.yml's detect step counts *.ncl into TOTAL. Every repo seeded
from the RSR template carries the same six-file k9 Nickel set, so TOTAL
is non-zero for a reason that has nothing to do with the repository's ecosystem.
The nickel job then runs, lints six template config files, and the pipeline
reports success while the repo's actual language is never examined.

The workflow's own comment states the standard this violates:

Folding them into TOTAL would lift it above zero and SILENCE the
zero-denominator refusal below while nothing whatsoever had been checked.
That is a vacuous gate, and a vacuous gate is worse than an honest blind
spot: the blind spot reports nothing, the vacuous gate reports success.

That reasoning is correct and is exactly what happens here — the boilerplate
does the lifting instead of the unsupported probes.

Evidence

Deterministic sample: every 5th live repo whose primary language is one the
pipeline detects but cannot check (Julia, Elixir, Idris, Zig, Ada, Agda,
Gleam, Lean, Isabelle, Ruby, PHP) — 24 repos of 134 such. Probes replicated
exactly from detect, run against real default-branch trees via
gh api repos/<r>/git/trees/<default>?recursive=1, not a local grep.

verdict	repos
RUNS-ncl-only (denominator is Nickel alone)	14
RUNS-real	6
REFUSE-unsupported	3
REFUSE-none	1

Of the 14, 9 have zero repo-owned Nickel — every matched .ncl is template:

hyperpolymath/candy-crash                 template_ncl=6   own_ncl=0  unsupported_markers=2
hyperpolymath/Cliometrics.jl              template_ncl=12  own_ncl=0  unsupported_markers=3
hyperpolymath/fireflag                    template_ncl=6   own_ncl=0  unsupported_markers=1
hyperpolymath/julia-ecosystem             template_ncl=6   own_ncl=0  unsupported_markers=62
hyperpolymath/ochrance                    template_ncl=6   own_ncl=0  unsupported_markers=7
hyperpolymath/polyglot-formalisms-gleam   template_ncl=6   own_ncl=0  unsupported_markers=1
hyperpolymath/resource-record-fluctuator  template_ncl=7   own_ncl=0  unsupported_markers=1
hyperpolymath/SMTLib.jl                   template_ncl=6   own_ncl=0  unsupported_markers=2
hyperpolymath/volumod                     template_ncl=6   own_ncl=0  unsupported_markers=2

The worst case is hyperpolymath/julia-ecosystem: it would lint 6
template files, report success, and leave 62 Julia markers unexamined. The
refusal added in #970 never fires.

The boilerplate is identical across unrelated repos — same six basenames, only
the directory prefix differs:

julia-ecosystem          .machine_readable/self-validating/{template-hunt,template-kennel,template-yard}.k9.ncl + examples/{ci-config,project-metadata,setup-repo}.k9.ncl
SMTLib.jl                .machine_readable/self-validating/  ... identical six
polyglot-formalisms-gleam contractiles/k9/                   ... identical six

Across the sample: 134 .ncl files in 19 repos, of which only 13 (9.7%) are
repo-owned; in 12 of the 19, every single .ncl is template.

Why this is not cosmetic

This is the failure mode #970 was written to prevent, reintroduced through a
different door. #970 correctly refused to fold unsupported markers into
TOTAL; but TOTAL was already being lifted by files that are equally not a
check of the repository. The guard is intact and simply never reached.

It also silently mis-scopes the planned rollout: these 9 repos would receive a
blocking caller and go green, when the honest outcome is a
detected-unsupported refusal and a ledger entry.

Cure options (owner's call — not implemented here)

1. Exclude the template set from the probe (.machine_readable/,
   contractiles/, *.k9.ncl) — narrow, matches the existing
   manifests-not-extensions doctrine.
2. Count only .ncl outside those paths toward TOTAL, still linting all of
   them if the job runs.
3. Treat "denominator is template-only" as equivalent to zero.

Acceptance criteria

• On hyperpolymath/julia-ecosystem, the pipeline REFUSES with the
  detected-unsupported message instead of running the nickel job.
• Re-running the 24-repo sample census yields 0 repos in the
  own_ncl=0 && nonncl=0 && unsupported>0 class (currently 9).
• Positive control — the cure must not zero out real Nickel repos:
  hyperpolymath/laminar (3 repo-owned .ncl of 4) still reports
  has_nickel=true and still runs the nickel job. Likewise
  hyperpolymath/zerotier-k8s-link (4 own of 11).
• The step-summary denominator distinguishes template from repo-owned
  .ncl, so the number printed cannot be mistaken for a real one.

Scope note

Found while censusing candidates for the #967 adoption rollout. This blocks
seeding the adoption ledger by detection, because the detector currently
reports "checkable" for repos where nothing meaningful is checked — the ledger
would record the wrong debt.

Refs #967, #970, #956.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ji1bq3TypfycfUPAR7hSxR

[hyperpolymath]

Confirmed by observation — the 5-repo dry-run wave has reported

The pilot ruled in #967 has now run. All five callers were pinned to the same
ci-pipeline.yml SHA (2eb9bb19) so the verdicts are comparable.

repo	detect	verdict	class
cicd-squabbler	SUCCESS	Nickel FAILURE	ran, went red
tropical-types	FAILURE	Detected Julia (1), Lean (2), Isabelle (1)	refuse-unsupported
AcceleratorGate.jl	FAILURE	Detected Julia (1)	refuse-unsupported
modshells	FAILURE	Detected Ada (3)	refuse-unsupported
ddraig-ssg	FAILURE	denominator = 0	refuse-none

Both refusal branches fire correctly and are distinguishable in the log. The
zero-denominator refusal was reached exactly once.

This issue is confirmed, and the consequence is worse than stated

cicd-squabbler is the only subject whose pipeline ran. It went red — and
100% of the failing files are the shipped k9 template set, none of its own
source (run 35726516904, job pipeline / Nickel, runner 1002435839):

.machine_readable/arrival-pack/arrival-pack.ncl   Bad format
.machine_readable/arrival-pack/claude-md.k9.ncl   Bad format + typecheck
.machine_readable/coaptation/coapt.ncl            Bad format
.machine_readable/coaptation/coapt.k9.ncl         Bad format + typecheck

So the template does not merely lift TOTAL and silence the zero-denominator
refusal, as this issue predicted. It lifts the denominator and then fails the
gate it just enabled — converting a repo that owns no Nickel work of its own
into a red one, on boilerplate.

Two distinct defects, both verified at source in rsr-template-repo:

1. The .ncl files are committed unformatted — they fail
   nickel format --check, the read-only form this pipeline is required to use.
2. arrival-pack.ncl imports claude-md-data.json, which does not exist —
   GET rsr-template-repo/contents/.machine_readable/arrival-pack/claude-md-data.json
   returns 404 in the template itself, not only in the seeded copy. Every
   repo seeded from it inherits a .ncl that cannot typecheck.

Consequence for the ledger

.machine_readable/pipeline-allow.txt is not being seeded from this wave.
The one earned red records template debt, not repo debt; ledgering
cicd-squabbler would file the defect against the wrong party and let the real
cause spread silently to every seeded repo. Fix the template; re-run; then seed
from whatever is still red.

Two traps this wave surfaced, recorded so they are not re-learned

• A merge racing its own run manufactures a red. The same run's
  pipeline / Rust / Detect Cargo.toml failed with
  fatal: couldn't find remote ref refs/pull/103/merge — PR Wave 0: regenerate canonical flake×Guix×container inventory worklist #103 was merged at
  12:29:24Z while the job was still running and GitHub deleted the merge ref
  underneath it. That red is an artefact and was not booked.
• A locally replicated detect under-reports. My replication scored
  modshells TOT=0 uns=0; the real run found Ada (3). Replicate to predict,
  dispatch to know — never select a subject on a replicated detector's verdict.

[hyperpolymath]

Correction to the comment above — defect 2 is the pipeline's, not the template's

I attributed both Nickel failures to the template. Re-checked with nickel
1.17.0 locally against the template's current revision; one attribution was
wrong and the split matters, because the two defects have different owners.

Defect 1 — unformatted template. Confirmed at source.

$ nickel format --check arrival-pack.ncl   # rsr-template-repo @ HEAD
error: format error
 = Bad format: "arrival-pack.ncl", run `nickel format ...` to fix
rc=1

Reproduces on the template's own current file, not merely on the seeded copy.
This one is a genuine template bug and stands as written.

Defect 2 — NOT a missing file. The pipeline typechecks a generated input.
claude-md-data.json is a build artifact and is correctly uncommitted. The
template ships the generator:

.machine_readable/arrival-pack/extract.sh
.machine_readable/arrival-pack/generate.sh

and generate.sh lines 16–17 are explicit:

bash "$AP/extract.sh" .../descriptiles > "$AP/claude-md-data.json"
nickel export --format raw "$AP/arrival-pack.ncl" > "$AP/.region.tmp"

The JSON is produced immediately before it is consumed. arrival-pack.ncl is
correct by design; it is simply not standalone-typecheckable.

So the red belongs to ci-pipeline.yml's Nickel job, which does:

mapfile -d '' FILES < <(git ls-files -z -- '*.ncl')
... nickel typecheck "$f"

— i.e. it typechecks every tracked .ncl with no notion that some are
projections over generated inputs. Any repo carrying a generator-backed .ncl
will go red on this regardless of its own correctness. That is a false red,
and by the doctrine in this repo a gate that fails for a reason the repo cannot
fix is as misleading as one that passes vacuously.

Revised split:

defect	owner	kind
.ncl committed unformatted	rsr-template-repo	real, fix the template
nickel typecheck on generated-input .ncl	ci-pipeline.yml Nickel job	false red, fix the gate

Neither is cicd-squabbler's debt, so the no-seed decision is unchanged — and
now better founded: of its two Nickel failure modes, one is a template bug and
the other is a pipeline bug.

Suggested cure for the gate: skip typecheck for files whose imports cannot be
resolved from the tree alone, or honour a declared exclusion (e.g. run the
sibling generate.sh first, or exclude paths a *.k9.ncl/generator manifest
names). Formatting should still be checked on all of them.