fix(hooks): remove two dead-format gates that deadlocked every commit - #798
Merged
Merged
Conversation
standards could not accept ANY commit through its own pre-commit hook. Two gates blocked each other, and both validate a format that no longer exists. The registry drift guard demanded every commit stage .machine_readable/REGISTRY.a2ml -- a generated, TOML-shaped artefact, i.e. a specimen of the record dialect the owner ruled SUPERSEDED on 2026-09-08. Staging it then tripped the "A2ML manifests" gate, because validate-a2ml.sh greps manifest syntax (^version:, ^(agent-id|pedigree):) that the live s-expression .deed grammar does not have. Measured: validate-a2ml.sh passes 0 of 222 tracked .a2ml files in this repo. Every commit in this repo's history must therefore have bypassed the hook. Repairing the regex is not the cure. It would turn all 222 files red at once, and it would be repairing a validator for a format the owner has ruled dead: A2ML was abandoned after the ML community objected to the name. .deed and .k9 are the live formats. Note the dates. REGISTRY.a2ml and scripts/build-registry.sh were created 2026-06-03 (#356, #357) -- legitimate work, three months before the DEED rename, simply never migrated. But .githooks/validate-a2ml.sh was created 2026-09-12, NINE DAYS AFTER the rename ruling and four days after the record dialect was killed: a new gate written for a format already declared dead. No hook in this repo knows .deed exists (pre-commit a2ml=4 / deed=0). Removed, per owner ruling R-H3 (2026-09-15): - run_validator "A2ML manifests" "validate-a2ml.sh" "staged" - the registry drift guard block Kept deliberately: - the K9 contracts gate. K9 is live. - registry drift coverage, which CI still enforces at .github/workflows/registry-verify.yml:56 (build-registry.sh --check). - REGISTRY.a2ml itself, byte-for-byte (owner ruling R-H4). It is a GENERATED artefact, so reshaping scripts/build-registry.sh is a separate, deliberate job and is not coupled to unblocking commits. A .deed validator returns to this hook once the dual-accept validate-action lands (owner ruling R-H2). Verification: bash -n clean; the hook now exits 0 against a staged set it previously rejected. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
📝 SummarySummary by CodeRabbit
WalkthroughThe local hooks no longer run A2ML validation. The pre-commit hook also no longer checks registry drift. Registry verification remains in CI, and the hooks document the planned ChangesLocal validation gates
Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Suggested reviewers: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the hooks at dawn Comment |
The deadlock had a second limb. Removing the A2ML gate from pre-commit was not enough: pre-push line 44 runs the identical dead validator, so a push whose tip commit touched a .a2ml file was still rejected. Found the hard way -- a push whose only change was regenerating .machine_readable/REGISTRY.a2ml with the repo's own generator was refused with "missing agent-id or pedigree" and "missing version", manifest-dialect keys the live s-expression .deed grammar does not have. Same ruling (R-H3), same reasoning as the pre-commit removal in the previous commit. The K9 gate stays: K9 is live. Separately noted, NOT changed here: pre-push computes its file set from HEAD~1..HEAD, so a multi-commit push validates only the TIP commit. That is a latent fake-gate and deserves its own fix. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx
This was referenced Sep 15, 2026
|
hyperpolymath
added a commit
that referenced
this pull request
Sep 15, 2026
…, refresh registry (#799) Three commits, each one file, each independently reviewable. ### 1. `fix(hooks)` — validate-spdx staged mode gets the filter its scan mode has `validate-spdx.sh` scan mode filters by extension; **staged mode did not**. So no commit touching `.github/workflows/actions.lock` could pass pre-commit — the lockfile is not a source file and carries no SPDX header by design. Instance 15 of the estate's recurring trap: *a guard asking a different question than its consumer.* Ships `scripts/tests/validate-spdx-test.sh` covering both modes, including the lockfile case that motivated it. ### 2. `fix(workflows)` — resync `actions.lock` after the codeql-action bump Dependabot bumped codeql-action in the workflow files; the lockfile was not resynced, so it named a ref the workflows no longer used. Six lines, **hand-edited**: `cdf488f5…` → `b96794f0…` (the three `codeql-action` refs in the `workflows:` stanzas, plus the `dependencies:` block key, `ref:` and `commit:`). `owner_id` / `repo_id` unchanged. `ref:` stays a bare SHA per the lock regime. > **Why by hand.** `gh actions-lock` *fix mode* was measured to rewrite **16** `.yml` > files (**42** with `--no-narrow`), de-pinning correct SHAs back to mutable tags and > inventing invalid local action refs — straight into `sha_pinning_required` and startup > death. Only `--no-fix --json` is safe to read. **Verification:** `stale` findings **3 → 0** (re-measured on this branch); gate rc 1 → 0; `git diff origin/main..HEAD -- '.github/workflows/*.yml'` is **empty** — zero `.yml` bytes touched. *(The 75 `sha-as-ref` findings the tool also reports are pre-existing and doctrinal: the tool prefers a tag, the estate ruleset mandates a SHA. Not addressed here.)* ### 3. `chore(registry)` — refresh three stale `source_hash` lines Not cosmetic: `build-registry.sh --check` **fails at `main`'s HEAD**, so `registry-verify.yml` is red before this branch touches anything. Regenerated with the generator, not hand-edited; the diff is exactly three `source_hash` lines. The file's **shape is unchanged** (owner ruling R-H4). Reshaping the registry away from its superseded TOML-shaped record dialect is a separate, deliberate job against `build-registry.sh`. **Verification:** `build-registry.sh --check` rc **1 → 0**. --- ⚠ **Depends on #798.** This branch was previously uncommittable: `standards` could accept no commit through its own pre-commit hook. #798 removes the two dead-format gates that deadlocked it. These three commits are signed and passed the repaired hook; **merge #798 first** so the fix is reproducible for anyone else on this branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Sep 15, 2026
## Why `standards/.githooks/validate-a2ml.sh` is the file that `.github/workflows/propagate-hooks.yml` copies into **every repo in both estates**. It was a 1,399-byte script that knew only the dead A2ML manifest dialect — it required `^(agent-id|pedigree):` and `^version:`, and had **zero** references to `.deed`. This replaces it with the dual-accept validator already merged on `deed-ecosystem/validate-action` main (`f9d999b6`). ## The ordering this fixes `propagate-hooks.yml` is **currently inert**. Its last five runs all failed at *"Identify repositories with .githooks"* with: ``` ##[error]Unable to process file command 'output' successfully. ##[error]Invalid format ' ""' ``` — a multi-line value written to `$GITHUB_OUTPUT` with no heredoc delimiter. The `Propagate Hook Updates` job is skipped every time. That makes this PR **a prerequisite, not a companion**, to any repair of that workflow. It does `cp -v ./.githooks/* target-repo/.githooks/`, so repairing it first would have copied this dead-dialect script over the **79 repos** that already carry a better (if also `.deed`-blind) 13,737-byte one. ## Measured, one denominator 245 local repos with a resolvable origin; 150 carry a remote `dogfood-gate.yml`. **118 of those 150 enforce the dead dialect.** | remote class | repos | `.deed`-aware | |---|---|---| | vendored `bash .githooks/validate-a2ml.sh` (13,737 b, frozen 2026-07-27) | 79 | no | | pinned `a2ml-ecosystem/validate-action@aa4b836b` (2026-07-25) | 39 | no | | pinned `…@main` (a2ml 20 + deed 5) | 25 | yes | | pinned phantom `a2ml-validate-action@` | 2 | no | ## Verification - `bash -n` clean - **4/4** `deed-ecosystem/conformance/valid` fixtures accepted, **0 false rejects** - **3/5** `conformance/invalid` rejected. The 2 misses are both version cases and are **warnings by design** — the ecosystem's own `run-deed-tests.sh` test 4 asserts *"strict promotes the version warning to an error"* - **14/14** sampled vendored repos (725 `.a2ml` files) return **identical exit codes** under the old and new script — no regression - **Planted positive:** a valid `.deed` passes under the new script; the old one has 0 `.deed` references and cannot see it at all - **Planted negative:** a `.deed` with no `:schema-version` is reported (as a warning, per the design above) ## Not changed here `strict` stays `false`. Measured: flipping it turns **8 of 10** sampled repos red, so it is a separate decision, not a free win. Stacked on #798, which removes this validator's invocation from `pre-commit` and `pre-push`. Without that, a commit to this repo cannot pass its own hooks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx --------- Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The problem
standardscannot accept any commit through its own pre-commit hook. Two gatesblock each other, and both validate a format that no longer exists.
mainand instructs you to stage.machine_readable/REGISTRY.a2ml— a generated, TOML-shaped artefact, i.e. aspecimen of the record dialect ruled SUPERSEDED on 2026-09-08.
validate-a2ml.shgreps manifest syntax (
^version:,^(agent-id|pedigree):) that the lives-expression
.deedgrammar does not have.The live grammar is neither shape.
deed.abnfsays it plainly: "there is nokey = valueproduction and no[section]production. The only bracket is(.A file using
=is not a deed."Measured:
validate-a2ml.shpasses 0 of 222 tracked.a2mlfiles here.Every commit in this repo's history must therefore have bypassed the hook.
Why not just fix the regex
It would turn all 222 files red at once, and it would be repairing a validator for a
dead format. A2ML was abandoned after the ML community objected to the name;
.deedand
.k9are the live formats.The dates matter
REGISTRY.a2ml+build-registry.sh.githooks/validate-a2ml.shNo hook in this repo knows
.deedexists (pre-commita2ml=4 / deed=0).What this PR does
Removes (owner ruling R-H3, 2026-09-15):
run_validator "A2ML manifests" "validate-a2ml.sh" "staged"Keeps deliberately:
.github/workflows/registry-verify.yml:56(build-registry.sh --check);REGISTRY.a2mlitself, byte-for-byte (ruling R-H4). It is a generatedartefact, so reshaping
build-registry.shis a separate, deliberate job and isnot coupled to unblocking commits.
A
.deedvalidator returns to this hook once the dual-acceptvalidate-actionlands(ruling R-H2 — that one fixes 154 of 269 repos from two action repos).
Verification
bash -nclean.SSH-signed. No
--no-verifywas used —core.hooksPath=.githooksmeans git runsthe hook from the working tree, so the fix is in effect for its own commit.
🤖 Generated with Claude Code
https://claude.ai/code/session_0168Bgpez8mFBcAqYAj8VgEx