release(canon): 2.0.2 — the law stops naming the hyphenated path (PATCH) - #818
Merged
Merged
Conversation
…CH, per [versioning].rule-patch)
Ruling R-A settles the machine tree's spelling as `.machine_readable/`. The
canon's two normative artefacts still named `machine-readable/`, so the law told
every repository to use the spelling the estate majority does not use. This
corrects the law.
WHY PATCH — the criteria's own rule, not my judgement
`rsr-criteria-v2.a2ml` `[versioning].rule-patch` reads:
A PATCH bump is editorial (wording, detection-rule id corrections,
template_ref fixes) with no criteria-set change.
This change is *exactly* those three things and nothing else:
* wording — path strings inside `desc`/`freeze-mechanism`/`applicable-set`/
`report` prose, and template_ref values;
* template_ref fixes — eight of the fifteen changed strings ARE template_ref
values (`machine-readable/descriptiles/STATE.a2ml` and siblings);
* detection-rule id corrections — none needed; no id changed.
No criterion is added, removed, re-tiered or re-gated. Nothing that was
conforming becomes non-conforming, and nothing that failed now passes.
The strongest evidence it is not a criteria-set change: **the gates already
resolved both spellings.** Their paths array carries
"machine-readable/descriptiles/|.machine_readable/descriptiles/"
and '|' means a path is satisfied if ANY alternative exists. So the only
behavioural difference is which spelling appears first in a list. That is why
this is PATCH and not MINOR: MINOR is for additions, and there are none.
THE IDENTIFIER IS NOT A PATH, AND IS UNTOUCHED
key = "machine-readable-substrate"
keeps its name. It is a criterion key, not a location. Renaming it would be a
criteria-set change, not errata. On the spine side of this same rename, exactly
this assumption — that the word is the path — silently corrupted six files
including a check-root-shape test and a lineage audit. The census is asserted
in the edit script: after the pass the file contains 15 `.machine_readable/`
paths, and the only two surviving `machine-readable` strings are this key and
one line of prose ("RSR v2.0 machine-readable criteria", the file's own title).
WHAT CHANGED
rsr-criteria-v2.a2ml 15 path tokens, in the freeze-mechanism and
applicable-set rules, the oracle's report prose,
criteria 3.1.1 (descriptiles-dir, desc) and 3.2.2
(rsr-profile, desc AND template_ref), and the eight
per-criterion template_ref values 3.1.2-3.1.9
template-capability-gates.toml two paths alternatives reordered so the
canonical spelling is listed first; one comment
canon.lock version 2.0.1 -> 2.0.2, tag canon-v2.0.1 ->
canon-v2.0.2, criteria sha256 and gates sha256
rewritten, a dated note recording the category
argument above
RSR-SPEC-v2.adoc Appendix E: Errata, added
APPENDIX E HAD NEVER BEEN WRITTEN
`[versioning].errata` says corrections "are recorded in RSR-SPEC-v2.adoc
Appendix E (Errata) and shipped as PATCH bumps". The spec has Appendix A and
Appendix B. The rule named a section that did not exist, so this release both
satisfies the rule and creates what it points at. The first entry is this
change.
Same file, same pass: its own SSOT footer still pointed at
`spec/rsr-criteria-v2.a2ml`, a path that stopped existing when #815 moved the
law into 0-canon/rsr/. Corrected.
NEW PINNED IDENTITY
criteria efd024ad9cbdf0d36d4dbce7e491531dd4ccccbfc747a04223ce4149f4b9a53d
-> 7804d77127001ed50263f0783d8a11f7211e72cb5e9f6443f2acde4b08d9ab1e
gates 8b1a77669c9ab78e9081669dbb2ab141d8af29700affc327f3dcde99f3dcd243
-> 6a8b9b420519dccdd2c586da06a9a302bdbbb3dc917f49e4a7b308882471d68a
SEQUENCE — THIS MAY NOT MERGE FIRST
[canon].order is spine-adopts-then-canon-releases, and Gate A enforces it. The
spine must re-adopt both hashes and go green against them before this lands.
Until it does, Gate A fails here on assertion 3, by design.
WITNESSES
lock hashes vs artefacts on disk both match, verified by sha256sum
check-canon-lockstep.sh rc=0 GATE A PASSED
check-standards-map.sh rc=0 GATE D PASSED
check-rsr-profile.sh rc=0 profile matches declared capabilities
check-allowed-actions.sh rc=0 35 uses: refs, 0 uncovered
.githooks/validate-a2ml.sh rc=1 33 errors — IDENTICAL to the
pre-release baseline, so the criteria
edits introduced none
Note on method: the first attempt at this edit expected
`machine-readable/rsr-profile.a2ml` twice and found three. The third was a
`template_ref` on a line whose visible head was identical, and a `grep -n`
that truncated at 165 characters had hidden it. The count assertion refused to
write. Enumerate tokens with `grep -o`, never ask whether a line looks right.
(cherry picked from commit 3c88d3fe7fef781fc4c248137ff9cff40a35b5a2)
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (3)
📝 SummarySummary by CodeRabbit
WalkthroughThe change makes ChangesCanonical machine-tree paths
Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Suggested reviewers: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the dotted tree, Comment |
hyperpolymath
added a commit
that referenced
this pull request
Sep 17, 2026
## What `main` is **POISON** by this repo's own `scripts/lock-selfcheck.sh`, added in #821. The gate went red on its own merge commit, and the cause predates it: ``` .github/workflows/governance-reusable.yml uses denoland/setup-deno@22d081f lock keys for this workflow: actions/cache … actions/checkout … editorconfig-checker/… erlef/setup-beam … ``` The ref is used but not keyed. It arrived with `cdec573` (#818, the 2.0.2 release) and no lock regeneration rode along. ## Why it matters GitHub resolves a reusable's action refs against the **callee** repo's `actions.lock` **at the pinned SHA**. An unkeyed ref kills every caller at workflow startup with **zero jobs**, conclusion `failure` (not `startup_failure`), and no reason carried in either REST or GraphQL — the run page is the only place that states one. A required context that dies this way never reports at all, so the gate reads as **absent** rather than failing and the branch looks clean. `main` is not currently a safe thing to pin to. ## Why this fix is deterministic The lockfile validator requires **key-SHA == the digest written inline in the workflow**, so the correct entry has exactly one possible value and needs no resolution, network, or judgement. This reproduces what `gh actions-lock` + `scripts/relock-sha-keys.sh` would key, with no other entry moved. ## Verification ``` scripts/lock-selfcheck.sh 176d1f7 -> VERDICT: POISON — 1 ref used but NOT keyed (rc=1) scripts/lock-selfcheck.sh 46ef434 -> VERDICT: SELF-CONSISTENT (rc=0) ``` Diff is one added line in `.github/workflows/actions.lock` — the key, inserted in the file's alphabetical convention. ## Not fixed here `lock-selfcheck.sh` also reports **6 workflows with no lock entry at all** (`apply-workflow-pins.yml`, `pages-archive.yml`, `propagate-hooks.yml`, `security-gate-pr-target.yml`, `settings-drift-detect.yml`, `tag-ruleset-canon.yml` — 18 refs). The gate states this is a separate question from the verdict and does not count it. Left alone deliberately: an empty `[]` entry is not obviously the intended answer for a workflow that may not be a reusable. ## Related `uses ⊆ actions.lock` is red on `main` with the same root cause (it shells out to `update-actions-lock.sh --verify-local`). Expect it to clear with this change; if it does not, it is a second defect, not the same one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ruling R-A settles the machine tree's spelling as
.machine_readable/. The canon's two normative artefacts still namedmachine-readable/, so the law told every repository to use a spelling the estate majority does not. This corrects the law.Why PATCH — the criteria's own rule, not my judgement
rsr-criteria-v2.a2ml[versioning].rule-patch:That is exactly this change and nothing more: wording in
desc/freeze-mechanism/applicable-set/reportprose, and eight of the fifteen changed strings aretemplate_refvalues.The strongest evidence it is not a criteria-set change: the gates already resolved both spellings. Their paths array carries
"machine-readable/descriptiles/|.machine_readable/descriptiles/", and|means satisfied if ANY alternative exists — so the only behavioural difference is which spelling appears first in a list. Nothing that conformed stops conforming; MINOR is for additions and there are none.The identifier is not a path
key = "machine-readable-substrate"keeps its name. It is a criterion key, not a location; renaming it would be a criteria-set change, not errata. Asserted in the edit script — after the pass the file holds 15.machine_readable/paths and exactly two survivingmachine-readablestrings: that key, and the file's own title line.Appendix E had never been written
[versioning].erratasays corrections "are recorded in RSR-SPEC-v2.adoc Appendix E (Errata) and shipped as PATCH bumps". The spec has Appendix A and Appendix B. The rule named a section that did not exist, so this release creates what it points at. Same file, same pass: its SSOT footer still pointed atspec/rsr-criteria-v2.a2ml, dead since #815 moved the law into0-canon/rsr/.Sequence
Gate A fails this until the spine re-adopts. The two merge together — spine first, then this, seconds apart.
Witnesses