From a994080c1198c88d25bd9523bb8b5ae49b7d624d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 22:21:46 +0000 Subject: [PATCH 1/3] fix(audit): correct the census total to 333 and the #17 tense Two self-inflicted defects in the previous commit, both caught by re-reading the artefacts against the census data they quote: * the audit said "337 required contexts across 179 repositories"; the census (census verdicts app-owned 168 + producible 156 + app-named 4 + unsatisfiable 5) totals 333. A census document that miscounts its own census is exactly the kind of unverified claim this estate's audit gate exists to prevent. * the gate's header still described tropical-types#17 in the present tense ("the wrapper publishes `scan / ...`"). That repository now publishes both the bare name (inline job) and the prefixed name (wrapper caller `hypatia`), so the sentence was stale the moment it merged. Also records that all five unsatisfiable contexts bind `integration_id: 15368` (GitHub Actions): they are repository-owned workflow job names, which is why no external publisher could satisfy them, and why the fix is a rename rather than an app configuration change. --- .../audit-ci-context-producibility-2026-09-20.adoc | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/audits/audit-ci-context-producibility-2026-09-20.adoc b/docs/audits/audit-ci-context-producibility-2026-09-20.adoc index 5def65dbe..0179dbcaf 100644 --- a/docs/audits/audit-ci-context-producibility-2026-09-20.adoc +++ b/docs/audits/audit-ci-context-producibility-2026-09-20.adoc @@ -66,7 +66,9 @@ those names. The audit's subject is the residue the *repository itself* owns. == Results -337 required contexts across 179 repositories, read from branch rulesets: +333 required contexts across 179 repositories, read from branch rulesets +(every one ruleset-sourced: no repository in the census still enforced required +status checks through legacy branch protection): [cols="1,1,2"] |=== @@ -90,8 +92,10 @@ those names. The audit's subject is the residue the *repository itself* owns. |=== That is a good result for the estate and a poor one for the five rules: the class -is rare, which is exactly why it hides. The residues, all in auxiliary -(`Optimus-Branch`, `Base`) rulesets: +is rare, which is exactly why it hides. All five carry `integration_id: 15368` +(GitHub Actions), so they are repository-owned *workflow job names* rather than +third-party app names — nothing outside the repository could ever publish them. +The residues, all in auxiliary (`Optimus-Branch`, `Base`) rulesets: [cols="2,1,2,2"] |=== From 3411d37ddcff6ebce252ffecfb1a772797c42a60 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 22:21:57 +0000 Subject: [PATCH 2/3] docs(gate): state the tropical-types #17 condition in the past tense The header still read "while the wrapper publishes `scan / Hypatia Neurosymbolic Analysis`". That repository publishes the bare name from an inline job and the prefixed name from its wrapper caller now, so the sentence described a condition that no longer exists. Split out from the census-count correction because the previous attempt at it matched the wrong text and silently changed nothing. --- scripts/check-required-contexts.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/check-required-contexts.sh b/scripts/check-required-contexts.sh index 420c1abf2..e885f72c8 100755 --- a/scripts/check-required-contexts.sh +++ b/scripts/check-required-contexts.sh @@ -12,8 +12,10 @@ # rule requiring a name nothing publishes is an unsatisfiable requirement: every # pull request stays BLOCKED, the CI board shows green, and nothing on the CI # side names the cause. Observed in hyperpolymath/tropical-types#17 (the bare -# `Hypatia Neurosymbolic Analysis` required while the wrapper publishes -# `scan / Hypatia Neurosymbolic Analysis`), and catalogued for the wrapper case in +# `Hypatia Neurosymbolic Analysis` required while the wrapper published +# `scan / Hypatia Neurosymbolic Analysis`; that repository now publishes the bare +# name from an inline job and the prefixed name from its wrapper caller), and +# catalogued for the wrapper case in # docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc. # # THE RULE THIS ENCODES From ccc6d02532beea0250435e2e5746f58810dc3303 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 20 Sep 2026 22:22:26 +0000 Subject: [PATCH 3/3] docs(audit): record per-ruleset verification of the five residues MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The census reads each repository's default-branch workflow set, so a required context held by a ruleset bound to some other ref could have been reported as a defect it never was. Re-checked all five against the ruleset that carries them: active enforcement, `~DEFAULT_BRANCH` in every `ref_name.include`, single-branch repositories, and `integration_id: 15368` on every context. The five are live defects. Also notes that three of them are guarded by a ruleset named `Optimus-Branch` that binds the default branch — the same conflation of "this branch" with "that branch" that produced the class. --- docs/audits/audit-ci-context-producibility-2026-09-20.adoc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/docs/audits/audit-ci-context-producibility-2026-09-20.adoc b/docs/audits/audit-ci-context-producibility-2026-09-20.adoc index 0179dbcaf..e90252c7c 100644 --- a/docs/audits/audit-ci-context-producibility-2026-09-20.adoc +++ b/docs/audits/audit-ci-context-producibility-2026-09-20.adoc @@ -108,6 +108,13 @@ The residues, all in auxiliary (`Optimus-Branch`, `Base`) rulesets: | `hyperpolymath/vext` | Optimus-Branch | `CodeQL Analysis (actions, none)` | stale job-name + matrix tuple |=== +Each one was re-checked per ruleset on 2026-09-20 and is a live defect, not an +artefact of evaluating the wrong ref: every carrying ruleset is `active`, every +one binds `~DEFAULT_BRANCH` (these repositories have a single branch, +`main`), and every context carries `integration_id: 15368`. Note the naming +irony in three of them — a ruleset called `Optimus-Branch` guarding the default +branch. + Each one is the same defect as tropical-types#17 in a different costume: the requirement names a check that used to exist. The fix is one of the two honest options below; the diagnostic is