Skip to content

fix(audit): correct the census total to 333, and the stale #17 tense in the gate header #871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 4 commits into from
Sep 20, 2026
Merged

fix(audit): correct the census total to 333, and the stale #17 tense in the gate header #871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a994080
fix(audit): correct the census total to 333 and the #17 tense
hyperpolymath Sep 20, 2026
3411d37
docs(gate): state the tropical-types #17 condition in the past tense
hyperpolymath Sep 20, 2026
ccc6d02
docs(audit): record per-ruleset verification of the five residues
hyperpolymath Sep 20, 2026
bf51cf5
Merge branch 'main' into fix/audit-context-count-corrections
hyperpolymath Sep 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions docs/audits/audit-ci-context-producibility-2026-09-20.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,9 @@ those names. The audit's subject is the residue the *repository itself* owns.

== Results

337 required contexts across 179 repositories, read from branch rulesets:
333 required contexts across 179 repositories, read from branch rulesets
(every one ruleset-sourced: no repository in the census still enforced required
status checks through legacy branch protection):

[cols="1,1,2"]
|===
Expand All @@ -90,8 +92,10 @@ those names. The audit's subject is the residue the *repository itself* owns.
|===

That is a good result for the estate and a poor one for the five rules: the class
is rare, which is exactly why it hides. The residues, all in auxiliary
(`Optimus-Branch`, `Base`) rulesets:
is rare, which is exactly why it hides. All five carry `integration_id: 15368`
(GitHub Actions), so they are repository-owned *workflow job names* rather than
third-party app names — nothing outside the repository could ever publish them.
The residues, all in auxiliary (`Optimus-Branch`, `Base`) rulesets:

[cols="2,1,2,2"]
|===
Expand All @@ -104,6 +108,13 @@ is rare, which is exactly why it hides. The residues, all in auxiliary
| `hyperpolymath/vext` | Optimus-Branch | `CodeQL Analysis (actions, none)` | stale job-name + matrix tuple
|===

Each one was re-checked per ruleset on 2026-09-20 and is a live defect, not an
artefact of evaluating the wrong ref: every carrying ruleset is `active`, every
one binds `~DEFAULT_BRANCH` (these repositories have a single branch,
`main`), and every context carries `integration_id: 15368`. Note the naming
irony in three of them — a ruleset called `Optimus-Branch` guarding the default
branch.

Each one is the same defect as tropical-types#17 in a different costume: the
requirement names a check that used to exist. The fix is one of the two honest
options below; the diagnostic is
Expand Down
6 changes: 4 additions & 2 deletions scripts/check-required-contexts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,10 @@
# rule requiring a name nothing publishes is an unsatisfiable requirement: every
# pull request stays BLOCKED, the CI board shows green, and nothing on the CI
# side names the cause. Observed in hyperpolymath/tropical-types#17 (the bare
# `Hypatia Neurosymbolic Analysis` required while the wrapper publishes
# `scan / Hypatia Neurosymbolic Analysis`), and catalogued for the wrapper case in
# `Hypatia Neurosymbolic Analysis` required while the wrapper published
# `scan / Hypatia Neurosymbolic Analysis`; that repository now publishes the bare
# name from an inline job and the prefixed name from its wrapper caller), and
# catalogued for the wrapper case in
# docs/audits/audit-hypatia-pin-orphan-2026-05-27.adoc.
#
# THE RULE THIS ENCODES
Expand Down
Loading