Skip to content

fix(main-red-round3): map drift repair + WH004-path asana ack #959

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 1 commit into from
Sep 22, 2026
Merged

fix(main-red-round3): map drift repair + WH004-path asana ack #959

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .hypatia-baseline.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1732,5 +1732,14 @@
"note": "TRIAGED (round-2 fix-forward 2026-09-22): Hypatia workflow_audit fails the lock closed with transitive_dependencies_missing -- asana/push-signed-commits@d615 (immutable pin, ref v1.3) declares transitive actions/setup-python@v2, which floats upstream and can never be a lock key. gh-actions-lock v0.1.6 verify says valid:true on the same file; Hypatia is stricter than the authoritative tool. Exposure is upstream float only. Exit: Asana pins setup-python, we replace the action, or Hypatia downgrades float-transitives. #947 deleted the metadata to silence the scanner; round 2 restored it verbatim and acked honestly.",
"expires_at": "2026-12-22",
"tracking_issue": "hyperpolymath/standards#951"
},
{
"severity": "high",
"rule_module": "workflow_hardening",
"type": "invalid_actions_lock",
"file": ".github/workflows/actions.lock",
"note": "TRIAGED (round-2 fix-forward 2026-09-22): second emission path of the same asana float-transitive as the workflow_audit ack (see #951). Hypatia emits invalid_actions_lock TWICE: workflow_audit/parse_actions_lock (file actions.lock) and WH004 standalone (rule_module workflow_hardening, full path). Both verified by running the real scanner locally. Same exit criteria as #951.",
"expires_at": "2026-12-22",
"tracking_issue": "hyperpolymath/standards#951"
}
]
23 changes: 18 additions & 5 deletions standards-map.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@
[map]
repo = "hyperpolymath/standards"
version = "1.0.0"
entry_count = 122
entry_count = 123
generated = false # hand-curated; the district index.adoc files ARE generated
checked_by = "scripts/check-standards-map.sh"

Expand Down Expand Up @@ -1517,17 +1517,30 @@ gate = "canon-self-conformance"
note = "two canonical front doors (README.adoc human, 0-AI-MANIFEST.a2ml machine); every other doc is a thin pointer"

[[entry]]
from = ".well-known"
target = ".well-known"
from = "www"
target = "www"
district = "root"
kind = "spine-mandated"
files = 4
lifecycle = "versioned"
canonical = false
canon_slot = ""
canonical_doc = ".well-known/index.adoc"
canonical_doc = ""
gate = "check-root-shape"
note = "must be at root because the spine's root-allow.txt requires it there"
note = "2026-09 (#851) migration wrapper: root .well-known/ moved to www/.well-known/ (its only content, 4 files). Replaces the stale .well-known entry (round 2). If a real site grows here, split the entry."

[[entry]]
from = "SECURITY.md"
target = "SECURITY.md"
district = "root"
kind = "onramp"
files = 1
lifecycle = "versioned"
canonical = false
canon_slot = ""
canonical_doc = ""
gate = ""
note = "GitHub security policy: supported versions (tip of main only) + private vulnerability reporting. Added 2026-09-22 (round 2 maps it)."

[[entry]]
from = ".editorconfig"
Expand Down
Loading