Repository navigation
ci(codeql): cron weekly→monthly (cut 3, standards#288) - #51
Merged
Merged
Conversation
Per `standards#286` canonical (cut 3, Option B 2026-05-30): convert CodeQL scheduled run from weekly `0 6 * * 1` to monthly `0 6 1 * *`. PR-trigger runs unchanged — every PR still gets CodeQL. Refs `hyperpolymath/standards#288` (campaign). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
marked this pull request as ready for review
June 5, 2026 13:43
hyperpolymath
enabled auto-merge (squash)
June 5, 2026 13:43
hyperpolymath
added a commit
that referenced
this pull request
Oct 3, 2026
## Summary Implements the repository-side work tracked by #53. This is a **draft** pending explicit owner confirmation of the license policy and branch-protection change. - Records #51 and #52 as reconciled: both issues are closed; the monthly CodeQL schedule and Tier-2/L10/proof-corpus work are present in the current tree. - Normalizes live license metadata to the policy already declared by this repository: MPL-2.0 for software/configuration and CC-BY-SA-4.0 for human documentation. GitHub Licensee currently recognizes the public `main` license as MPL-2.0. Removed the unused AGPL license text; no source file currently declares AGPL. Corrected invalid PMPL SPDX headers, package/release metadata, and misleading legacy license wording. The ethical-use exhibits now expressly state they are non-binding guidance and do not modify MPL-2.0. - Adds a closed license-policy contract and fail-closed checker: REUSE 6.2.0 lint, one inline SPDX declaration, path-specific documentation/software rules, allowed-ID checks, Cargo metadata checks, root license and Zenodo checks. Wires it into `just license-check`, pre-commit, the K9/Must contract, and the CI check `license-policy`. - Adds explicit CC-BY-SA headers to untagged human documentation and missing MPL headers to code/configuration manifests; fixes REUSE copyright gaps. - Rewrites `.machine_readable/STATE.a2ml` to reflect the actual VCL-UT implementation, proof corpus, limitations, and next actions; removes the byte-identical `6a2/STATE.a2ml` mirror. Documents the distinct roles of the four contractile locations and removes the remaining template-state wording from the AI entry point. ## Validation - REUSE 6.2.0 `reuse lint` — pass (0 missing, invalid, deprecated, or unused licenses). - `scripts/check-license-policy.sh` — pass; negative test confirmed the documentation path rule rejects MPL-2.0. - Strict `.githooks/validate-a2ml.sh` — pass (121 files, 0 errors/warnings). - `pre-commit validate-config`, shell syntax, TOML/JSON/YAML parsing, and `git diff --check` — pass. - Full pre-commit execution is currently blocked by the existing `https://github.com/hyperpolymath/a2ml-pre-commit` remote returning “Repository not found”. Strict K9 validation also flags the existing `container/deploy.k9.ncl` envelope-format mismatch. Cargo, Idris2, and Nickel are not installed in this sandbox, so build/proof corpus execution was not possible here. ## Owner actions before this can be merged/closed 1. Confirm that **MPL-2.0 code + CC-BY-SA-4.0 documentation** is the intended ruling (rather than retaining an AGPL core). The current repository headers, Cargo metadata, policy docs, and GitHub Licensee result point to that choice; the orphan AGPL text was removed accordingly. 2. After this check appears on a PR, make the `license-policy` status check required in branch protection/rulesets. GitHub reports its exact check context as `license-policy`; this session's integration cannot read or change branch-protection settings (HTTP 403). 3. Optionally provide the correct A2ML pre-commit repository/ref so the full pre-commit suite can be run locally; the new local license hook itself is configured and independently passes. This PR intentionally does not auto-close #53; owner confirmation and the required-check setting are still needed for full conclusion. ## GitHub CI status (observed 2026-10-03) The PR-head `license-policy` job passes in [REUSE compliance run 37153345024](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345024); the A2ML validation job also passes here (the corresponding job failed on `main` before this PR). Parse Gate, E2E/property tests, CodeQL, OpenSSF, and the dedicated Hypatia scan passed. Several other red checks are pre-existing on `main` and reproduce on this PR: K9 contract validation ([PR](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345063), [main](https://github.com/hyperpolymath/vcl-ut/actions/runs/36827801346)) rejects `container/deploy.k9.ncl` because its metadata envelope differs from the validator's expected literal `K9!`/top-level pedigree format; the Governance workflow linter ([PR](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345544), [main](https://github.com/hyperpolymath/vcl-ut/actions/runs/36827802174)) fails at “Check SPDX headers + permissions”; Static Analysis Gate / Hypatia critical findings ([PR](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345049), [main](https://github.com/hyperpolymath/vcl-ut/actions/runs/36827801472)); Rust CI / Clippy ([PR](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345611), [main](https://github.com/hyperpolymath/vcl-ut/actions/runs/36827802116)); and Cargo Audit ([PR](https://github.com/hyperpolymath/vcl-ut/actions/runs/37153345048), [main](https://github.com/hyperpolymath/vcl-ut/actions/runs/36827801358)). These are not attributed to this change; the Actions log archive endpoint returned EOF when detailed failed-step logs were requested. The K9 validator mismatch is documented rather than suppressed or “fixed” by weakening the gate. At the time checked, Proof Corpus remained in progress and the large Backend Matrix remained queued, so this is not a claim that the full CI suite completed. Maintainers should resolve or explicitly disposition the pre-existing red checks as appropriate for branch protection, then wait for the proof/matrix jobs. ## Additional maintainer follow-up 4. Resolve the pre-existing K9 envelope mismatch without a blanket ignore (either teach the validator the deployed `component_pedigree` / `metadata.magic_number` / `trust_level` representation with regression coverage, or migrate the deployment config to the canonical format). Also triage the baseline governance, Hypatia, Clippy, and Cargo Audit failures if they are required checks. --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reconciles the parked
cicd/codeql-cron-monthlybranch intomain(branch-reconciliation pass, owner-approved).Single change: CodeQL scan cron weekly→monthly (cut 3, per standards#288). Trivial; safe to merge once CI is green.
https://claude.ai/code/session_01W9Voe3JceP66Bna9FT4jME
Generated by Claude Code