Repository navigation
fix(ci): clear the deferred red checks — descriptiles, hypatia-scan, RSR realignment (#78) - #80
Merged
Conversation
…e_readable/descriptiles/ (#78) RSR v2.0 SSOT 3.1.x requires STATE/META/ECOSYSTEM/AGENTIC/NEUROSYM/PLAYBOOK descriptiles at .machine_readable/descriptiles/; the .machine_readable/ root of the machine tree and the 6a2/ directory are retired (6a2 deprecated 2026-06-30). This clears the 9 SD004 criticals reported by the Hypatia neurosymbolic scan on main. * git-mv the six record-dialect 6a2 manifests to descriptiles/ * reconcile the legacy s-expression-dialect twins (.machine_readable/ {META,STATE,ECOSYSTEM}.a2ml) into the record versions and retire them — no fact lost (root STATE was semantically newer: M3 complete, 66%, session history to 2026-06-27 — ported into the record dialect) * repair retired-path references: 0-AI-MANIFEST.a2ml canonical-locations section + anchor path, AGENTIC/PLAYBOOK operational hooks, HANDOFF.adoc, CLAUDE.md, TOPOLOGY.adoc Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…canner's highs + timeouts (#78) Kills the remaining Hypatia findings from the red static-analysis gate: * add .github/workflows/hypatia-scan.yml — the estate-required independent Hypatia security scan (workflow_audit/missing_workflow critical; RSR 6.1.2), pinned to the standards reusable at 10e0b6ffb9 (vetted scanner SHA input, SARIF to the Security tab, advisory until a baseline is committed — standards#399/#437 mechanism) * setup.sh: remove both download-and-execute fallbacks (CWE-494) — package managers stay; otherwise print checksum-verify manual-install instructions; header usage note rewritten the same way * gui/app.js: delete the dead innerHTML escape hatch — SafeDOM by construction, no callers used the html: option (CWE-79) * least-privilege Deno permissions, never -A (CWE-250): scripts/validate-cartridges.js doc line, scripts/launch-gui.sh (--allow-read --allow-net --allow-env --allow-run), Justfile recipe to follow in the RSR commit * rsr-antipattern.yml: anchor the exemption-table heading regex to the markdown heading shape (WF022 — the silent-wrong-section class; verified the anchored regex still matches '### TypeScript Exemptions') * instant-sync.yml: gate the repository-dispatch secret on presence via the estate env-boolean idiom (WF017) + timeout-minutes * timeout-minutes on every flagged job (ERR-WF-013): codeql analyze, guix-nix-policy check, instant-sync dispatch Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
…#78) The red 'RSR Compliance Check' demanded a 2025-era file set; three estate migrations moved on without it. Regenerate it as a non-normative mirror of the rsr-criteria-v2 detectors (the ONE normative checker is hypatia:rsr-conformance) with honest failures and timeout-minutes: * any_of shapes for the 2.1.x community docs; owner ruling 2026-10-10: community-health files stay AsciiDoc (SECURITY.adoc et al.) while .md variants remain accepted — the SSOT's .md-only detector lag is recorded for upstream (standards#994; GitHub .adoc recognition requests orgs/community #181843/#189645) * 2.2.1 well-known: www/.well-known/ canonical (rsr-template-repo#53), legacy root tolerated with a warning * 3.1.1 descriptiles present + retired 6a2 absent; 1.1.2/1.1.3 Justfile present / Makefile banned Companion repairs: * Justfile: the deno task recipes referenced a deno.json that never existed in git history — replaced with direct least-privilege deno commands; validate-rsr/validate-docs/validate-security/validate-structure use the same SSOT shapes; header aligned to LANGUAGE-POLICY tiers (this repo's Deno surface is tier-2 grandfathered) * wellknown-enforcement.yml: fails closed when security.txt is absent everywhere (was a vacuous warn-only gate), www/ canonical, runs the adopted template validator www/tests/check-wellknown.sh * www/.well-known/security.txt: Canonical/Policy URLs fixed (wrong repository name 'nextgen-languages-evangeliser', retired paths) * www/.well-known/ai.txt: stale AI.a2ml reference -> CLAUDE.md + descriptiles * SECURITY.adoc modernized: retired VS Code-extension threat model replaced with the current Deno + cartridge-data surface; dead links/paths fixed * CONTRIBUTING.adoc dead links (SECURITY.md/CODE_OF_CONDUCT.md -> .adoc), README.adoc humans.txt link + structure tree, docs/RSR_COMPLIANCE.adoc (paths, Nix retirement), CHANGELOG entry Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
The full recon + remediation plan: verified root causes of both red contexts (Hypatia 10-critical reconstruction from the rule sources; RSR gate staleness vs the estate migrations), binding constraints from the RSR v2.0 criteria SSOT and rsr-template-repo, phased workstreams, verification plan, risks, and the owner's decision-point rulings (DP-1..DP-4). Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (36)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…kflows (#78) RE001 is the advisory research-extension recommendation to install step-security/harden-runner wherever a workflow references a secret. These five workflows deliberately use SHA-pinned, repository-locked actions with least-privilege permissions while retaining the outbound access they need (GitHub API, SMTP, forge propagation) — the same justification and file-scoped shape as rsr-template-repo's own .hypatia-ignore (whose entries cover push-email-notify, release, build-notification, dependabot-automerge, label-triage, labels). File-scoped entries keep the advisory applying to every NEW workflow. Surfaced as a code-scanning alert on #80 only because instant-sync.yml was rewritten there; the advisory pre-exists the PR. Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Remediates the two deferred red contexts tracked in #78 (standing ruling 2026-09-15: a red non-required check is an issue with acceptance criteria). Full recon + plan:
docs/plans/PLAN-issue-78-red-checks.adoc. Cross-cutting governance reds: hyperpolymath/standards#994.Red context 1 —
Hypatia neurosymbolic scan(static-analysis-gate.yml)The gate reported 10 critical security issue(s); GitHub's 10-annotation cap hid the true set. Reconstructed from the Hypatia rule sources (
structural_drift.ex,workflow_audit.ex,code_safety.ex):SD004(critical).machine_readable/{META,STATE,ECOSYSTEM}.a2ml(legacy s-expression dialect) +.machine_readable/6a2/{AGENTIC,ECOSYSTEM,META,NEUROSYM,PLAYBOOK,STATE}.a2ml.machine_readable/descriptiles/(SSOT 3.1.x;6a2/deprecated 2026-06-30); record-dialect kept as base, s-expr twins reconciled fact-by-fact then retiredmissing_workflow(critical).github/workflows/hypatia-scan.ymlabsent (SSOT 6.1.2)@10e0b6ffb979f0a27fe58206512055133e67460a(advisory until a baseline lands; standards#399/#437 mechanism)Also cleared the annotated highs + mediums so the reusable scan and any future baseline promotion start clean:
setup.shdownload-and-execute ×2 removed (CWE-494) — checksum-verify manual-install guidance insteadgui/app.jsdeadinnerHTMLescape hatch deleted — no caller usedhtml:; SafeDOM by construction (CWE-79)-Aeliminated → explicit least-privilege flags (CWE-250):scripts/validate-cartridges.js,scripts/launch-gui.sh,Justfilersr-antipattern.ymlexemption-heading regex anchored to^#{1,4}\s+(WF022; verified it still matches### TypeScript Exemptions)instant-sync.ymlrepository-dispatchgated on secret presence via the estate env-boolean idiom (WF017)timeout-minuteson all 10 flagged jobs (ERR-WF-013): ci.yml ×6, codeql analyze, guix-nix-policy check, instant-sync dispatchstatic-analysis-gate.ymlitself is untouched — it is byte-shaped like rsr-template-repo's (the inline job feeds the gitbot-fleet learning pipeline; the newhypatia-scan.ymlis the independent pinned scan).Red context 2 —
RSR Compliance Check(ci.yml)The job demanded a 2025-era file set; three estate migrations moved on without it. Regenerated as a non-normative mirror of the rsr-criteria-v2 SSOT detectors (the ONE normative checker is
hypatia:rsr-conformance):any_ofshapes. Owner ruling 2026-10-10: community-health files stay AsciiDoc (SECURITY.adocet al.);.mdvariants remain accepted. The SSOT's.md-only detector lag is recorded for upstream (standards#994; GitHub.adocrecognition is the owner's own feature requests orgs/community#181843 / #189645).www/.well-known/canonical (rsr-template-repo#53 stage-5 sweep), legacy root tolerated with a warning6a2/absent; 1.1.2/1.1.3 Justfile / no Makefiletimeout-minutes: 10; honest failures, no silent-greenCompanion repairs:
deno taskrecipes referenced adeno.jsonthat never existed in git history — replaced with direct least-privilegedenocommands;validate-rsrnow runs green and honestlywww/tests/check-wellknown.sh(passes locally)www/.well-known/security.txt: Canonical/Policy URLs fixed (wrong repo namenextgen-languages-evangeliser→nextgen-language-evangeliser; retired paths)SECURITY.adocmodernized: retired VS Code-extension threat model → current Deno + cartridge-data surface; dead links fixedCONTRIBUTING.adocdead links,README.adochumans.txt link + structure tree,docs/RSR_COMPLIANCE.adoc(paths, Nix retirement),0-AI-MANIFEST.a2mlcanonical-locations section, CHANGELOG entryVerification
.machine_readable/descriptiles/;6a2/gone; no SD007/SD023/SD024 re-triggers (no retired-path refs remain in the files those rules scan)gui/app.jspassesnode --check; nodeno run -A, nocurl|shanywhere in scanned surfaceAcceptance
Both contexts green on this PR head; once merged, green on
maincloses #78. Open dependabot PR #79 should be refreshed afterwards to inherit green.Upstream reports drafted in the plan (§5.5) for owner posting to standards#994: oracle 2.2.1 root-only detector vs www/ canonical, SSOT 2.1.3–2.1.5
.adocvariants, unimplemented SD020, floating Hypatia clone in the template's static-analysis-gate.