Skip to content

docs(affirmation): re-anchor at 6d19ce0e, refs #787 - #1215

Merged
hyperpolymath merged 1 commit into
mainfrom
docs/affirmation-reanchor-2026-10-09
Oct 9, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
docs/affirmation-reanchor-2026-10-09

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Oct 9, 2026 •

Copy link
Copy Markdown
Owner

Summary

Refreshes docs/AFFIRMATION.adoc (profile B) at anchor 6d19ce0ebae047027dcfd594c7810bf35c642faa, and keeps the 2026-10-07 file verbatim at docs/affirmations/AFFIRMATION-2026-10-07.adoc. Claude re-ran the checks at the anchor on 2026-10-09 between 08:05Z and 08:27Z and drafted the file. The owner affirms it with the signed commit in this PR, whose parent is the anchor.

Why a refresh. The 10-07 affirmation (#1203) did not land anchored. scripts/verify-affirmation-anchor.sh hyperpolymath/standards 1203 printed DRAFT (rc=1) at 08:07:49Z for three reasons:

The new file says so in "Changes since the 2026-10-07 affirmation", and it calls itself a draft unless it lands as its "When this file is anchored" note describes.

Refs #787. Closes: none.

Type of change

  • 🐛 Bug fix: no code changed.
  • ✨ New feature: no code changed.
  • 💥 Breaking change: no code changed.
  • 🕳️ Soundness fix: no checker or proof changed.
  • 📖 Documentation
  • 🧹 Refactor / tech debt: no code changed.
  • ⚡ Performance: no code changed.
  • 🔧 Build / CI / tooling: no workflow, script or canon file changed.

📌 New pins

  • Head SHA: 76773445d8b0c3a2558f33cc426bacc638206a6f. This is the owner's signed commit, the one CI runs on.
  • Anchor: 6d19ce0ebae047027dcfd594c7810bf35c642faa. It is the head's parent, and it was main when this PR opened.
  • No action uses: SHAs, actions.lock entries, lockfiles or container digests are added or changed. canon.lock is untouched.

How has this been verified?

The two files:

  • asciidoctor -S safe --failure-level=WARN -o /dev/null returned rc=0 with no output on both files. A planted out-of-sequence section returned rc=1, so the gate can fail.
  • Every <<xref>> resolves to an anchor in its own file, checked with comm -23, because Asciidoctor 2.0.26 does not report a dangling xref.
  • The archive is byte-identical to the landed 10-07 file: cmp against e35431d5:docs/AFFIRMATION.adoc returned 0.
  • Commit (HEAD) appears exactly once in the new file, holding the full 40-hex anchor. verify-affirmation-anchor.sh reads the anchor from that row. The archive still carries the old SHA in its own row, so pass the anchor explicitly (below).

The repo's own hooks, with a throwaway unsigned commit of exactly these two files in a scratch clone at the anchor (never pushed):

  • .githooks/pre-commit: rc=0. With a .env holding a planted ghp_ token staged beside the two files, it returned rc=1 and flagged .env:github-pat:1. Its gitleaks pass cannot see these two files, because gitleaks 8.16.0 skips every path ending in doc (inbox, 2026-10-09). So this rc=0 says nothing about secrets in them.
  • gitleaks on .md copies of both files, with .gitleaks.toml and its config/gitleaks/estate-baseline.toml from the anchor: no leaks (rc=0). With a planted ghp_ token beside them, it returned rc=1 and flagged only the plant. CI's secret-scanner-reusable.yml runs its own AsciiDoc pass.
  • .githooks/commit-msg: rc=0 on the full message owner-actions.sh writes, with one warning that the subject is over 50 characters. A 90-character subject gave rc=1.
  • .githooks/pre-push: rc=0, all seven validators passed. A planted workflow with no SPDX header gave rc=1.

What the file records at the anchor:

  • Passed (rc=0):
    • check-canon-lockstep.sh: 7 passed / 0 failed / 3 skipped by design.
    • check-rsr-profile.sh and check-standards-map.sh: Gate D, 124 records.
    • check-uuid-v8.sh --strict, and uuid-v8-test.sh with PASS=32.
    • Each check's positive control tripped.
  • Measured, not affirmed: check-ijson-jcs.sh (report-only) found 0 of 62 JSON files canonical.
  • Failing locally (rc=1): build-registry.sh --check reports DRIFT. The registry and scorecard tests report 7 passed / 2 failed each, and three scorecard rows claim PASS while their check exits 1.
  • CI at the anchor (69 check runs, paginated): 48 success, 13 skipped, 8 failure. The 8 are SonarCloud, five mirror jobs, Registry + topology in sync and Repo self-tests. All 8 were already failing at 85aa1934, and none is required. All three required contexts passed.

Checklist

  • My commits are signed: the owner signed the head with git commit -S via owner-actions.sh reanchored. Claude made no commit. Before opening this PR, the opener checked that git log -1 --format=%G? prints G on the head; it refuses to open the PR otherwise.
  • I ran the project's own checks/tests locally: the battery above, at the anchor. Two of them fail, and the file records both failures as failures.
  • New files carry the correct SPDX-License-Identifier: both files are prose and start with // SPDX-License-Identifier: CC-BY-SA-4.0. No existing file was relicensed.
  • Docs are updated, and no public claim now overstates what the code does. The file refutes the 10-07 file's toolchain row (ugrep and bfs were shell wrappers; the scripts ran GNU grep and find) and moves it out of "We affirm".
  • I have not introduced a soundness hole: no code, canon or check changed.

Notes for reviewers

Deferred red check (§5c): Registry + topology in sync fails on this head (7677344) and at the anchor 6d19ce0e alike. It is the registry drift that the file itself records, it is not required, and this PR does not change it. Tracked in #1161 (section 2).

Deferred red check (§5c): Repo self-tests fails on this head and at the anchor alike, on the same assertion: scripts/tests/build-registry-test.sh reports 7 passed, 2 failed (job 113745995059 here, 113612738347 at the anchor). This is the same registry drift, tracked in #1161; #1174 attributes this self-test failure to it. Not required, and not changed by this PR.

This lands only while main is still 6d19ce0e. If main has moved, do not merge and do not press Update branch; ask for a re-anchor. main requires linear history and allows squash only. The three required contexts are not strict, so automerge is deliberately not armed: it would fire after main moved. There is no pull-request rule and no signatures rule (read 2026-10-09). Branch-Floor (deletion + non_fast_forward, ruleset 24339404) was re-enabled at the owner's request at 2026-10-09T08:45Z. It does not block a fast-forward.

The file names two landings that keep it anchored. The owner chose the fast-forward (2026-10-09). The squash is kept below only as the fallback.

  1. Fast-forward (chosen). The commit on main is the signed commit itself, and the push fails safe:
    • Run bash owner-actions.sh land-standards. It re-reads main's required contexts and checks each one on this PR's head: the latest check run, or failing that the legacy status. It refuses until all three have passed.
    • It then runs git push origin <head>:refs/heads/main, without --force. Git refuses the push if main has moved.
    • Check with git log --show-signature -1 origin/main and git rev-parse origin/main^, which should print the anchor.
    • Untested here: that GitHub accepts this push on the strength of check runs from the PR, and how it records this PR afterwards.
  2. Squash (the tested route; fails silently if main moves first, which is what happened to docs(affirmation): refresh the standards affirmation at 85aa1934 #1203):
    • Re-read git ls-remote origin refs/heads/main immediately before, and merge this PR alone.
    • Afterwards run bash scripts/verify-affirmation-anchor.sh hyperpolymath/standards <N> 6d19ce0ebae047027dcfd594c7810bf35c642faa. It should print ANCHORED.

🤖 Generated with Claude Code

https://claude.ai/code/session_013omQK26s4uDjJMkdqNEvEG

Drafted by Claude from local runs at the anchor; affirmed by the owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013omQK26s4uDjJMkdqNEvEG
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
@coderabbitai

coderabbitai Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 50a4eafa-2794-46d1-a1b7-787b02458661

📥 Commits

Reviewing files that changed from the base of the PR and between 6d19ce0 and 7677344.


📒 Files selected for processing (2)
  • docs/AFFIRMATION.adoc
  • docs/affirmations/AFFIRMATION-2026-10-07.adoc


  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

K9 contract conformance

run https://github.com/hyperpolymath/standards/actions/runs/37907987240

K9 normative contract typecheck

k9_contract.ncl typechecks

K9 contract self-test

== the bash mirrors cannot drift from the normative contract ==
ok   leash_levels mirrors k9_contract.ncl
ok   core_capabilities mirrors k9_contract.ncl
ok   contract_version mirrors k9_contract.ncl
ok   schema_major mirrors k9_contract.ncl
== capability arithmetic (§8) ==
ok   capability_ok fs.read accepted
ok   capability_ok rollback.apply accepted
ok   capability_ok x-acme.gpu.alloc accepted
ok   capability_ok x-acme rejected
ok   capability_ok x-.gpu rejected
ok   capability_ok fs.delete rejected
ok   capability_ok  rejected
== the extractor ==
ok   extracts pedigree.security.leash
ok   extracts pedigree.component_type
ok   extracts pedigree.metadata.name
ok   pedigree leash is not reported as top-level leash
ok   required_capabilities for a quiet component
ok   required_capabilities follows allow_network
== the envelope strip keeps line numbers (§3.6) ==
ok   line 1 becomes a comment
ok   line count is preserved
ok   schema_version stays on line 5
== L3: signature presence is not verification (§10) ==
ok   no verifier -> K9-C001 is SKIPPED, never a pass
ok   the skip states presence does not authorise 'Hunt
ok   verifier accepts -> verdict 'Verified, no K9-C001 finding
ok   verifier refuses -> K9-C001 error, verdict 'Rejected
== the fixture runner's attribution cannot be fooled by a filename ==
ok   every extracted finding is well-formed rule+layer
ok   the rule that really fired is attributed
ok   a rule named only in the filename is NOT attributed
ok   K9-C001 is present as a skipped finding
ok   and that same finding is NOT extractable as a rejection
== no Nickel reserved word is used as an identifier ==
ok   the contract and all 27 fixtures avoid Nickel's reserved words

self-test: all assertions passed

K9 conformance fixtures

== positive controls (must pass) ==
ok   extension-capability.k9.ncl
ok   extension-fields.k9.ncl
ok   hunt-fully-granted.k9.ncl
ok   kennel-data.k9.ncl
ok   library-base.ncl
ok   yard-typed-config.k9.ncl

== negative controls (must fail, by the named rule) ==
ok   L0-K9-E001-bad-magic.k9.ncl (rejected by K9-E001 at L0)
ok   L0-K9-E002-nul-byte.k9.ncl (rejected by K9-E002 at L0)
ok   L0-K9-E003-crlf.k9.ncl (rejected by K9-E003 at L0)
ok   L0-K9-E004-no-spdx.k9.ncl (rejected by K9-E004 at L0)
ok   L0-K9-E005-unclaimed-body.k9.ncl (rejected by K9-E005 at L0)
ok   L0-K9-S012-library-with-pedigree.ncl (rejected by K9-S012 at L0)
ok   L0-K9-S014-stray-leash.ncl (rejected by K9-S014 at L0)
ok   L1-K9-S001-no-pedigree.k9.ncl (rejected by K9-S001 at L1)
ok   L1-K9-S002-wrong-major.k9.ncl (rejected by K9-S002 at L1)
ok   L1-K9-S003-todo-component-type.k9.ncl (rejected by K9-S003 at L1)
ok   L1-K9-S004-unknown-leash.k9.ncl (rejected by K9-S004 at L1)
ok   L1-K9-S005-missing-name.k9.ncl (rejected by K9-S005 at L1)
ok   L1-K9-S006-unknown-capability.k9.ncl (rejected by K9-S006 at L1)
ok   L1-K9-S007-ungranted-flag.k9.ncl (rejected by K9-S007 at L1)
ok   L1-K9-S008-hunt-signature-not-required.k9.ncl (rejected by K9-S008 at L1)
ok   L1-K9-S009-hunt-no-signature-block.k9.ncl (rejected by K9-S009 at L1)
ok   L1-K9-S010-hunt-empty-side-effects.k9.ncl (rejected by K9-S010 at L1)
ok   L1-K9-S011-recipes-at-yard.k9.ncl (rejected by K9-S011 at L1)
ok   L1-K9-S013-dangling-import.k9.ncl (rejected by K9-S013 at L1)
ok   L2-K9-N001-two-segment-version.k9.ncl (rejected by K9-N001 at L2)
ok   L2-K9-N001-wrong-field-type.k9.ncl (rejected by K9-N001 at L2)

fixtures: 6 positive, 21 negative (0 needing nickel), 0 failure(s)

K9 corpus conformance (L2)

[validate-k9] debt rhodium-standard-repositories/rsr-compliance-checklist.k9.ncl (fail) — K9-N001 K9-S004 K9-S005 K9-S014 (grandfathered; touching it makes it blocking)
[validate-k9] 14 conforming, 1 grandfathered (layer all, contract v1.0.0)

@sonarqubecloud

sonarqubecloud Bot commented Oct 9, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath merged commit 7677344 into main Oct 9, 2026
65 of 67 checks passed
@hyperpolymath
hyperpolymath deleted the docs/affirmation-reanchor-2026-10-09 branch October 9, 2026 09:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant