Skip to content

fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only) - #733

Merged
hyperpolymath merged 1 commit into
mainfrom
fix/nix-is-not-a-fallback
Aug 28, 2026
Merged

fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)#733
hyperpolymath merged 1 commit into
mainfrom
fix/nix-is-not-a-fallback

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Mirrors hyperpolymath/standards#671, which removes the "; Nix fallback only" clause from criterion 1.2.1 per the owner ruling of 2026-08-27.

LANGUAGE-POLICY.adoc §2.1 had already retired Nix estate-wide on 2026-06-01 — "It is not a tier and not a fallback" — but the criteria table never caught up.

test/fixtures/a2ml/rsr-criteria-v2.a2ml is a copy of the canon's SSOT. Leaving it behind would make the suite assert against a spec the canon no longer holds: passing while measuring the wrong thing, which is the failure a fixture copy exists to avoid.

Measured before the change: flake.nix exists in 0 of 381 local repos; guix.scm in 178. Nothing is stranded.

Verification

mix test test/a2ml/record_dialect_test.exs test/rules/rsr_conformance_test.exs24 tests, 0 failures.

Should land together with standards#671.

🤖 Generated with Claude Code

@gitar-bot

gitar-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

Gitar

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

Run reviewer

TIP This summary will be updated as you push new changes.

@coderabbitai

coderabbitai Bot commented Aug 27, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 51c207de-4135-454f-82f7-0b0cab22c638

📥 Commits

Reviewing files that changed from the base of the PR and between e40031e and a892c65.

📒 Files selected for processing (1)
  • test/fixtures/a2ml/rsr-criteria-v2.a2ml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (16)
  • GitHub Check: Rust Tests
  • GitHub Check: Integration Tests
  • GitHub Check: Codacy Static Code Analysis
  • GitHub Check: Generate SBOM
  • GitHub Check: Rust Dependency Audit
  • GitHub Check: Rust Dependency Audit
  • GitHub Check: Container Security (Trivy) (deploy/Containerfile)
  • GitHub Check: stress-test
  • GitHub Check: E2E — Rust CLI Scan
  • GitHub Check: Generate Rust SBOM
  • GitHub Check: Build AsciiDoc
  • GitHub Check: Build Rust - x86_64-pc-windows-msvc
  • GitHub Check: Build Rust - x86_64-apple-darwin
  • GitHub Check: Build Rust - aarch64-apple-darwin
  • GitHub Check: Build Rust - x86_64-unknown-linux-gnu
  • GitHub Check: Build AsciiDoc
⚠️ CI failures not shown inline (14)

GitHub Actions: Governance / 0_governance _ Validate Hypatia Baseline.txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run echo "Scanning repository: hyperpolymath/hypatia (checking baseline)"
 �[36;1mecho "Scanning repository: hyperpolymath/hypatia (checking baseline)"�[0m
 �[36;1m# Move the baseline filter OUT of the scanned tree, then delete the�[0m
 �[36;1m# standards checkout, so `hypatia scan .` only ever sees the CALLER's�[0m
 �[36;1m# own files. Without this, `.standards-checkout/` (the tooling we�[0m
 �[36;1m# checked out to get apply-baseline.sh) is itself scanned, and�[0m
 �[36;1m# standards' own files get reported as the caller's findings (a banned�[0m
 �[36;1m# `.ts`, `shell_download` bootstrap.sh scripts, etc.).�[0m
 �[36;1mcp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1m# hypatia's `scan` exits non-zero whenever it finds anything — that is�[0m
 �[36;1m# by design, and under `bash -e` it would abort this step at this line,�[0m
 �[36;1m# before the baseline filter (the real gate) ever runs. Tolerate the�[0m
 �[36;1m# scan's own exit code…�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.raw.json || true�[0m
 �[36;1m# …but never swallow a genuine scanner crash into a false pass: require a�[0m
 �[36;1m# valid JSON array before trusting the output as "the findings".�[0m
 �[36;1mif ! jq -e 'type == "array"' hypatia-findings.raw.json >/dev/null 2>&1; then�[0m
 �[36;1m  echo "::error::hypatia scan did not produce a valid JSON findings array (scanner error, not a baseline result)"�[0m

GitHub Actions: Governance / governance _ Validate Hypatia Baseline: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run echo "Scanning repository: hyperpolymath/hypatia (checking baseline)"
 �[36;1mecho "Scanning repository: hyperpolymath/hypatia (checking baseline)"�[0m
 �[36;1m# Move the baseline filter OUT of the scanned tree, then delete the�[0m
 �[36;1m# standards checkout, so `hypatia scan .` only ever sees the CALLER's�[0m
 �[36;1m# own files. Without this, `.standards-checkout/` (the tooling we�[0m
 �[36;1m# checked out to get apply-baseline.sh) is itself scanned, and�[0m
 �[36;1m# standards' own files get reported as the caller's findings (a banned�[0m
 �[36;1m# `.ts`, `shell_download` bootstrap.sh scripts, etc.).�[0m
 �[36;1mcp .standards-checkout/scripts/apply-baseline.sh "$RUNNER_TEMP/apply-baseline.sh"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1m# hypatia's `scan` exits non-zero whenever it finds anything — that is�[0m
 �[36;1m# by design, and under `bash -e` it would abort this step at this line,�[0m
 �[36;1m# before the baseline filter (the real gate) ever runs. Tolerate the�[0m
 �[36;1m# scan's own exit code…�[0m
 �[36;1mHYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.raw.json || true�[0m
 �[36;1m# …but never swallow a genuine scanner crash into a false pass: require a�[0m
 �[36;1m# valid JSON array before trusting the output as "the findings".�[0m
 �[36;1mif ! jq -e 'type == "array"' hypatia-findings.raw.json >/dev/null 2>&1; then�[0m
 �[36;1m  echo "::error::hypatia scan did not produce a valid JSON findings array (scanner error, not a baseline result)"�[0m

GitHub Actions: Governance / 5_governance _ Well-Known (RFC 9116 + RSR).txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1mSCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m# Self-hosting fallback: when THIS repository is standards, its own�[0m
 �[36;1m# working tree already holds the script, and during a rename that copy�[0m
 �[36;1m# is the only correct one — the pinned main checkout still has the old�[0m
 �[36;1m# name. Preferring the fetched copy keeps every other caller on the�[0m
 �[36;1m# canonical version.�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f scripts/check-workflow-duplicate-keys.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / governance _ Workflow security linter: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run if [ -f .github/workflows/actions.lock ]; then
 �[36;1mif [ -f .github/workflows/actions.lock ]; then�[0m
 �[36;1m  # The lockfile records transitive dependency evidence, while direct�[0m
 �[36;1m  # workflow references remain visibly SHA-pinned. Keep both layers:�[0m
 �[36;1m  # external analysers and GitHub's sha_pinning_required setting do�[0m
 �[36;1m  # not infer direct pins from actions.lock.�[0m
 �[36;1m  gh extension install github/gh-actions-lock�[0m
 �[36;1m  bash scripts/update-actions-lock.sh --verify-local�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: direct workflow references not SHA-pinned:"�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "Lockfile coverage verified; direct references SHA-pinned"�[0m
 �[36;1melse�[0m
 �[36;1m  unpinned=$(grep -rnE --include='*.yml' --include='*.yaml' \�[0m
 �[36;1m    "^[[:space:]]+uses:" .github/workflows/ | \�[0m
 �[36;1m    grep -v "@[a-f0-9]\{40\}" | \�[0m
 �[36;1m    grep -v "uses: \./\|uses: docker://\|uses: actions/github-script\|uses: hyperpolymath/standards/" || true)�[0m
 �[36;1m  if [ -n "$unpinned" ]; then�[0m
 �[36;1m    echo "ERROR: no .github/workflows/actions.lock in THIS TREE, and these refs are not SHA-pinned."�[0m
 �[36;1m  echo "  Prefer \`gh actions-lock\` — it also locks the transitive dependencies"�[0m
 �[36;1m  echo "  of composite actions, which an inline SHA cannot express."�[0m
 �[36;1m  echo "  Do NOT do both: gh actions-lock refuses a ref no tag or branch contains,"�[0m
 �[36;1m  echo "  so inline pinning REMOVES actions from the lockfile."�[0m
 �[36;1m    echo "$unpinned"�[0m
 �[36;1m    exit 1�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "All ...

GitHub Actions: Governance / 9_governance _ Security policy checks.txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 10_governance _ Allowlist Preflight.txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/hypatia
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / governance _ Allowlist Preflight: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run rm -rf .standards-checkout
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-actions-policy.sh" \�[0m
 �[36;1m  "$GITHUB_REPOSITORY" "$RUNNER_TEMP/allowed-actions.json"�[0m
 shell: /usr/bin/bash -e {0}
 env:
   GH_***REDACTED_SECRET_ASSIGNMENT***
 gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
   env:
     GH_***REDACTED_SECRET_ASSIGNMENT*** github.token }}
 ERROR: could not read live Actions permissions for hyperpolymath/hypatia
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / 11_governance _ Exemption ratchet.txt: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Stage the script OUT of the scanned tree and delete the checkout,�[0m
 �[36;1m# so the ratchet only ever reads the CALLER's ledgers — standards has�[0m
 �[36;1m# ledgers of its own and they are not this repository's.�[0m
 �[36;1m# Both files: the ratchet calls count-ledger-entries.sh as a sibling,�[0m
 �[36;1m# and it has no fallback if the counter is missing — deliberately.�[0m
 �[36;1mcp .standards-checkout/scripts/check-exemption-ratchet.sh \�[0m
 �[36;1m   .standards-checkout/scripts/count-ledger-entries.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-exemption-ratchet.sh" \�[0m
 �[36;1m  "e40031e44ad3b571631c828e8d17e626ca27d69e"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Exemption ratchet — comparing against e40031e44ad3b571631c828e8d17e626ca27d69e
   unchanged      .hypatia-baseline.json: 45
   unchanged      .hypatia-ignore: 1
   unchanged      .gitleaks.toml: 4
   ANONYMOUS      .hypatia-baseline.json: 44 entr(y|ies) carry neither a note nor a tracking_issue
                  Every exemption must say what it is. Add `note` explaining
                  what the finding actually is, or `tracking_issue` naming the
                  work that discharges it.
 Exemption ratchet: FAILED.
 An exemption ledger grew, or an exemption does not say what it is.
 If the growth is correct — a newly vendored dependency, a newly discovered
 architectural boundary — declare it in the commit message:
     Ratchet-exception: vendored upstream foo/ at v1.2.3; its test corpus
     contains credential-shaped fixtures by design
 If it is not correct, remove the finding rather than the report.
 ##[error]Process completed with exit code 1.

GitHub Actions: Governance / governance _ Exemption ratchet: fix(fixtures): sync criterion 1.2.1 with the standards SSOT (Guix only)

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Stage the script OUT of the scanned tree and delete the checkout,�[0m
 �[36;1m# so the ratchet only ever reads the CALLER's ledgers — standards has�[0m
 �[36;1m# ledgers of its own and they are not this repository's.�[0m
 �[36;1m# Both files: the ratchet calls count-ledger-entries.sh as a sibling,�[0m
 �[36;1m# and it has no fallback if the counter is missing — deliberately.�[0m
 �[36;1mcp .standards-checkout/scripts/check-exemption-ratchet.sh \�[0m
 �[36;1m   .standards-checkout/scripts/count-ledger-entries.sh "$RUNNER_TEMP/"�[0m
 �[36;1mrm -rf .standards-checkout�[0m
 �[36;1mbash "$RUNNER_TEMP/check-exemption-ratchet.sh" \�[0m
 �[36;1m  "e40031e44ad3b571631c828e8d17e626ca27d69e"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 Exemption ratchet — comparing against e40031e44ad3b571631c828e8d17e626ca27d69e
   unchanged      .hypatia-baseline.json: 45
   unchanged      .hypatia-ignore: 1
   unchanged      .gitleaks.toml: 4
   ANONYMOUS      .hypatia-baseline.json: 44 entr(y|ies) carry neither a note nor a tracking_issue
                  Every exemption must say what it is. Add `note` explaining
                  what the finding actually is, or `tracking_issue` naming the
                  work that discharges it.
 Exemption ratchet: FAILED.
 An exemption ledger grew, or an exemption does not say what it is.
 If the growth is correct — a newly vendored dependency, a newly discovered
 architectural boundary — declare it in the commit message:
     Ratchet-exception: vendored upstream foo/ at v1.2.3; its test corpus
     contains credential-shaped fixtures by design
 If it is not correct, remove the finding rather than the report.
 ##[error]Process completed with exit code 1.
🔇 Additional comments (1)
test/fixtures/a2ml/rsr-criteria-v2.a2ml (1)

92-92: 🗄️ Data Integrity & Integration

No detector change is required. Hypatia.Rules.RsrConformance evaluates criterion 1.2.1 with any_of(["guix.scm", "build/guix.scm"]). A Nix-only repository therefore fails. BuildSystemRules has no guix_primary detector; the detect value is catalogue metadata, not the scoring dispatch.


📝 Walkthrough

Summary by CodeRabbit

  • Documentation
    • Clarified criterion 1.2.1 to specify Guix as the sole reproducible build method, replacing the previous allowance for a Nix fallback.

Walkthrough

Criterion 1.2.1 now requires Guix as the sole reproducible build method. Its other fields remain unchanged.

Changes

Guix criterion update

Layer / File(s) Summary
Update reproducible build description
test/fixtures/a2ml/rsr-criteria-v2.a2ml
Criterion 1.2.1 removes the Nix fallback from its description.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to a892c

This localized fixture update aligns criterion 1.2.1 with the current standard without changing detector behavior; the targeted tests pass, and no actionable merge-blocking risk remains after normal checks.

Poem

A rabbit checked the Guix note
The Nix fallback sailed afloat
One clear build path now appears
With tidy fields and no new fears
Hop, hop, the fixture is right

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Linked Issues check ⚠️ Warning The pull request does not implement issue #39, which requires upgrading erlef/setup-beam from 1.17.5 to 1.20.4 and preserving workflow compatibility. Update the relevant GitHub Actions workflow to use erlef/setup-beam 1.20.4. Preserve existing workflow behaviour and verify CI compatibility.
Out of Scope Changes check ⚠️ Warning The fixture change is unrelated to the linked issue #39, which concerns a GitHub Actions dependency upgrade. Remove the unrelated fixture synchronisation from this pull request, or link it to the appropriate standards or fixture-tracking issue. Keep this pull request focused on the erlef/setup-beam upgrade.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly describes the fixture synchronisation and the removal of the Nix fallback clause.
Description check ✅ Passed The description explains the fixture synchronisation, its standards source, and the verification results.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codacy-production codacy-production Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This pull request synchronizes the local RSR criteria fixture with the global standards by updating the description for criterion 1.2.1. Specifically, it removes the Nix fallback reference and designates the criterion as '(Guix only)', reflecting the project's retirement of Nix.

Codacy analysis indicates that the changes are up to standards with no new quality issues or complexity regressions. However, there are no accompanying unit or integration tests provided to verify that the A2ML parser or RSR conformance logic correctly handles these modified descriptions and enforces the Guix-only constraint.

Test suggestions

  • Verify that the A2ML parser correctly loads the modified criterion description without syntax errors.
  • Verify that RSR conformance tests correctly evaluate repositories against the updated Guix-only criterion and no longer accept Nix fallbacks.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that the A2ML parser correctly loads the modified criterion description without syntax errors.
2. Verify that RSR conformance tests correctly evaluate repositories against the updated Guix-only criterion and no longer accept Nix fallbacks.

TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback

Mirrors hyperpolymath/standards fix/nix-is-not-a-fallback, which removes the
"Nix fallback only" clause from criterion 1.2.1 per the owner ruling of
2026-08-27. LANGUAGE-POLICY 2.1 had already retired Nix estate-wide on
2026-06-01 ("not a tier and not a fallback"); the criteria table had not caught
up.

This fixture is a copy of the canon's rsr-criteria-v2.a2ml. Leaving it behind
would make the suite assert against a spec the canon no longer holds — passing
while measuring the wrong thing, which is the failure a fixture copy exists to
avoid.

Verified: mix test test/a2ml/record_dialect_test.exs
test/rules/rsr_conformance_test.exs — 24 tests, 0 failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@hyperpolymath
hyperpolymath force-pushed the fix/nix-is-not-a-fallback branch from a892c65 to cb30dc0 Compare August 28, 2026 00:00
@hyperpolymath
hyperpolymath merged commit ff4a2b8 into main Aug 28, 2026
59 of 71 checks passed
@hyperpolymath
hyperpolymath deleted the fix/nix-is-not-a-fallback branch August 28, 2026 00:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant