fix(ci): adopt upstream CI-honesty gates — dogfood-gate exits on real faults, hypatia opt-in gate, fail-fixture proofs (#49) - #98
Merged
Conversation
…hypatia (issue #49) The 2026-07-17 failure-path audit found checks that CANNOT fail when something is wrong. The template origin (rsr-template-repo / standards#hypatia-scan-reusable) has since been repaired; this change adopts those fixes here, per the issue's fix-at-origin-then-fan-out rule: * empty-lint: 🔴 GATE — runs the shared byte-safe scanner (scripts/check-invisible-characters.sh, verbatim from rsr-template-repo) and EXITS 1 on blocking (C0/NUL) findings; a scanner failure exits 2 instead of silently passing. (Pre-fix: 'set +e' + ::warning annotations only — could never fail.) * groove-check: 🟡 CHECK — gate logic extracted to scripts/check-groove-manifest.sh; an INVALID manifest now exits 1 (pre-fix: ::error annotation on a still-green job). Missing-endpoint advisories stay advisories and say so. * dogfood-summary: ℹ️ ADVISORY — labelled non-gating in the job name and the scorecard, so green is never mistaken for enforcement. * hypatia-scan: adds the estate-reusable's block-on-high gate as an opt-in (repository variable HYPATIA_BLOCK_ON_HIGH=true), logic in scripts/check-hypatia-findings.sh; advisory step relabelled '(ADVISORY — does not gate)' and suppressed when the gate is on. * gate-self-test job: scripts/test-ci-honesty.sh runs every gate's REAL logic against fixtures that MUST pass and MUST FAIL, plus structural drift checks that the workflows still wire the gates in. A future edit that re-fakes a gate turns CI red. * just test-ci-honesty + .github/workflows/README.md gate-honesty docs. Part of issue #49 (codeql rust coverage landed in #61; README scorecard reference previously removed; contractile drift resolved by the 2026-08-01 decision record).
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (8)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
hyperpolymath
added a commit
that referenced
this pull request
Sep 22, 2026
…ge format, provisioner, harness, minter (#33) (#99) ## What Foundation for the λδ plugin system + wizard of #33 — the two fundamentals the issue says must land early ("capability model" + "package format", because they shape the kernel/host seam), plus the author loop, without touching kernel semantics. **Dependency map (upstream/cross-dependency):** - ⬆️ Built *on* the merged L0 kernel (#35), L1 formula context (#48), macros+multimethods (#43), and the notebook host seam (#36) — the issue's "post-L0" precondition. - 🔀 Aligned with the sibling conventions the issue points at: manifest fields mirror **BoJ** `cartridge.json` (`name`/`version`/`spdx`/`tier`/`description`), tiers `teranga/shield/ayo` come from **PanLL** `src/abi/cartridge-schema.json`, and the minter mirrors `panll/contracts/minter.toml`'s scaffold role. - ⬇️ Unblocks later layers: provisioner host-prompt + install receipts, configurator UI, registry, wizard (all documented in the new design doc). - Independent of PR #98 (CI honesty) by design — disjoint files. ### Shipped foundation | Component | Where | State | |---|---|---| | Capability model | `core/src/lambdadelta/capability.rs` | `:notes/read` `:notes/write` `:agents/run`; `allows`/`missing`/`require`; agents-run ⇒ notes-read | | Host enforcement | `lambdadelta_host::register_gated` | grant check runs BEFORE the notebook is touched → structured `LdError::Capability`, never a panic, never a partial effect | | Package format | `core/src/lambdadelta/package.rs` | homoiconic `manifest.ld` (λδ map via the ordinary reader — no second parser); typed `:config` schema + `resolve_config` | | Provisioner (pure core) | `core/src/lambdadelta/provisioner.rs` | **total refusal** when requested ⊄ granted (`missing` names the delta); grants exactly what was requested | | Harness | `core/src/lambdadelta/harness.rs` | closure-registered sandbox (kernel never depends on a host); `assert-eq`/`assert` *record* (never abort); eval errors become failed assertions | | Minter | `scripts/ld-mint.js` + `just ld-new` | scaffolds `plugins/<name>/`; ESM, runs on Bun + Node | | Reference package | `plugins/word-count/` | **minted by the minter** (dogfood) | | End-to-end proof | `core/tests/lambdadelta_plugin_system.rs` | manifest validates → provisions → runs green vs fixture notebook; partial grants refused; read-only sandbox denies the plugin's mutation | | Design doc | `docs/design/lambdadelta-plugin-system.adoc` | four components + wizard, tier/trust model, deferred items | This discharges the spec §7 proof obligation for the gated path — "capability non-escalation … until authority is represented and checked at dispatch": authority is now represented (`CapabilitySet`) and checked at every gated dispatch. ### Deferred (explicit, documented in the design doc) Configurator UI (schema + validation already done), provisioner host-prompt + install receipts, registry, signing/provenance (estate-level open question), and the wizard itself (presentation glue over the now-existing components). ### Verification - `cargo test`: 118 tests green (incl. new integration suite + doctests); `clippy --all-targets --features wasm -D warnings` clean; wasm32 build clean; `cargo fmt --check` clean. - The estate's byte-safe invisible-character scanner: 0 blocking hits across the new files; SPDX headers on all new source files. - `node --check scripts/ld-mint.js`; minter exercised end-to-end (minted word-count → integration test runs it). Refs #33 Co-authored-by: Arena Agent <agent@arena.ai>
Open
4 tasks
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adopts the CI-honesty fixes for this repo's "checks that cannot fail" — the fan-out step of #49, now that the template origins are repaired upstream.
Dependency map (upstream / downstream):
rsr-template-repobyte-safe empty-linter +scripts/check-invisible-characters.sh(adopted verbatim here);standardshypatia-scan-reusable.ymlblock-on-highinput (mirrored here as an opt-in repo variable); and the last combined-template gap → rsr-template-repo#190 (this PR's groove-adoption matches it).Gate tiers (the estate's 🔴/🟡/ℹ️ taxonomy)
empty-lintset +e, only::warning::— could never failgroove-check::errorannotations on a still-green jobscripts/check-groove-manifest.sh); missing-endpoint stays a labelled advisorydogfood-summaryhypatia-scanblock-on-highasHYPATIA_BLOCK_ON_HIGHrepo variable (documented in.github/workflows/README.md); advisory step relabelled (ADVISORY — does not gate)Proven with fail fixtures (the acceptance criterion)
New
gate-self-testjob runsscripts/test-ci-honesty.sh(just test-ci-honestylocally): every gate's real logic (the exact scripts the workflows invoke) against fixtures that MUST pass and fixtures that MUST FAIL — NUL-byte fixture lands in blocking results, invalid groove manifest exits 1, blocked hypatia findings exit 1, malformed findings fail loudly (exit 2, never silently pass) — plus structural drift checks that the workflows still wire the gates in. If a future edit re-fakes a gate, CI goes red. Pre-fix run: 7 proofs failed; post-fix: all green.Acceptance checklist from #49
Notes
uses:refs touched →actions.lockstays valid.bun.lock/package.jsonuntouched.hypatia-scan.ymlis wholesale conversion to the thin standards-reusable caller (like the template); deliberately not done here to preserve the fleet-learning submit + PR-comment integrations.Refs #49 · Upstream: hyperpolymath/rsr-template-repo#190 · Related: hyperpolymath/standards
hypatia-scan-reusable.yml