Skip to content

Commit eb7f676

Browse files
hyperpolymathhyperpolymath
authored
Merge branch 'main' into claude/awesome-mendel-tHDLR
2 parents 12d3b7c + 142dd7a commit eb7f676

2,766 files changed

Lines changed: 7905 additions & 3947 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/hypatia-scan-reusable.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,17 @@ permissions:
8181
# "Resource not accessible by integration" and (absent continue-on-error)
8282
# hard-fails the scan — exactly what the gate-decoupling design forbids.
8383
pull-requests: write
84+
# actions: read lets `codeql-action/upload-sarif` call
85+
# GET /repos/{owner}/{repo}/actions/runs/{run_id} to attach the SARIF
86+
# blob to the workflow run. Without it the upload step fails with
87+
# "Resource not accessible by integration" AFTER the scan + SARIF
88+
# conversion both succeed — symptoms observed across .git-private-farm
89+
# and other estate consumers since the SARIF upload was wired in.
90+
# Reusable workflow permission blocks OVERRIDE the caller's permission
91+
# block, so this MUST live here at source rather than at every
92+
# wrapper — adding it only at the wrapper is a no-op.
93+
# See .git-private-farm#69 for the reproducing logs.
94+
actions: read
8495

8596
jobs:
8697
scan:

‎.github/workflows/secret-scanner-reusable.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,21 @@ jobs:
7777

7878
gitleaks:
7979
runs-on: ${{ inputs.runs-on }}
80+
# Job-level permissions (narrower than granting these workflow-wide).
81+
# The other jobs (trufflehog / rust-secrets / shell-secrets) only need
82+
# `contents: read`, which they get from the workflow-level block.
83+
permissions:
84+
contents: read
85+
# gitleaks-action's `ScanPullRequest` posts a summary comment via
86+
# the GitHub Issues/PR API. Without `pull-requests: write` it fails
87+
# with "Resource not accessible by integration" AFTER the gitleaks
88+
# scan itself succeeds. Reusable-workflow permission blocks
89+
# OVERRIDE the caller's, so this MUST live here at source.
90+
# See .git-private-farm#69 for the reproducing logs.
91+
pull-requests: write
92+
# Additional API calls inside `ScanPullRequest` (workflow-run
93+
# metadata, PR-files endpoint) require `actions: read`.
94+
actions: read
8095
steps:
8196
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8297
with:

‎.machine_readable/6a2/STATE.a2ml‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
[metadata]
66
project = "standards"
77
version = "0.2.0"
8-
last-updated = "2026-04-04T00:00:00Z"
8+
last-updated = "2026-06-02T18:00:00Z"
99
status = "active"
10-
session = "converted from scheme — 2026-04-11"
10+
session = "2026-06-02 inbox cleanup + license-policy hardening + estate sweeps"
1111

1212
[project-context]
1313
name = "Standards"
@@ -34,5 +34,31 @@ actions = [
3434
]
3535

3636
[maintenance-status]
37-
last-run-utc = "2026-04-04T00:00:00ZT00:00:00Z"
38-
last-result = "unknown" # unknown | pass | warn | fail
37+
last-run-utc = "2026-06-02T18:00:00Z"
38+
last-result = "pass" # unknown | pass | warn | fail
39+
40+
[session-history-2026-06-02]
41+
session = "2026-06-02 inbox cleanup wave + license-policy hardening + estate sweeps"
42+
prs-merged = [
43+
"#338 docs(carveouts): add zotpress/** upstream-fork ReScript carve-out",
44+
"#339 docs(policy): top-of-file 'License Policy — Manual Only' section + 5-way classification",
45+
"#340 ci(governance): allow Java in android/**/src/**/*.java (platform-required JVM shims)"
46+
]
47+
issues-still-open = [
48+
"#288 [campaign] Estate CodeQL weekly→monthly sweep (cut 3) — sweep RESUMED today 13:08Z, ~22h remaining at 7-min cadence",
49+
"#323 [standing] Estate CodeQL cron drift detection + 6-week budget review",
50+
"#324 [campaign] Long-tail non-canonical CodeQL cron sweep — corrected audit posted (17 not 86; no daily); long-tail sweep queued behind #288",
51+
"#331 [campaign] Estate boj-build.yml sweep — repair or retire"
52+
]
53+
estate-policy-changes = [
54+
"License auto-PR pipeline DISABLED at 3 layers: hypatia#414/#415 (SC-010 auto_fixable:false + license_finding_strategy) + gitbot-fleet#247 (dispatch-runner refusal + fix-script exit-1 banners) + standards#339 (CLAUDE.md top-of-file Manual-Only header)",
55+
"Trigger: neurophone#99 method-violation closed",
56+
"Verified by synthetic test: bash scripts/fix-license-hygiene.sh exits 1; SC-010 carries auto_fixable:false; dispatch-runner refuses license/spdx/pmpl/mpl-2/agpl/palimpsest categories",
57+
"Companion auto-remediation: hypatia#422 (WF024 chapel + WF025 cron-drift + BH008 inherited-debt) + gitbot-fleet#251 (5 fix scripts for chapel + codeql-cron-monthly)"
58+
]
59+
related-memories = [
60+
"[[estate-license-policy-umbrella]]",
61+
"[[no-automated-licence-edits]]",
62+
"[[pr-sweep-title-keyword-exclusion]]",
63+
"[[session_2026_06_02_inbox_root_cause_wave]]"
64+
]

‎0-ai-gatekeeper-protocol/.gitattributes‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# RSR-compliant .gitattributes
33

44
* text=auto eol=lf

‎0-ai-gatekeeper-protocol/.github/FUNDING.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# Funding platforms for hyperpolymath projects
33
# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
44

‎0-ai-gatekeeper-protocol/.github/dependabot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# Dependabot configuration for RSR-compliant repositories
33
# Covers common ecosystems - remove unused ones for your project
44

‎0-ai-gatekeeper-protocol/.github/workflows/governance.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# governance.yml — single wrapper calling the shared estate governance bundle
33
# in hyperpolymath/standards instead of carrying per-repo copies.
44
#

‎0-ai-gatekeeper-protocol/.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# Hypatia Neurosymbolic CI/CD Security Scan
33
name: Hypatia Security Scan
44

‎0-ai-gatekeeper-protocol/.github/workflows/instant-sync.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# Instant Forge Sync - Triggers propagation to all forges on push/release
33
name: Instant Sync
44

‎0-ai-gatekeeper-protocol/.github/workflows/jekyll-gh-pages.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
1+
# SPDX-License-Identifier: AGPL-3.0-or-later
22
# Sample workflow for building and deploying a Jekyll site to GitHub Pages
33
name: Deploy Jekyll with GitHub Pages dependencies preinstalled
44

0 commit comments

Comments
 (0)