Repository navigation
🔧 CodeRabbit CI Fix: Fix failing CI checks across governance, self-tests, and K9-SVC validation - #1325
Merged
Conversation
…sts, and K9-SVC validation <!-- coderabbit-ai-generated:v1 -->
3 tasks done
Contributor
Author
|
Important Review skippedThis PR was authored by the user configured for CodeRabbit reviews. CodeRabbit does not review PRs authored by this user. It's recommended to use a dedicated user account to post CodeRabbit review feedback. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
🟢 conformant · commit
K9 live corpus (L0–L2): 2 finding(s) / scope notes
Scope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run. |
|
hyperpolymath
approved these changes
Oct 23, 2026
hyperpolymath
added a commit
that referenced
this pull request
Oct 23, 2026
…1234 convergence script (#1326) ## Summary Follow-up to merged PRs `#1324` and `#1325` addressing all post-merge review findings from Codex and CodeRabbit across the **D303/D304** R2 encrypted bundle mirror workflow, the **#1234 / #306** close-out report, and `scripts/triage-2026-10-23-issue-1234-apply.sh`: ### 1. Cloudflare R2 Encrypted Bundle Mirror (`D303` / `D304`) - **Immutable snapshot keys (`mirror-reusable.yml`):** Uploads each age-encrypted bundle to `s3://${R2_BUCKET}/${MIRROR_ORG}/${REPO_NAME}/snapshots/${BUNDLE_TS}-${COMMIT_SHA}.bundle.age` in addition to updating `latest.bundle.age`, ensuring force-pushes or ref deletions do not overwrite prior recovery bundles even when R2 object versioning is not enabled. - **Validation & `zizmor` hardening (`mirror-reusable.yml`):** Adds `name: Mirror encrypted bundle to Cloudflare R2`, rejects dots in R2 bucket names (`^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$`), and permits `.us` jurisdiction endpoints alongside `.eu` and `.fedramp`. - **Caller wiring (`mirror.yml` & `actions.lock`):** Repins `.github/workflows/mirror.yml` to `70019048f862250c04346f27e6ca196ff7aa187a`, explicitly forwards `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, and `R2_AGE_RECIPIENT`, and closes `.github/workflows/actions.lock` via `scripts/close-lock.sh`. - **Docs & Security Test Suite (`docs/MIRROR-HOST-VERIFICATION.adoc`, `scripts/tests/science-ci-security-test.rb`):** Documents explicit caller `secrets:` mappings and asserts command order (`encrypt < remove plaintext < upload`), snapshot key presence, `.us` endpoint acceptance, and dot-in-bucket rejection. ### 2. `#1234` Convergence Script (`scripts/triage-2026-10-23-issue-1234-apply.sh`) - **Resumable / idempotent PR loops:** Checks default-branch convergence first and uses `git ls-remote --exit-code --heads origin <branch>` + `ensure_open_pr` so interrupted runs can be safely re-run without failing at `git push`. - **A2 (`D14`):** Adds `hyperpolymath/echidna` stub cleanup removing only `fuzz/fuzz_targets/fuzz_input.rs` while retaining its 3 real fuzz targets (`fuzz_aspect_tagging.rs`, `fuzz_concept_Arena.rs`, `fuzz_dispatch.rs`). - **A3 (`D24`):** Updates `metadatastician/knot-knot` `.github/workflows/pages.yml` on branch `chore/d24-publish-knot-lab-pages` to overlay `www/public/` (`knot-lab/index.html`) and `www/.well-known/` into `_site/` (`include-hidden-files: true`) alongside enabling GitHub Pages. - **B / `D332`:** Queries `orgs/metadatastician/installations` (compatible with classic owner PATs carrying `admin:org`, failing closed in live mode if inaccessible) and, once app `1561` is uninstalled, iterates over all **95** active repositories (`65` `hyperpolymath` + `30` `metadatastician`) to remove `.github/settings.yml`. - **Gated tracker closure:** Tracks pending convergence counts (`A1_PENDING`, `A5_PENDING`, `A2_PENDING`, `A3_PENDING`, `D332_PENDING`) and only closes `#306` / `#1234` when all prerequisites are verified converged on default branches. ### 3. Close-Out Report & Triage Docs (`ISSUE-1234-CLOSEOUT-REPORT.adoc`, `issue-triage-1049-1234.adoc`) - Reconciles **A4 (`D97` / `D355`)** transfer-tier counts (`Tier 4 = 25` distinct non-Tier-2 flagships, `Tier 5 = 271` standalone active repos; `3 + 3 + 12 + 43 + 25 + 271 = 357`). - Updates the 95-repo **D332** census list (`65` `hyperpolymath`, `30` `metadatastician`) to match live `HEAD:.github/settings.yml` GraphQL verification. ## Test Plan - `bash scripts/tests/triage-2026-10-23-issue-1234-apply-test.sh` - `bash scripts/triage-2026-10-23-issue-1234-apply.sh --dry-run` - `bash scripts/close-lock.sh --check .github/workflows/actions.lock` - `bash .githooks/docstring-scan.sh --staged` - `bash .githooks/validate-bot-directives.sh --staged` --------- Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI failure fixes was requested by @hyperpolymath.
The following files were modified:
docs/reorg/2026-10-14-tidy/ISSUE-1234-CLOSEOUT-REPORT.adoc