Merge branch 'main' into fix/gbf-legacy-findings-resolve-at-source

Author: hyperpolymath

.github/workflows/hypatia-scan.yml

@@ -10,13 +10,25 @@ on:
   schedule:
     - cron: '0 0 * * 0'  # Weekly on Sunday
   workflow_dispatch:
+# Estate guardrail: cancel superseded runs so re-pushes don't pile up
+# queued runs across the estate. Safe here because this workflow only
+# performs read-only checks/lint/test/scan with no publish or mutation.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
-  # `pull-requests: write` is needed for the "Comment on PR with findings"
-  # step to POST a results summary. Note: on Dependabot PRs the token is
-  # downgraded to read-only regardless, so that step is also marked
-  # continue-on-error below.
+  # security-events: read lets the built-in GITHUB_TOKEN query this
+  # repo's own Dependabot alerts via the Hypatia DependabotAlerts rule
+  # (DA001-DA004). Without this, `scan_from_path` gets HTTP 403 and
+  # the rule silently returns no findings.
+  # See 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
+  security-events: read
+  # pull-requests: write lets the advisory "Comment on PR with findings"
+  # step post its summary. Without it the built-in GITHUB_TOKEN gets
+  # "Resource not accessible by integration" and (absent continue-on-error)
+  # hard-fails the scan — exactly what the gate-decoupling design forbids.
   pull-requests: write
 
 jobs:
@@ -26,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0  # Full history for better pattern analysis
 
@@ -36,17 +48,9 @@ jobs:
           elixir-version: '1.19.4'
           otp-version: '28.3'
 
-      - name: Clone Hypatia (or use checkout when scanning hypatia itself)
-        env:
-          REPO: ${{ github.repository }}
+      - name: Clone Hypatia
         run: |
-          # When scanning hypatia from inside hypatia, point $HOME/hypatia
-          # at the PR/branch checkout instead of cloning main — otherwise
-          # CLI changes can never pass their own gate (the scanner binary
-          # would always come from main and ignore new flags).
-          if [ "$REPO" = "hyperpolymath/hypatia" ]; then
-            ln -sfn "${GITHUB_WORKSPACE}" "$HOME/hypatia"
-          elif [ ! -d "$HOME/hypatia" ]; then
+          if [ ! -d "$HOME/hypatia" ]; then
             git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia"
           fi
 
@@ -62,39 +66,16 @@ jobs:
       - name: Run Hypatia scan
         id: scan
         env:
-          # Suppress the "Warning: Dependabot alerts unavailable: GITHUB_TOKEN
-          # not set" line so the run is silent-warning-free. The token is
-          # read-only by default and only used to query Dependabot alerts.
+          # Pass the built-in Actions token through to Hypatia so the
+          # DependabotAlerts rule can query this repo's own alerts.
+          # For cross-repo scanning (fleet-coordinator scan-supervised),
+          # a PAT with `security_events` scope is required instead.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REPO: ${{ github.repository }}
         run: |
-          echo "Scanning repository: $REPO"
-
-          # Run scanner with --exit-zero so a findings-found exit-1 does
-          # NOT short-circuit the rest of this step under `set -e`. The
-          # downstream "Check for critical or high-severity issues" step
-          # is the explicit gate. See hyperpolymath/hypatia#213.
-          #
-          # Guard against the scanner producing no output (a crash, an
-          # unknown flag, etc.): if hypatia-findings.json is empty or
-          # missing after the run, fall back to "[]" so the jq calls
-          # below don't 9 the whole gate. We surface stderr so the
-          # underlying scanner failure is still visible in the log.
-          set +e
-          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero \
-            > hypatia-findings.json 2> hypatia-scan.stderr
-          SCAN_EXIT=$?
-          set -e
-          echo "Scanner exit: $SCAN_EXIT"
-          if [ -s hypatia-scan.stderr ]; then
-            echo "--- scanner stderr ---"
-            cat hypatia-scan.stderr
-            echo "--- end stderr ---"
-          fi
-          if ! jq empty hypatia-findings.json 2>/dev/null; then
-            echo "Scanner did not produce valid JSON; defaulting to empty findings."
-            echo "[]" > hypatia-findings.json
-          fi
+          echo "Scanning repository: ${{ github.repository }}"
+
+          # Run scanner (exits non-zero when findings exist — suppress to continue)
+          HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json || true
 
           # Count findings
           FINDING_COUNT=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0)
@@ -116,7 +97,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: hypatia-findings
           path: hypatia-findings.json
@@ -191,73 +172,31 @@ jobs:
           # Cleanup
           rm -rf "$FLEET_DIR"
 
-      - name: Check for critical or high-severity issues
-        if: steps.scan.outputs.critical > 0 || steps.scan.outputs.high > 0
-        env:
-          CRITICAL_COUNT: ${{ steps.scan.outputs.critical }}
-          HIGH_COUNT: ${{ steps.scan.outputs.high }}
+      - name: Check for critical issues
+        if: steps.scan.outputs.critical > 0
         run: |
-          echo "Total critical/high: $CRITICAL_COUNT critical, $HIGH_COUNT high"
-
-          # Baseline-aware gate: pre-existing accepted findings live in
-          # .hypatia-baseline.json (committed). New critical/high findings
-          # not in the baseline still fail the build. Findings are matched
-          # on (severity, rule_module, type, file) tuple with absolute
-          # build paths normalised to repo-relative.
-          if [ -f .hypatia-baseline.json ]; then
-            # Normalise + project just the comparable keys from the current scan.
-            jq '[ .[] | select(.severity == "critical" or .severity == "high")
-                       | {severity, rule_module, type,
-                          file: (.file | sub("^/home/runner/work/[^/]+/[^/]+/"; "")
-                                       | sub("^/github/workspace/"; "")),
-                          action} ]' hypatia-findings.json > findings-current.json
-
-            # Subtract baseline. A current finding is "new" iff there's no
-            # element in baseline equal to it (by-value).
-            jq --slurpfile base .hypatia-baseline.json \
-               '. as $cur | $cur | map(. as $f | select(($base[0] | any(. == $f)) | not))' \
-               findings-current.json > findings-new.json
-            new_count=$(jq 'length' findings-new.json)
-
-            if [ "$new_count" -gt 0 ]; then
-              echo "::error::$new_count new critical/high finding(s) outside the baseline:"
-              jq -r '.[] | "  [\(.severity)] \(.rule_module)/\(.type) — \(.file)"' findings-new.json
-              echo
-              echo "If these are intentional, regenerate .hypatia-baseline.json:"
-              echo "  jq '[.[] | select(.severity == \"critical\" or .severity == \"high\") | {severity, rule_module, type, file, action}] | sort_by(.severity, .rule_module, .type, .file)' hypatia-findings.json > .hypatia-baseline.json"
-              exit 1
-            fi
-            echo "All critical/high findings present in baseline — gate passes."
-          else
-            echo "No .hypatia-baseline.json — failing on any critical/high (legacy behaviour)."
-            echo "Review hypatia-findings.json for details"
-            exit 1
-          fi
+          echo "⚠️  Critical security issues found!"
+          echo "Review hypatia-findings.json for details"
+          # Don't fail the build yet - just warn
+          # exit 1
 
       - name: Generate scan report
-        env:
-          REPO: ${{ github.repository }}
-          SHA: ${{ github.sha }}
-          CRITICAL_COUNT: ${{ steps.scan.outputs.critical }}
-          HIGH_COUNT: ${{ steps.scan.outputs.high }}
-          MEDIUM_COUNT: ${{ steps.scan.outputs.medium }}
-          TOTAL_COUNT: ${{ steps.scan.outputs.findings_count }}
         run: |
           cat << EOF > hypatia-report.md
           # Hypatia Security Scan Report
 
-          **Repository:** $REPO
+          **Repository:** ${{ github.repository }}
           **Scan Date:** $(date -u +"%Y-%m-%d %H:%M:%S UTC")
-          **Commit:** $SHA
+          **Commit:** ${{ github.sha }}
 
           ## Summary
 
           | Severity | Count |
           |----------|-------|
-          | Critical | $CRITICAL_COUNT |
-          | High     | $HIGH_COUNT |
-          | Medium   | $MEDIUM_COUNT |
-          | **Total**| $TOTAL_COUNT |
+          | Critical | ${{ steps.scan.outputs.critical }} |
+          | High     | ${{ steps.scan.outputs.high }} |
+          | Medium   | ${{ steps.scan.outputs.medium }} |
+          | **Total**| ${{ steps.scan.outputs.findings_count }} |
 
           ## Next Steps
 
@@ -276,14 +215,13 @@ jobs:
           cat hypatia-report.md >> $GITHUB_STEP_SUMMARY
 
       - name: Comment on PR with findings
-        # Dependabot PRs always run with a read-only token regardless of the
-        # workflow's declared permissions, so the createComment call below
-        # would 403 on every dep-bump PR. The PR comment is informational
-        # (the check result is already visible in the PR UI); we don't want
-        # its absence to block merge.
         if: github.event_name == 'pull_request' && steps.scan.outputs.findings_count > 0
+        # Advisory only — posting findings as a PR comment must never gate
+        # the scan (hypatia#213 gate decoupling). Belt-and-braces alongside
+        # the pull-requests: write permission above: a token/API hiccup or
+        # a fork PR (read-only token) skips the comment, not the check.
         continue-on-error: true
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v7
         with:
           script: |
             const fs = require('fs');
@@ -313,4 +251,4 @@ jobs:
               repo: context.repo.repo,
               issue_number: context.issue.number,
               body: comment
-            });
+            });

.github/workflows/rsr-antipattern.yml

@@ -138,83 +138,6 @@ jobs:
           print(f"✅ No TypeScript files outside allowlist ({len(exemption_patterns)} per-repo exemption(s) parsed).")
           PYEOF
 
-          # Universal builtin allowlist — bridges that need no per-repo declaration.
-          # Files matching any of these patterns are always allowed.
-          BUILTIN_GLOBS = [
-              '*.d.ts',
-              '**/bindings/**',
-              '**/tests/**', '**/test/**',
-              '**/scripts/**',
-              '**/mcp-adapter/**',
-              '**/*vscode*/**',
-              '**/cli/**',
-              '**/mod.ts',
-              '**/lsp-server.ts', '**/lsp_server.ts', '**/lsp.ts', '**/*-lsp.ts',
-              '**/deno-*/**',
-              '**/node_modules/**',
-              '**/vendor/**',
-              '**/examples/**',
-              '**/ffi/**',
-          ]
-
-          # Per-repo exemptions parsed from .claude/CLAUDE.md "TypeScript Exemptions" table.
-          # Single source of truth — adding a row here unblocks CI for that path.
-          # Format expected:
-          #   ### TypeScript Exemptions ...
-          #   | Path | Files | Rationale | Unblock condition |
-          #   |---|---|---|---|
-          #   | `path/to/file.ts` | 1 | ... | ... |
-          #   | `dir/*.ts` | 6 | ... | ... |
-          exemptions = []
-          claude_md = pathlib.Path('.claude/CLAUDE.md')
-          if claude_md.exists():
-              in_table = False
-              for line in claude_md.read_text(encoding='utf-8').splitlines():
-                  if re.search(r'TypeScript [Ee]xemptions', line):
-                      in_table = True
-                      continue
-                  if in_table and line.startswith(('### ', '## ', '# ')):
-                      break
-                  if in_table and line.startswith('|'):
-                      m = re.match(r'\|\s*`([^`]+)`', line)
-                      if m:
-                          exemptions.append(m.group(1))
-
-          # Find all .ts and .tsx files
-          found = []
-          for ext in ('ts', 'tsx'):
-              found.extend(str(p) for p in pathlib.Path('.').rglob(f'*.{ext}'))
-
-          def allowed(path):
-              p = path.lstrip('./')
-              for g in BUILTIN_GLOBS + exemptions:
-                  if fnmatch.fnmatchcase(p, g):
-                      return True
-                  # also treat glob ending with / as a directory prefix
-                  base = g.rstrip('/').rstrip('*').rstrip('/')
-                  if base and (p == base or p.startswith(base + '/')):
-                      return True
-              return False
-
-          bad = sorted(f for f in found if not allowed(f))
-          if bad:
-              print("❌ TypeScript files detected outside the allowlist.\n")
-              for f in bad:
-                  print(f"  {f}")
-              print()
-              print("To resolve, either:")
-              print("  (a) migrate the file to AffineScript")
-              print("      (see Human_Programming_Guide.adoc migration chapter), OR")
-              print("  (b) move it to an allowlisted bridge path")
-              print("      (bindings/, tests/, scripts/, mcp-adapter/, *vscode*/, cli/, deno-*/, etc.), OR")
-              print("  (c) add an entry to the 'TypeScript Exemptions' table in .claude/CLAUDE.md")
-              print("      with rationale + unblock condition.")
-              if exemptions:
-                  print(f"\n(Currently {len(exemptions)} exemption(s) parsed from .claude/CLAUDE.md.)")
-              sys.exit(1)
-          print(f"✅ No TypeScript files outside allowlist ({len(exemptions)} per-repo exemption(s) parsed).")
-          PYEOF
-
       - name: Check for Go
         run: |
           if find . -name "*.go" | grep -q .; then

.github/workflows/secret-scanner.yml

@@ -21,7 +21,9 @@ jobs:
       - name: TruffleHog Secret Scan
         uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
         with:
-          extra_args: --only-verified --fail
+          # The action already passes --fail itself; repeating it errors
+          # ("flag 'fail' cannot be repeated"). Only pass --only-verified.
+          extra_args: --only-verified
 
   gitleaks:
     runs-on: ubuntu-latest

.machine_readable/6a2/AGENTIC.a2ml

@@ -2,6 +2,8 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # AGENTIC.a2ml — AI agent constraints and capabilities
+name = "agentic"
+
 [metadata]
 version = "0.1.0"
 last-updated = "2026-04-11"

.machine_readable/6a2/META.a2ml

@@ -2,6 +2,8 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # META.a2ml — Gitbot Fleet meta-level information
+name = "meta"
+
 [metadata]
 version = "1.0"
 last-updated = "2026-04-11"

.machine_readable/6a2/NEUROSYM.a2ml

@@ -2,6 +2,8 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # NEUROSYM.a2ml — Neurosymbolic integration metadata
+name = "neurosym"
+
 [metadata]
 version = "0.1.0"
 last-updated = "2026-04-11"

.machine_readable/6a2/PLAYBOOK.a2ml

@@ -2,6 +2,8 @@
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # PLAYBOOK.a2ml — Operational playbook
+name = "playbook"
+
 [metadata]
 version = "0.1.0"
 last-updated = "2026-04-11"

.machine_readable/CICD-PATTERNS.a2ml

@@ -5,6 +5,11 @@
 ;; Generated: 2026-01-05 from cicd-hyper-a audit session
 ;; Updated: 2026-01-09 with RSR policy contradiction fixes
 
+;; A2ML identity (TOML-shaped manifest header for the a2ml validator)
+project = "gitbot-fleet"
+name = "gitbot-fleet-cicd-patterns"
+version = "1.0"
+
 (cicd-patterns
   (version "1.0")
   (project "gitbot-fleet")

.machine_readable/CLADE.a2ml

@@ -3,6 +3,7 @@
 # See: https://github.com/hyperpolymath/gv-clade-index
 
 [identity]
+name = "gitbot-fleet"
 uuid = "f8cdb015-c230-50f2-b09c-f9e8d37646dd"
 primary-forge = "github"
 primary-owner = "hyperpolymath"

.machine_readable/agent_instructions/coverage.a2ml

@@ -8,6 +8,7 @@
 # Reference: ADR-002 in standards/agentic-a2ml/docs/
 
 [metadata]
+name = "gitbot-fleet-coverage"
 version = "1.0.0"
 last-updated = "2026-03-24"