Skip to content

chore(registry): fix the K9 home hash the format commit invalidated (#1149 follow-up) - #1151

Merged
hyperpolymath merged 1 commit into
mainfrom
arena/01a10a3b-standards
Oct 5, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
arena/01a10a3b-standards

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Follow-up to #1149 (merged as aa1c4dd), which landed one commit too early: nickel format on 1-formats/k9/spec/contract/k9_contract.ncl moved the 1-formats/k9/ source_hash after the registry had been regenerated, so Registry Verify failed on main.

source_hash is sha256(git ls-files -s <home>), so the formatted contract — not just the new fixture — is part of the hash. This regenerates .machine_readable/REGISTRY.a2ml; the only changed line is that one hash.

bash scripts/build-registry.sh --check                     → OK
bash scripts/build-scorecards.sh --check --strict          → OK (dashboard in sync)
1-formats/k9/tools/k9-validate.sh --self-test              → all assertions passed
K9_VALIDATE_LAYER=all bash .githooks/validate-k9.sh        → 13 conforming, 5 grandfathered

Refs: #1058 (M1 · #A, M7 · #F).

@coderabbitai

coderabbitai Bot commented Oct 5, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 25a1a7d0-377e-4323-ab5b-9a121399aab8
📥 Commits

Reviewing files that changed from the base of the PR and between aa1c4dd and 35948b0.

📒 Files selected for processing (1)
  • .machine_readable/REGISTRY.a2ml
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

…ormatted

`source_hash` covers every tracked file in a home, so `nickel format` on
`1-formats/k9/spec/contract/k9_contract.ncl` moved the `1-formats/k9/` hash
again — one commit after the earlier regeneration. Registry Verify caught it on
main (`aa1c4dd`), which is the check doing its job.

`bash scripts/build-registry.sh --check` passes again; the only changed line is
the `1-formats/k9/` source_hash. Scorecards and the compliance dashboard were
already in sync.

Follow-up to #1149 (M1 · #A, M7 · #F).

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
@hyperpolymath
hyperpolymath force-pushed the arena/01a10a3b-standards branch from 284fe11 to 35948b0 Compare October 5, 2026 04:54
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

K9 contract conformance

run https://github.com/hyperpolymath/standards/actions/runs/37265527198

K9 normative contract typecheck

k9_contract.ncl typechecks

K9 contract self-test

== the bash mirrors cannot drift from the normative contract ==
ok   leash_levels mirrors k9_contract.ncl
ok   core_capabilities mirrors k9_contract.ncl
ok   contract_version mirrors k9_contract.ncl
ok   schema_major mirrors k9_contract.ncl
== capability arithmetic (§8) ==
ok   capability_ok fs.read accepted
ok   capability_ok rollback.apply accepted
ok   capability_ok x-acme.gpu.alloc accepted
ok   capability_ok x-acme rejected
ok   capability_ok x-.gpu rejected
ok   capability_ok fs.delete rejected
ok   capability_ok  rejected
== the extractor ==
ok   extracts pedigree.security.leash
ok   extracts pedigree.component_type
ok   extracts pedigree.metadata.name
ok   pedigree leash is not reported as top-level leash
ok   required_capabilities for a quiet component
ok   required_capabilities follows allow_network
== the envelope strip keeps line numbers (§3.6) ==
ok   line 1 becomes a comment
ok   line count is preserved
ok   schema_version stays on line 5
== L3: signature presence is not verification (§10) ==
ok   no verifier -> K9-C001 is SKIPPED, never a pass
ok   the skip states presence does not authorise 'Hunt
ok   verifier accepts -> verdict 'Verified, no K9-C001 finding
ok   verifier refuses -> K9-C001 error, verdict 'Rejected
== the fixture runner's attribution cannot be fooled by a filename ==
ok   every extracted finding is well-formed rule+layer
ok   the rule that really fired is attributed
ok   a rule named only in the filename is NOT attributed
ok   K9-C001 is present as a skipped finding
ok   and that same finding is NOT extractable as a rejection
== no Nickel reserved word is used as an identifier ==
ok   the contract and all 27 fixtures avoid Nickel's reserved words

self-test: all assertions passed

K9 conformance fixtures

== positive controls (must pass) ==
ok   extension-capability.k9.ncl
ok   extension-fields.k9.ncl
ok   hunt-fully-granted.k9.ncl
ok   kennel-data.k9.ncl
ok   library-base.ncl
ok   yard-typed-config.k9.ncl

== negative controls (must fail, by the named rule) ==
ok   L0-K9-E001-bad-magic.k9.ncl (rejected by K9-E001 at L0)
ok   L0-K9-E002-nul-byte.k9.ncl (rejected by K9-E002 at L0)
ok   L0-K9-E003-crlf.k9.ncl (rejected by K9-E003 at L0)
ok   L0-K9-E004-no-spdx.k9.ncl (rejected by K9-E004 at L0)
ok   L0-K9-E005-unclaimed-body.k9.ncl (rejected by K9-E005 at L0)
ok   L0-K9-S012-library-with-pedigree.ncl (rejected by K9-S012 at L0)
ok   L0-K9-S014-stray-leash.ncl (rejected by K9-S014 at L0)
ok   L1-K9-S001-no-pedigree.k9.ncl (rejected by K9-S001 at L1)
ok   L1-K9-S002-wrong-major.k9.ncl (rejected by K9-S002 at L1)
ok   L1-K9-S003-todo-component-type.k9.ncl (rejected by K9-S003 at L1)
ok   L1-K9-S004-unknown-leash.k9.ncl (rejected by K9-S004 at L1)
ok   L1-K9-S005-missing-name.k9.ncl (rejected by K9-S005 at L1)
ok   L1-K9-S006-unknown-capability.k9.ncl (rejected by K9-S006 at L1)
ok   L1-K9-S007-ungranted-flag.k9.ncl (rejected by K9-S007 at L1)
ok   L1-K9-S008-hunt-signature-not-required.k9.ncl (rejected by K9-S008 at L1)
ok   L1-K9-S009-hunt-no-signature-block.k9.ncl (rejected by K9-S009 at L1)
ok   L1-K9-S010-hunt-empty-side-effects.k9.ncl (rejected by K9-S010 at L1)
ok   L1-K9-S011-recipes-at-yard.k9.ncl (rejected by K9-S011 at L1)
ok   L1-K9-S013-dangling-import.k9.ncl (rejected by K9-S013 at L1)
ok   L2-K9-N001-two-segment-version.k9.ncl (rejected by K9-N001 at L2)
ok   L2-K9-N001-wrong-field-type.k9.ncl (rejected by K9-N001 at L2)

fixtures: 6 positive, 21 negative (0 needing nickel), 0 failure(s)

K9 corpus conformance (L2)

[validate-k9] debt .machine_readable/svc/k9/examples/setup-repo.k9.ncl (fail) — K9-S007 K9-S009 K9-S010 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-hunt.k9.ncl (fail) — K9-S003 K9-S005 K9-S007 K9-S009 K9-S010 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-kennel.k9.ncl (fail) — K9-S003 K9-S005 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-yard.k9.ncl (fail) — K9-S003 K9-S005 (grandfathered; touching it makes it blocking)
[validate-k9] debt rhodium-standard-repositories/rsr-compliance-checklist.k9.ncl (fail) — K9-N001 K9-S004 K9-S005 K9-S014 (grandfathered; touching it makes it blocking)
[validate-k9] 13 conforming, 5 grandfathered (layer all, contract v1.0.0)

@coderabbitai

coderabbitai Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Autopilot could not be updated. Open Coding to check access and billing.

@hyperpolymath
hyperpolymath force-pushed the arena/01a10a3b-standards branch 2 times, most recently from a914af6 to 35948b0 Compare October 5, 2026 04:56
@hyperpolymath
hyperpolymath merged commit 6075712 into main Oct 5, 2026
111 of 125 checks passed
@sonarqubecloud

sonarqubecloud Bot commented Oct 5, 2026

Copy link
Copy Markdown

@hyperpolymath
hyperpolymath deleted the arena/01a10a3b-standards branch October 5, 2026 04:57
@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

K9 contract conformance

run https://github.com/hyperpolymath/standards/actions/runs/37265625692

K9 normative contract typecheck

k9_contract.ncl typechecks

K9 contract self-test

== the bash mirrors cannot drift from the normative contract ==
ok   leash_levels mirrors k9_contract.ncl
ok   core_capabilities mirrors k9_contract.ncl
ok   contract_version mirrors k9_contract.ncl
ok   schema_major mirrors k9_contract.ncl
== capability arithmetic (§8) ==
ok   capability_ok fs.read accepted
ok   capability_ok rollback.apply accepted
ok   capability_ok x-acme.gpu.alloc accepted
ok   capability_ok x-acme rejected
ok   capability_ok x-.gpu rejected
ok   capability_ok fs.delete rejected
ok   capability_ok  rejected
== the extractor ==
ok   extracts pedigree.security.leash
ok   extracts pedigree.component_type
ok   extracts pedigree.metadata.name
ok   pedigree leash is not reported as top-level leash
ok   required_capabilities for a quiet component
ok   required_capabilities follows allow_network
== the envelope strip keeps line numbers (§3.6) ==
ok   line 1 becomes a comment
ok   line count is preserved
ok   schema_version stays on line 5
== L3: signature presence is not verification (§10) ==
ok   no verifier -> K9-C001 is SKIPPED, never a pass
ok   the skip states presence does not authorise 'Hunt
ok   verifier accepts -> verdict 'Verified, no K9-C001 finding
ok   verifier refuses -> K9-C001 error, verdict 'Rejected
== the fixture runner's attribution cannot be fooled by a filename ==
ok   every extracted finding is well-formed rule+layer
ok   the rule that really fired is attributed
ok   a rule named only in the filename is NOT attributed
ok   K9-C001 is present as a skipped finding
ok   and that same finding is NOT extractable as a rejection
== no Nickel reserved word is used as an identifier ==
ok   the contract and all 27 fixtures avoid Nickel's reserved words

self-test: all assertions passed

K9 conformance fixtures

== positive controls (must pass) ==
ok   extension-capability.k9.ncl
ok   extension-fields.k9.ncl
ok   hunt-fully-granted.k9.ncl
ok   kennel-data.k9.ncl
ok   library-base.ncl
ok   yard-typed-config.k9.ncl

== negative controls (must fail, by the named rule) ==
ok   L0-K9-E001-bad-magic.k9.ncl (rejected by K9-E001 at L0)
ok   L0-K9-E002-nul-byte.k9.ncl (rejected by K9-E002 at L0)
ok   L0-K9-E003-crlf.k9.ncl (rejected by K9-E003 at L0)
ok   L0-K9-E004-no-spdx.k9.ncl (rejected by K9-E004 at L0)
ok   L0-K9-E005-unclaimed-body.k9.ncl (rejected by K9-E005 at L0)
ok   L0-K9-S012-library-with-pedigree.ncl (rejected by K9-S012 at L0)
ok   L0-K9-S014-stray-leash.ncl (rejected by K9-S014 at L0)
ok   L1-K9-S001-no-pedigree.k9.ncl (rejected by K9-S001 at L1)
ok   L1-K9-S002-wrong-major.k9.ncl (rejected by K9-S002 at L1)
ok   L1-K9-S003-todo-component-type.k9.ncl (rejected by K9-S003 at L1)
ok   L1-K9-S004-unknown-leash.k9.ncl (rejected by K9-S004 at L1)
ok   L1-K9-S005-missing-name.k9.ncl (rejected by K9-S005 at L1)
ok   L1-K9-S006-unknown-capability.k9.ncl (rejected by K9-S006 at L1)
ok   L1-K9-S007-ungranted-flag.k9.ncl (rejected by K9-S007 at L1)
ok   L1-K9-S008-hunt-signature-not-required.k9.ncl (rejected by K9-S008 at L1)
ok   L1-K9-S009-hunt-no-signature-block.k9.ncl (rejected by K9-S009 at L1)
ok   L1-K9-S010-hunt-empty-side-effects.k9.ncl (rejected by K9-S010 at L1)
ok   L1-K9-S011-recipes-at-yard.k9.ncl (rejected by K9-S011 at L1)
ok   L1-K9-S013-dangling-import.k9.ncl (rejected by K9-S013 at L1)
ok   L2-K9-N001-two-segment-version.k9.ncl (rejected by K9-N001 at L2)
ok   L2-K9-N001-wrong-field-type.k9.ncl (rejected by K9-N001 at L2)

fixtures: 6 positive, 21 negative (0 needing nickel), 0 failure(s)

K9 corpus conformance (L2)

[validate-k9] debt .machine_readable/svc/k9/examples/setup-repo.k9.ncl (fail) — K9-S007 K9-S009 K9-S010 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-hunt.k9.ncl (fail) — K9-S003 K9-S005 K9-S007 K9-S009 K9-S010 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-kennel.k9.ncl (fail) — K9-S003 K9-S005 (grandfathered; touching it makes it blocking)
[validate-k9] debt .machine_readable/svc/k9/template-yard.k9.ncl (fail) — K9-S003 K9-S005 (grandfathered; touching it makes it blocking)
[validate-k9] debt rhodium-standard-repositories/rsr-compliance-checklist.k9.ncl (fail) — K9-N001 K9-S004 K9-S005 K9-S014 (grandfathered; touching it makes it blocking)
[validate-k9] 13 conforming, 5 grandfathered (layer all, contract v1.0.0)

Copy link
Copy Markdown
Owner Author

Housekeeping note on this branch's history: a parallel session force-pushed it twice at ~04:57 UTC (35948b0 → a914af6 → 35948b0) before noticing this PR already existed. The tree at both SHAs is byte-identical (same single-line REGISTRY.a2ml change), so the diff, checks and merge outcome are unaffected — the head is back to your original commit, which is the one that should land.

hyperpolymath added a commit that referenced this pull request Oct 5, 2026
Resolve conflicts by accepting main branch changes for:
- REGISTRY.a2ml (hash updates from #1151, #1149)
- k9-contract-debt.txt (ledger updates)
- k9_contract.ncl (template file references)

This incorporates all changes from main into the PR branch.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant