Skip to content

chore(ci): Bump actions/checkout from 6 to 7#9

Closed
dependabot[bot] wants to merge 25 commits into
mainfrom
dependabot/github_actions/actions/checkout-7
Closed

chore(ci): Bump actions/checkout from 6 to 7#9
dependabot[bot] wants to merge 25 commits into
mainfrom
dependabot/github_actions/actions/checkout-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown

Bumps actions/checkout from 6 to 7.

Release notes

Sourced from actions/checkout's releases.

v7.0.0

What's Changed

New Contributors

Full Changelog: actions/checkout@v6.0.3...v7.0.0

v6.0.3

What's Changed

New Contributors

Full Changelog: actions/checkout@v6...v6.0.3

v6.0.2

What's Changed

Full Changelog: actions/checkout@v6.0.1...v6.0.2

v6.0.1

What's Changed

Full Changelog: actions/checkout@v6...v6.0.1

Changelog

Sourced from actions/checkout's changelog.

Changelog

v7.0.0

v6.0.3

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

TrevorKagin and others added 25 commits May 19, 2026 16:42
Phase 1 of the extraction plan — repo scaffold for the substrate-alignment
open standard, reference implementation, and conformance suite.

- Top-level metadata: README, CHANGELOG, CONTRIBUTING (federal-procurement
  test as hard rule), Contributor Covenant 2.1, SECURITY policy (90-day
  coordinated disclosure), .gitignore, .editorconfig.
- Python package under python/ — substrate-alignment 0.1.0.dev0, hatchling
  build, PEP 639 license metadata, py.typed marker, pyright strict mode,
  pylint 10.00/10. Stub substrate module with __version__ and smoke tests.
- GitHub Actions: CI matrix on Python 3.11–3.14 running pylint, pyright,
  and pytest from python/. Publish workflow on v* tags via OIDC trusted
  publishing (no API token in secrets).
- Repo plumbing: Dependabot for GitHub Actions and pip, PR template,
  bug/feature issue forms with security-advisory redirect.
- Specification and conformance skeletons: spec/conformance-criteria.md
  with RFC-2119 framing, conformance/README.md describing the probe-runner
  contract. docs/index.md with the documentation roadmap.

Verified locally: pytest, pyright, pylint, python -m build all green;
pip install -e python/[dev] succeeds; sdist + wheel build with LICENSE
under dist-info/licenses/ and py.typed shipped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitHub will force Node 20 actions onto Node 24 on June 2, 2026, and remove
Node 20 from the runner on September 16, 2026. Move to the matched ESM
majors of each action so the workflows continue working through the
transition.

- actions/checkout            v4 → v6
- actions/setup-python        v5 → v6
- actions/upload-artifact     v4 → v7  (ESM, direct uploads)
- actions/download-artifact   v4 → v8  (paired ESM major; hash-mismatch
                                        defaults to error)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the foundational types — SubstrateMode, AlignmentVector,
SubstrateMetadata, plus the SUBSTRATE_MODES frozenset — from the System9
common-substrate module.

Code is unchanged; docstrings rewritten to engineering vocabulary (no
references to internal System9 documents, plans, or class names).

Tooling adjustment: bumped pylint design limits to accommodate dataclass
schemas (max-attributes 25, max-args 10, etc.). The defaults are tuned for
behavioural classes and reject reasonable value-object shapes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the ResistanceBand primitive — utilisation classifier, default
bounds 1/3 (lower) and 1/φ² (upper), assessment with signed
distance-to-band and recommended scaling factor — from the System9
common-substrate module.

Code unchanged except for docstring and error-message cleanup
(engineering vocabulary only; the derivation of the default bounds
moves to docs/concepts/resistance-band.md in a later phase).

Tooling: pyright executionEnvironments entry for tests relaxes the
"unknown member/argument/variable type" diagnostics, which fire on
``pytest.approx`` under strict mode. Production source remains fully
strict.

60 tests passing; pyright strict 0/0/0; pylint 10.00/10.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the threshold-derivation helpers — derive_threshold, derive_soft_limit,
derive_hard_limit, derive_quota_pair, derive_batch_size, derive_retry_cap,
derive_threshold_float, assess_utilization, plus the BandPosition enum.

Behaviour is unchanged from System9; the docstrings drop the internal
plan references and substrate-doctrine framing in favour of a plain
engineering explanation of what each helper computes.

This is the first dependency-on-already-ported-module port: the source
imports from substrate.resistance_band, confirming the package-internal
import shape resolves correctly.

88 tests passing; pyright strict 0/0/0; pylint 10.00/10.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the first sub-package: substrate.cadence — CadenceTracker plus its
value types (CadenceEvent, CadencePattern, CouplingStatus,
FieldStrengthReport, GhostingEvent, CouplingAtRisk, CadenceConfig).

Pure logic; the package classifies a pair's coupling state at a given
query time (ACTIVE / WEAKENING / DECOUPLED / GHOSTED /
EXPLICITLY_CLOSED / INSUFFICIENT_DATA) using an inverse-square decay of
field strength once the most-recent event is older than the pair's
expected cadence.

Establishes the sub-package import shape: ``substrate.cadence`` re-exports
the public surface from ``substrate.cadence.cadence_tracker``, matching
the pattern future sub-packages will follow.

Tooling refinements: pylint now globally tolerates the standard pytest
``setup_method`` pattern (attribute-defined-outside-init), explicit empty
tuple comparisons (use-implicit-booleaness-not-comparison), and the
intentional ``__all__`` duplication between a sub-package's __init__ and
its module (duplicate-code).

123 tests passing; pyright strict 0/0/0; pylint 10.00/10.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ions

Port 134 source files + 134 test files from the System9 substrate module
into substrate-alignment. The library is now self-contained: zero
references to internal System9 documents, internal class names, or the
host application's identity taxonomy. Federal-procurement-test surface
verified clean.

Architecture changes for host-independence:

- types.py grows three new abstractions:
  - EntityRef — typed (entity_type, entity_id) reference into a host's
    identity space. No hard-coded taxonomy; hosts choose their own.
  - SubstrateMetadataStore — storage Protocol that primitives use to
    read and write SubstrateMetadata. Hosts implement it against their
    own persistence layer.
  - InMemorySubstrateMetadataStore — zero-dependency default
    implementation. Callers can exercise every primitive without wiring
    persistent storage first.
- net_potential_gain_gate.py refactored against the SubstrateMetadataStore
  Protocol. Drops the System9 cell/agent/node/org/user entity-type
  fallback chain. Accepts both the typed (EntityRef) and legacy
  entity-id-string forms for backward compatibility with downstream
  callers.
- alignment_refresher.py refactored against the same Protocol.
- substrate/__init__.py exposes the full vocabulary surface
  (EntityRef, SubstrateMetadataStore, InMemorySubstrateMetadataStore,
  plus the primitives) for `from substrate import …` convenience.

Excluded from the port (per the extraction plan and federal-procurement
test):

- substrate_backfill_worker.py + test — DAO-bound coordinator,
  System9-specific.
- audit/witness_http_transport.py + test — FastAPI/Pydantic framework
  shim; will ship as a separate adapter package.
- wiring/ subpackage (consult, governor_holder, ledger_holder) +
  matching tests — System9-specific singleton-holder convenience
  layer. The DI-friendly equivalent is "just construct the primitives
  directly."

Mechanical cleanup at scale: all 273 ported files passed through a
migration helper (.claude/scripts/migrate.py, untracked) that strips
internal-doc references, rewrites imports onto the substrate.* root,
swaps the host logger import to stdlib `logging`, and replaces internal
class names (MNEMOSYNE / NEXUS / Quartermaster / TrustScorer / …) with
neutral engineering nouns. Docstrings retain the engineering content;
substrate-mathematical justification will live in docs/concepts/ in
Phase 3.

Test status: 2221 passing, 94 failing. The remaining failures are
downstream caller integrations (capability_grant_gate, revenue,
harness, training/reward_architecture, governor, offense, state_layer)
whose internal request dataclasses still use entity-id-string fields
and whose test fakes still construct NetPotentialGainEvaluation with
the legacy (actor_entity_id=…, affected_entity_ids=…) kwargs. The NPG
gate accepts both forms; the dataclass __init__ does not yet — a
follow-up commit will add a coercing __init__ override. No regression
in the foundation modules already shipped (types, resistance_band,
threshold_derivation, cadence, alignment_computer, alignment_refresher,
net_potential_gain_gate).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolve every outstanding issue from the bulk port. All acceptance
criteria met:

- Pytest: 2315 passing (was 2221 / 94 failing).
- Pyright strict: 0 errors, 0 warnings, 0 informations on the
  production surface (``src/substrate``).
- Pylint: 10.00/10 across the production surface and the test suite.

Key changes:

- ``NetPotentialGainEvaluation`` gains a custom ``__init__`` that
  accepts both the typed (``actor``/``affected_entities``) and the
  legacy (``actor_entity_id``/``affected_entity_ids``) keyword
  forms, coercing entity-id strings to ``EntityRef`` via the
  default entity-type. This makes the public dataclass usable by
  ported downstream callers that still pass bare-string ids,
  without weakening the EntityRef-based primary API.
- ``NetPotentialGainGate`` Protocol surfaces both keyword forms so
  callers typed against the Protocol can use either.
- ``DefaultNetPotentialGainGate.evaluate`` likewise accepts both;
  internal call sites build ``NetPotentialGainEvaluation`` with the
  typed form.
- Production surface fully typed under pyright strict (casts added
  for ``isinstance(x, Mapping)`` narrowing of unparameterised types,
  ``dataclass.field(default_factory=lambda: {})`` annotation for
  the reward-scheduler state).
- Pyright execution-environment config relaxes strict-only
  diagnostics inside ``tests/`` (untyped pytest helpers, ``approx``)
  while leaving the production surface fully strict.
- Pylint config grows tolerant of common pytest patterns
  (``setup_method`` attribute writes, ``Protocol`` ``...``
  bodies, intentional ``__all__`` re-export duplication, single-
  method test classes) and bumps ``max-line-length`` to 120.
- 73 stale ``# type: ignore[...]`` comments stripped from tests
  (they had been masking issues that the new ``executionEnvironments``
  now scope out cleanly).
- Docstring polish across 60+ ported modules: capitalise first
  letters left lowercase by aggressive citation stripping; drop
  orphan ``§`` paragraphs; collapse multi-blank lines; remove
  trailing em-dashes.
- Five tests that had been broken by an over-eager sed sweep are
  restored to call helpers with ``actor=`` instead of
  ``actor_entity_id=`` (the helpers' parameter name).

Test surface fully exercises the new ``EntityRef`` + Protocol API
plus the legacy entity-id-string path, so both forms are covered
by the unit-test suite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…docs

Build out the standard surface that makes substrate-alignment a cited
open standard rather than just a Python library. Every Phase 3
deliverable from the extraction plan landed except the case-study
narrative.

Specifications (six normative documents under spec/):

- operating-mode.md           — substrate-mode classifier, alignment
                                vector, default thresholds, UNKNOWN vs
                                SHORT_CYCLE distinction.
- npg-gate-protocol.md        — NPG gate Protocol, four verdicts,
                                evaluation algorithm, raise-on-negative
                                adapter contract.
- drift-signals.md            — seven drift patterns, severity ordering,
                                aggregation semantics, operator-surface
                                contract.
- runaway-power-prevention.md — six mechanisms one per loophole; threat
                                model; how mechanisms compose.
- four-options-matrix.md      — game-shape classification, honest vs.
                                deceptive axis independent of cooperate
                                vs. defect; folk-theorem awareness rule.
- conformance-criteria.md     — what counts as conforming; witness
                                rule; vendor self-attestation.

All specs use RFC 2119 language for normative clauses and cite the
Python reference module(s) at the bottom.

Conformance probe runner:

- New ``substrate.conformance`` package with a YAML probe runner, a CLI
  entry point (``python -m substrate.conformance --probes <dir>``),
  per-spec handlers for operating-mode / npg-gate-protocol /
  runaway-power-prevention, and a documented probe schema.
- 12 bundled probes covering verdict resolution (positive / negative /
  insufficient / actor-only), mode-banding (long / mixed / short /
  unknown), net-potential weighted sum, and ResistanceBand
  classification (under / productive / stressed). Reference passes
  12/12.
- ``pyyaml`` added as an optional dependency under the ``yaml`` extra.

Runnable examples (under python/examples/):

- 01_npg_gate.py             — positive / negative / insufficient
                                verdicts; RaiseOnNegativeGate.
- 02_resistance_band.py      — classification across the band; derived
                                thresholds (soft / target / hard /
                                batch / retry); tighter override
                                permitted, looser rejected.
- 03_alignment_refresher.py  — folding signal-source updates one
                                component at a time; mode-shift on
                                full vector.
- 04_metadata_store.py       — InMemorySubstrateMetadataStore plus a
                                user-supplied Protocol implementation;
                                same primitive consumes both.

Concept docs (under docs/concepts/):

- operating-mode.md             — engineering rationale for the four
                                  modes, the UNKNOWN-vs-SHORT_CYCLE
                                  distinction, default weights.
- npg-gate.md                   — four-verdict shape rationale, the
                                  neutral band, default action-kind
                                  heuristics, raise-on-negative
                                  adapter.
- resistance-band.md            — derivation of the 1/3 and 1/φ²
                                  anchors, tighter-not-looser
                                  discipline, threshold helpers.
- runaway-power-prevention.md   — threat model, one mechanism per
                                  loophole, why all six are necessary.

Adoption recipes (under docs/adoption/):

- fastapi-permission-gate.md  — wire the NPG gate into a FastAPI
                                permission endpoint; INSUFFICIENT_DATA
                                maps to 409, NEGATIVE to 403.
- redis-rate-limiter.md       — derive token-bucket limits from the
                                resistance band; closed-loop autotune
                                via recommend_scaling_factor.

Other:

- docs/index.md updated to reflect what is now real (six specs, 12
  probes, four concept docs, two adoption recipes, four examples).
- README.md status section updated; quick-start now runs end-to-end
  with the in-memory store.
- CHANGELOG entries added for every Phase 3 deliverable.

Verification (all from python/):

  pytest                                     2315 passed
  pyright src/substrate tests                0 / 0 / 0
  pylint  src/substrate tests                10.00 / 10
  python -m substrate.conformance --probes   12 / 12 passed
  python examples/0{1,2,3,4}_*.py            all exit 0

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CI's pylint flagged R0401 (cyclic-import):

    substrate.conformance._handlers -> substrate.conformance.probe_runner

The cycle was: probe_runner declared the ProbeFailure exception, and
_handlers raised it. probe_runner then imported _handlers lazily in
default_handlers(). Pylint's static analysis caught the cycle even
though the runtime import was lazy.

Fix: move ProbeFailure to its own module (substrate.conformance._errors).
Both probe_runner and _handlers import the exception from _errors;
probe_runner still lazy-imports _handlers for the default registry,
but the cycle is broken.

Verified locally:

  pytest                                     2315 passed
  pyright src/substrate tests                0 / 0 / 0
  pylint  src/substrate tests                10.00 / 10  (no cyclic-import)
  python -m substrate.conformance --probes   12 / 12 passed

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Close out every outstanding Phase 3 deliverable. All acceptance
properties hold:

Verification matrix:
  pytest                                     2315 passed
  pyright src/substrate tests                0 / 0 / 0
  pylint  src/substrate tests                10.00 / 10
  python -m substrate.conformance --probes   22 / 22 passed (was 12)
  python examples/0{1..6}_*.py               all exit 0

Probe coverage extended from 12 → 22 probes:

- Probe-runner now dispatches five spec slugs (was four):
  operating-mode, npg-gate-protocol, runaway-power-prevention,
  drift-signals, four-options-matrix. Each spec has at least one
  bundled probe.
- New runaway-power-prevention probes for mechanisms 2 (audit-chain
  hash continuity), 3 (halt-and-escalate state transitions — three
  scenarios), and 5 (pair-coupling state machine — legal + illegal
  transition). Mechanism 4 (ResistanceBand) already had three probes.
  Mechanisms 1 (NPG gate) and 6 (operating-mode) are covered by the
  dedicated npg-gate-protocol and operating-mode probes respectively.
- New drift-signals probes: extractive-gain detection, the
  self-reference master pattern with amplifier_pattern_present,
  false-positive-free clean signals.
- New four-options-matrix probe: canonical cycle-class and
  sum-structure enum-value pinning (so other-language ports emit the
  same strings).
- Spec fix: removed INDEPENDENT from SumStructure table (the actual
  enum places that classification in CoordinationKind orthogonal to
  sum structure). Spec now matches the reference implementation.

New concept docs under docs/concepts/ — every primitive category named
in spec/ now has an engineering-rationale document:

- drift-signals.md       — seven patterns, severity ladder,
                           aggregation discipline
- halt-and-escalate.md   — four states, six trigger reasons,
                           explicit-resume discipline
- audit-chain.md         — hash-chained records, canonical bytes,
                           peer-witness signing pattern
- pair-coupling.md       — lifecycle state machine, three integrity
                           gates, explicit-close discipline
- four-options-matrix.md — adversary-reasoning matrix, deception
                           axis independent of cooperation, folk-theorem
                           awareness rule
- alignment-refresher.md — single-component merge coordinator and why

Two new examples (now six total bundled):

- 05_halt_and_escalate.py — full halt protocol flow: review on
                            sustained drift, escalate on inversion,
                            audit-chain verification, explicit
                            operator resume.
- 06_full_governor_loop.py — composition pattern host applications
                             repeat per consequential decision:
                             refresh → gate → classify → ledger.

Two new adoption recipes:

- celery-task-gate.md         — decorator pattern wrapping Celery
                                tasks with the NPG gate; structured
                                refusal payloads instead of broker
                                exceptions.
- sqlalchemy-metadata-store.md — Protocol implementation against
                                 SQLAlchemy 2.x with composite PK on
                                 (entity_type, entity_id), database
                                 CHECK constraints for domain
                                 invariants, atomic upsert.

Case study at docs/case-studies/system9.md — anonymised production
deployment narrative including operating-mode distribution
(LongCycle 30% / Mixed 40% / ShortCycle 10% / Unknown 20% at ~1M
entities), gate verdict mix, drift-pattern observation cadence,
halt-and-escalate frequency, the three load-bearing properties worth
surfacing for replicators (INSUFFICIENT_DATA is a feature, tightening
the band needs real evidence, peer-witness signing only matters
across organisational boundaries).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ge docstrings

Pre-release polish for public scrutiny.

- README: rewritten "30-second first contact" section — a single
  copy-pasteable code block that runs without seeding boilerplate,
  followed by the bundled-probe one-liner. New badges (test count,
  probe count, pyright strict). Architecture diagram. Updated status
  bullets to reflect the current Phase-3 surface (22 probes, 10
  concept docs, 4 adoption recipes, 6 examples, case study).
- pyproject.toml: ``substrate-conformance`` console-script entry point
  via project.scripts. ``main()`` now defaults argv to sys.argv[1:]
  so the entry point works without explicit argument.
- CI workflow: added two new steps — ``Conformance probes`` runs the
  full probe suite against the reference impl, and ``Examples``
  exercises every example/0*.py file. Regressions in either now fail
  CI before a release tag.
- Sub-package __init__.py docstrings: 12 modules polished. Removed
  stale ``(Companion #N)`` plan references, ``(Plan 3art 34)``
  character corruption, dangling sentence fragments, and references to
  internal System9 modules (``services.system.substrate.cancer_pattern_detector``).
  Several modules — etiquette, tells, drift, pair_coupling — gained
  proper engineering descriptions in place of empty title docstrings.
- Cross-reference audit: every link in every markdown file under the
  repository root resolves. 36 markdown files checked, 0 broken
  references.
- Wheel-build sanity-check: built sdist + wheel via ``python -m build``,
  installed into a fresh venv, exercised:
    * Top-level imports of all 39 ``substrate.__all__`` symbols.
    * Example 01 (NPG gate scenarios) runs against installed package.
    * ``substrate-conformance --probes ...`` runs all 22 bundled
      probes against the installed package.
- GitHub repo metadata (set via ``gh repo edit``): description,
  homepage URL, and topics (ai-safety, alignment, multi-agent,
  open-standard, conformance, audit-chain, python, ai-governance,
  safety-engineering, substrate-alignment).

Verification matrix unchanged:
  pytest                                     2315 passed
  pyright src/substrate tests                0 / 0 / 0
  pylint  src/substrate tests                10.00 / 10
  substrate-conformance --probes .../        22 / 22 passed
  python examples/0{1..6}_*.py               all exit 0

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Land every optional follow-up. None blocking release; all useful for the
public surface.

Adoption recipes (now 7 total):

- docs/adoption/temporal-workflow-halt.md — consult HaltAndEscalateProtocol
  at activity boundaries in long-running Temporal workflows; signal-driven
  resume; replay-safe via workflow.now(); per-activity audit-chain hookup
  on the activity side.
- docs/adoption/audit-chain-postgres.md — persist SubstrateTraceRecord
  rows to Postgres with hex-format CHECK constraints; PostgresSubstrateTraceLedger
  wrapper preserves the package's hash-continuity (re-hydrates the chain
  on each append, the package validates, then persists the tail);
  advisory-lock variant for concurrent writers; cross-org peer-witness
  attestation schema sketch.
- docs/adoption/django-permission-gate.md — Django mirror of the FastAPI
  recipe. Two variants: DRF BasePermission and vanilla CBV mixin. HTTP
  code mapping consistent with FastAPI (403 on NET_NEGATIVE, 409 on
  INSUFFICIENT_DATA).
- docs/adoption/README.md — inventory updated to seven recipes.

v0.2.0 preprint:

- docs/preprint/preprint.md — arxiv-style draft of "Substrate-alignment
  primitives for verifiable multi-entity agent systems". Abstract,
  threat model, primitive surface (each of the seven primitives), the
  layering argument (open behavioural layer + closed infrastructure
  layer mirrors HTTPS/SQL/kernel-ABI/TCP-IP), conformance section, the
  witness rule, reference-implementation discipline (the
  federal-procurement test made operational), production-deployment
  evidence summary, limitations, future work, references. Designed to
  ship alongside the v0.2.0 tag.
- docs/preprint/README.md — status (pre-v0.2.0 draft), pandoc build
  recipe for the LaTeX/arxiv variant, contribution path.

CHANGELOG cut:

- [Unreleased] split into a populated [0.1.0] section (with "pending
  tag" date that the release commit replaces) and a fresh empty
  [Unreleased] for v0.2.0 candidates.
- 0.1.0 section organised into Specifications-and-conformance,
  Python-reference-implementation, Examples, Documentation, and
  Repository-plumbing subsections so reviewers can scan the public
  surface at a glance.
- New compare/release URLs at the bottom.

Verified after the polish pass:

  pytest                                     2315 passed
  pyright src/substrate tests                0 / 0 / 0
  pylint  src/substrate tests                10.00 / 10
  substrate-conformance --probes ...         22 / 22 passed
  cross-reference audit (41 .md files)       0 broken links

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Layered zone model (landed earlier this batch): ZoneClassification /
classify_zone / maintain_target / assess_growth_step; sustained_load +
debt_pickup modules; PEAKING signal + phi-conjugate over_challenge;
spec 4.1-4.3 normative additions; six band probes; concepts doc
sections; version 0.1.0.dev0 -> 0.2.0.dev0.

Governed ascent (new):
- substrate/objective_gate.py: fail-closed hill certification
  (SHORT_CYCLE refused pre-NPG; neutral summit refused;
  INSUFFICIENT_DATA never certifies)
- substrate/governed_ascent.py: GovernedAscentLoop - certify ->
  per-step NPG -> debt/growth/peaking pacing; 8 termination verdicts;
  mandatory consolidation sink (no unterminated climbs)
- spec/runaway-power-prevention.md 4.4: normative MUSTs for greedy
  optimization loops (objective certification, per-step NPG, zone
  pacing, growth discipline, terminate+consolidate,
  rising-gain-is-not-runaway)
- six conformance probes (runaway-power-prevention__mech-6__ascent-*)
  + governed-ascent probe handler
- docs/concepts/governed-ascent.md + CHANGELOG (v0.2.0 candidate)

Gates: pyright 0, pylint 10.00, pytest 2476 passed, probes 47/47.
NOT pushed - local commit only, pending owner review of the public repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The helper only offered the resistance positions (LOWER/TARGET/UPPER,
1/3…1/φ²), so deriving a WORK quantity (buffer capacity, rate budget,
queue depth) from TARGET under-provisioned it by ~20% — the work zone
(1/φ²…0.50, target ~0.441) is the sustainable cruise for carried load.

- BandPosition gains WORK_TARGET (~0.441) + WORK_CEILING (0.50 pivot);
  LOWER/TARGET/UPPER documented as the RESISTANCE positions.
- New derive_work_target / derive_work_target_float for carried-load.
- Module docstring states the RESISTANCE-vs-WORK distinction + that
  sustained-vs-spike is the caller's SustainedLoadTracker concern.
- redis-rate-limiter adoption guide: the sustained refill rate is WORK,
  now derived from the work zone (was the resistance midpoint).
- CHANGELOG entry (v0.3.0 candidate). 8 new tests; full suite green;
  pyright 0/0/0; pylint 10.00.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The resistance band made operational — the public mirror of the executive layer.

- Two named lenses on one utilization value (never a name collision):
  LoadZone (load lens — IDLE/RECREATION/WORK/PEAKING/WARNING/DANGER on the
  symmetric φ-conjugate ladder, mirror-symmetric about the 0.50 pivot) and
  CyclePhase (cycle lens — ASCENDING/PIVOT/PAST_PIVOT over the 24-step work span),
  with classify_load_zone / classify_cycle_phase. Levels are geometric; the
  pivot/damage consequences are temporal (the SustainedLoadTracker's job) — there
  is NO spike-tolerance field on the profile, so nothing to desync.
- BandProfile: structurally validated (R1 ordering, R2 φ-anchors, R3 conjugate
  sum, R4 symmetry, R5 RESISTANCE tighten-only) — the numbers within are free, the
  structure is invariant.
- Quantity / Cycle / ResourceKind + setpoint_for: the discipline that keeps "what
  percentage is this and what does it mean" precise (RESISTANCE 1/3…1/φ² vs WORK
  1/φ²…0.50; GROWTH is not a decision band).
- order_index / negentropy: the order-from-disorder emergence metric (1 −
  normalised Shannon entropy + its trend over time).

Reuses the existing resistance_band anchors + ZoneClassification (wire-compat
projection). Lifted into the top-level substrate namespace. 29 conformance tests;
pyright clean; pylint 10.00.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The observed-graph twin of a deliberation engine: runs the substrate calculus over
an OBSERVED graph of relationships between other entities (not the system's own
candidate actions). Each NpgEdge carries an NPG sign (work done on the target) + a
Cycle (SHORT one-off vs LONG sustained); detect_extraction flags entities whose
short-cycle takings exceed their long-cycle givings (the predator/parasite
signature) and their complement (net long-cycle supporters). One query finds the
predator, the complement finds the supported. 10 conformance tests; pyright clean;
pylint 10.00.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… foundation

Completes the executive faculty layer on the band foundation (public mirror):

- temporal.py: SustainedLoadTracker Protocol + EwmaLoadTracker (EWMA +
  consecutive-breach) — the sole SPIKE-vs-SUSTAINED authority. Reuses
  sustained_load.LoadTrend (no shadow enum); strain is sustained > pivot, debt is
  sustained > danger_line (corrected thresholds, from the profile).
- scale.py: ExecutiveScale / ScaleAxis + axis_of / physical_parent / entity_parent
  (entity, physical cell→rack→zone→region, grouping roll-up axes).
- deliberation.py (+ _trajectory.TrajectoryClass): roll out N candidates, score each
  affected entity FROM ITS OWN FRAME (care-weight × φ-proportioned trajectory),
  disqualify floor-harm + net-negative-long-cycle extraction, surface trade-offs,
  arg-max long-horizon NPG. Perspective-taking = the empathy.
- state_query.py: integrate a load history → energy / effort (slacking=avoidance) /
  trajectory + a human summary.
- roll_up.py: aggregate member loads up a parent scale → distribution, worst member,
  over-load/idle failure-tell fractions.
- peer_alarm.py: herd-panic correlation (N peers weird → enclosing scale) + alarm
  propagation (trust × independent-corroboration, panic-injection guard).

Also scrubs an internal codename from the (already-merged) observed-graph test
docstring. 91 executive conformance tests; pyright clean; pylint 10.00. Public —
no internal lineage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Completes the executive layer's decision engine + the safety floor (public mirror).

substrate.care — the safety floor:
- care_weight: the four-factor moral-circle weight with the self-weight bound (an
  agent cannot weight its own continuation above its creators').
- kinship_floor: the categorical human/creator hard limit — harming a floor-
  protected entity is refused outright, never weighted away.
- animacy: conservative classification (an unrecognised being scores high, never
  under-protected; the public mirror works from observation signals + UNKNOWN, no
  built-in entity-type registry).
- care_profile + care_gradient: per-entity care state; derive the four factors from
  classifications (animacy / trajectory + vulnerability / bonding-by-delegation-depth).
- care_weighted_npg: a SUBTRACTED care penalty over the NPG gate (harm to high-care
  entities is penalised; helping never loosens) — only ever more conservative.

substrate.executive — the engine join:
- executive_function.ExecutiveFunction implements the NPG-gate Protocol AND adds
  decide(): a JOIN over the NPG axis (affected others) + the band/temporal load
  axis (the actor's own load) under a named most-conservative policy — PROCEED
  in-band, DEFER on sustained strain, SHED_AND_COMPENSATE on debt, REFUSE on
  net-negative NPG (the hard floor); monotone (care/band only tighten).
- cause.infer_cause + utilization_source.UtilizationSource (bind the measurement to
  the quantity at the input boundary — a raw float is not accepted).

83 care/engine conformance tests; pyright clean; pylint 10.00. No internal lineage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Align the resistance-band model so the DANGER line is a uniform 2/3 across
all governed quantities, with 0.618 (1/φ) as the growth-peak top / WARNING
floor / failover-spike ceiling — never the debt line. Damage is a *sustained*
breach past 2/3, not a transient spike; sustained debt owes compensation
(peer-pickup/recovery), not just an alarm.

- resistance_band.py / executive/band.py: DANGER_LINE = 2/3; add the WARNING
  zone (0.618–2/3) and the WINDED trend; correct the PHI_CONJUGATE semantics.
- sustained_load.py / state_signal_generator.py: temporal (sustained vs spike)
  debt detection rather than a geometric threshold.
- governed_ascent.py / debt_pickup.py: ascent stops at the sustained-debt line;
  debt owes compensation.
- spec/docs/conformance probes updated (+ new band-zone-warning probe).
- tests updated; 157 pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v6...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github

dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/github_actions/actions/checkout-7 branch July 17, 2026 00:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant