chore(security): fill the security-contact placeholders (owner-supplied values)

[hyperpolymath]

Mirror of systemet PR #33 — same owner-ruled values, same three judgement calls (see commit message). Should turn openssf-compliance green here too.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

Running post-merge workflows

CI failed: Multiple CI validation checks failed due to unallowlisted root files, missing K9 contract formatting, a banned Nix file, and a missing SonarQube authentication token.

Overview

Multiple distinct validation failures occurred across CI jobs, including violations of repository root shape allowlists, K9 contract validation errors, a banned Nix file check failure, and an authentication failure for SonarQube scanning across 4 unique error logs.

Failures

K9 Contract Validation Failure (confidence: high)

• Type: tooling
• Affected jobs: 90186734795
• Related to change: unclear
• Root cause: The K9 contract files lack required formatting and fields, such as the mandatory 'K9!' magic number string on the first non-empty line and required pedigree blocks.
• Suggested fix: Update the K9 contract files to include the 'K9!' magic number and valid pedigree blocks, or run the local generator tool (k9iser).

Banned Nix File Policy Violation (confidence: high)

• Type: tooling
• Affected jobs: 90186734370
• Related to change: unclear
• Root cause: The repository contains flake.nix, triggering a hard-fail because Nix is banned estate-wide in favor of Guix.
• Suggested fix: Remove flake.nix and use Guix (guix.scm) exclusively.

SonarQube Authentication Failure (confidence: high)

• Type: authentication
• Affected jobs: 90186734926
• Related to change: no
• Root cause: The SonarScanner action executed without a valid SONAR_TOKEN environment variable or with insufficient permissions.
• Suggested fix: Configure a valid SONAR_TOKEN secret in GitHub Actions.

Root Shape Allowlist Violation (confidence: high)

• Type: tooling
• Affected jobs: 90186734536
• Related to change: unclear
• Root cause: Unauthorized root entries (e.g., .githooks/, ARCHITECTURE.md, GOVERNANCE.md, MAINTAINERS, mise.toml) were added to the repository root without updating the allowlist.
• Suggested fix: Add the newly introduced root entries to .machine_readable/root-allow.txt or move them into appropriate subdirectories.

Summary

• Change-related failures: 0 (Authentication and policy checks are environmental/repository configuration issues)
• Infrastructure/flaky failures: 0
• Recommended action: Update the repository root allowlist and K9 files to comply with repository standards, remove flake.nix, and configure the missing SonarQube token secret.

Code Review ✅ Approved

Fills security-contact placeholders with owner-supplied values to satisfy OpenSSF compliance requirements. No issues found.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

⚠️ Gitar auto-approved this PR but could not enable auto-merge: auto-merge is disabled for this repository — enable "Allow auto-merge" in the repository settings.

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)