docs(signing): squash signs the result, not the PR branch - #1098
Merged
Merged
Conversation
required_signatures checks every commit on the PR branch before a merge, so a squash merge is not a way for bots to get signed commits: one unsigned head commit blocks the PR (measured on pons-asinorum #46). Drop the squash route from the apps row, and add a section with the measurement and the cherry-pick -S recovery. Raised by CodeRabbit on rpa-elysium#142. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 53 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Autopilot could not be updated. Open Coding to check access and billing. |
hyperpolymath
added a commit
that referenced
this pull request
Oct 1, 2026
…ult" (PROVISIONAL; adopts nothing) (#1111) **Supersedes #1083.** The content is identical, rebuilt on current `main` with every commit signed. ## Why a replacement #1083 could not merge, for two reasons: - **Unsigned commits.** Two commits pushed by `coderabbitai[bot]` (`ae0a5522`, `045a2227`) were unsigned. `required_signatures` checks every commit on the head, so the squash was blocked (see `docs/SIGNING-POLICY.adoc` § *Squash signs the result, not the PR branch*, #1098). - **Conflicts.** The only conflicts were in `045a2227`'s `REGISTRY.a2ml` and `docstring-scan-test.sh` edits. That work is now on main from #1088, so the commit is **dropped**. The branch is `origin/main`, then `cherry-pick -S -x` of `af3f614a`, `81275794`, `ae0a5522`. Authors are kept. `git diff <#1083 head> HEAD -- 0-canon/RSR-PHILOSOPHY.adoc docs/decisions/` is empty. `scripts/build-registry.sh --check`: in sync. ## What Opens `CHANGE-PROCEDURE.adoc` **step 1** for _Elegance by default_, **retroactively**, as `docs/decisions/ADR-007-elegance-by-default.adoc`. - `0-canon/RSR-PHILOSOPHY.adoc`: the Elegance banner gains a *Proposal record* pointer. Its PROVISIONAL status is unchanged. - `docs/decisions/ADR-006-always-leave-it-working.adoc`: records that step 6's `Immutable-Tags` precondition is **met**. The repair was made 2026-09-23 and re-verified 2026-09-30 (`current_user_can_bypass = always` on all four repos), and `launch-scaffolder` has cut `v0.1.0`. ## Why `KNOWN-TENSIONS.adoc` records a high-severity `contradiction`: rule 15 is projected into every generated `CLAUDE.md` while the canon marks it PROVISIONAL. The owner chose the *ratify* exit (D209, #787). ## What merging does, and does not do Merging **adopts nothing**. It records the proposal only (steps 1–2). Steps 3–6 stay owed: review, contest period, recorded decision, regeneration. The KNOWN-TENSIONS row stays open until step 5. **Step-3 note:** ADR-007 step 3 says authorised review by the constitutional authority is required before this proposal record merges. The owner (the constitutional authority) instructed on 2026-10-01 that this PR be landed. That instruction is recorded here as that review. ## Review threads carried over from #1083 All three CodeRabbit threads are answered by the text in this branch: - ADR-006 "date the Immutable-Tags blocker as pre-repair": ADR-006 l.166 ("*The `Immutable-Tags` blocker is resolved.* Before the repair, …"). - ADR-007 "keep step 6 regeneration proof in scope": ADR-007 l.141–142 and the step 6 row (regenerate, validate, prove determinism "even if output is unchanged, regardless of manifesto pin changes"). - ADR-007 "do not merge before authorised review": the step 3 row, and the step-3 note above. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DAKujx2PXHcVSA7vncTNH1 --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
hyperpolymath
added a commit
that referenced
this pull request
Oct 1, 2026
…isioning modes (#1112) **Supersedes #1096.** The content is identical, rebuilt on current `main` as one signed commit. ## Why a replacement - **Unsigned commits.** Two docstring commits pushed by `coderabbitai[bot]` (`71cad01f`, `18dcefa2`) were unsigned. `required_signatures` refuses a PR that has any unsigned commit on its head, even under squash (`docs/SIGNING-POLICY.adoc` § *Squash signs the result, not the PR branch*). Their content (docstrings, now 74/74 covered) is kept. - **Rebuild.** `git merge --squash origin/feat/provisioning-canon` onto `origin/main`, then `git commit -S`. `git diff 18dcefa HEAD` shows only main's later #1087/#1098 files plus the delta below. The original commit list is in the commit message. ## Delta vs #1096: Hypatia `eval_in_shell` false positives #1096's `Hypatia` code-scanning check and `governance / Validate Hypatia Baseline` were red on 4 `content_patterns/eval_in_shell` findings (`provision-check.sh:23`, `provision-lib.sh:867,868,944`). The rule is a bare `\beval\b`, and every hit is the **word**: the `eval` verb name, or the `.eval/` directory. None is the shell builtin. The fix is an inline `# hypatia:ignore eval_in_shell -- <reason>` pragma on each line, not baseline entries: - `HYPATIA-BASELINE-FORMAT.adoc` lists "single new findings on freshly-introduced code" as a bad baseline entry, and the baseline is a ratcheted exemption ledger. - These files are templates minted into other repos. The pragma travels with them; a standards-only baseline entry would not. - 3 comment lines that newer hypatia (`4065424`) also flags are pragma'd too, so a scanner bump does not turn this red again. **Control:** local `hypatia@4065424 scan` over the two files reports **7** `eval_in_shell` findings on #1096's version and **0** on this branch. `bash -n` is clean for both scripts. Upstream rule precision is tracked upstream in hyperpolymath/hypatia#892 (`eval_in_shell` matches the word, not the builtin in command position). CodeRabbit's last `CHANGES_REQUESTED` (the `launcher.sh.tmpl` header saying modes delegate to the Justfile) is already addressed in this content: l.25–29 say provisioning modes call `build/just/provision-lib.sh` directly. --- ## Original description (#1096) ## What Phase 1 of the estate provisioning campaign. This PR is the canon every repository will be minted from, so that nobody who clones a repo has to search for how to install, configure, run, test, bench, diagnose or repair it. **New: `3-practice/provisioning/`** - `PROVISIONING-STANDARD.adoc` (v1.0.0) and `provisioning-standard_praxis.deed` (lints OK) - **Engine**, identical estate-wide: - `provision.just`: the `provision::` module with every verb - `provision-lib.sh`: bash only, shellcheck clean - `provision-modes.sh`: the launcher dispatch - `provision-check.sh`: the offline conformance checker, covering §8 items 1–5 - **Minted templates:** - `launcher.sh.tmpl` - `mise.toml` (latest plus `mise.lock`) - Guix: a `cargo-build-system` package for Rust, a `copy-build-system` source package for everything else, plus `manifest.scm` and a pinned `channels.scm` - `docs/SETUP.adoc`, the manual route, with a doctor-code troubleshooting table - `docs/AI_INSTALLATION_GUIDE.adoc` - `llm-warmup-{user,dev,maintainer}.adoc` - the README `[[ai-install]]` "Just say it" fragment (the neurophone pattern) - the per-repo `provisioning_praxis.deed` **Launcher standard 0.6.0** (`launcher-standard.adoc` and `launcher-standard_praxis.deed`) - Every repository carries a `launcher.sh`, profiled by archetype. Only `app` has runtime modes; the others print N/A and exit 0. - `--setup`, `--doctor`, `--heal` and `--ai-setup` call the engine directly (`build/just/provision-lib.sh`), so a repo's own root `doctor`/`setup`/`heal` recipe cannot shadow the canon. - Repo-specific checks live in the `doctor-local`, `setup-local` and `heal-local` recipes. A failing `doctor-local` is FAIL PV-E50. **`guix.scm`:** the licence field was a malformed ad-hoc licence object pointing at palimpsest-license. It is now `mpl2.0` from `(guix licenses)`, which is the licence the file's own SPDX header already declares. No licence changes. ## Verified - `deed_lint.py`: - OK on `launcher-standard_praxis.deed` and `provisioning-standard_praxis.deed` - OK on a filled instance of the per-repo deed template - Shellcheck is clean on the engine scripts. - `provision-check.sh` fixture: - The positive control gives rc=0. - 9 mutants each fail on exactly their own check: launcher not executable, root verb missing, module verb missing, banned `python`, banned `aqua:denoland/deno`, no `mise.lock`, guix stub, mechanical slot residue, README SPEC residue. - `--dev` downgrades SPEC residue to a WARN. - doctor-local, in a scratch repo: - A failing `doctor-local` gives PV-E50 and rc=1 via both `./launcher.sh --doctor` and `just doctor`. - A root `doctor` that prints fake green is not executed by `--doctor`. - just floor 1.42.0, measured: a root recipe depending on a module recipe fails on 1.31, 1.36, 1.40 and 1.41. - Guix, via `podman` with `metacall/guix` at ae77aeb: the Rust source package derivation builds (`guix build -d`, rc=0). The non-Rust derivation and the real build were still running when this PR was opened. ## Known, not introduced here - The standards-map gate (Gate D) is already red on `main`, with 5 unmapped top-level entries: `arena-session-787`, `patches`, `ULTRAPLAN-2026-09-24.adoc`, `ULTRAPLAN-2026-09-29.adoc` and `ziz-drop`. This PR adds no top-level entry, because `3-practice` is already mapped. - Dogfooding `mod provision` in this repo's own Justfile is deferred to the pilot phase. ## Update: review round (head b234caf) **Commits since opening** - **206eb6c4 — one placement resolver.** - Each Guix template resolves the repository root from its own location, so a repo can keep the files at the root or under `build/`. This resolves the CodeRabbit placement thread. - Zig is detected up to 3 directories down. - **39b790f5 — no faked zig/bun tests.** - A language with no test command prints an honest N/A. - There is now one AI-install sentence, read from the README by `ai-setup`. - **eaf3a894 — new `fmt-check` verb, the check-only twin of `fmt`.** - Per language: `cargo fmt --check`, `zig fmt --check`, `mix format --check-formatted`, `gleam format --check`, `dune build @fmt`, and bun's `fmt-check` script. - `quality` now depends on this verb. Before, it silently ran `lint`. - **b234caf5 — the remaining review findings.** - `doctor-local.sh` now runs sourced in a subshell. An `exit` or a tripped `set -e` is FAIL **PV-E51**, and the checks it completed still count. - `hp_provision_or_return` replaces `&& exit $?`, which reported success for a failing mode. - The `ai-warmup` argument is now quoted. - trivy is pinned in mise only where a recipe calls it. - The launcher currency constant is now 0.5.0 (0.6.0 after 094fd79, below). - **7e6f3db6 — `toolchain-refresh` regenerates `build/guix/crates.scm`.** - `guix.scm.cargo.tmpl` already promised this, but nothing implemented it. The new lib verb `crates-scm` runs `guix import crate --lockfile`. `GUIX` may name a container wrapper. - The file is written whole or not at all. Output is accepted only when it defines one origin per registry crate in `Cargo.lock`, because a containerised guix loses its exit status. Otherwise the run fails with the new code **PV-E41** and the old file stays. PV-E41 is in the deed, the lib and the SETUP table: all three hold the same 28 codes. - Measured on launch-scaffolder's `Cargo.lock`: - 151/151 origins; - `guix repl` gives `(length %crate-inputs)` = 151 and `origin?` = `#t`; - regeneration is byte-identical. - Mutants killed: - truncated importer output (10/151): rc 1, PV-E41, file sha256 unchanged; - a failing importer (0/151): rc 1, PV-E41, file sha256 unchanged. - **094fd798 — merge `main`; the provisioning modes are launcher standard 0.6.0.** - `main` took 0.5.0 for the `(js-runtime)` clause (D224, #1100). That number is published with that meaning, so the archetype and provisioning obligations move to **0.6.0** (2026-10-01). Updated together: the deed, the `.adoc`, the currency gate's `CURRENT_VERSION`, the launcher template and `provision-modes.sh`. - A consumer still citing 0.5.0 gets the non-blocking stale-version warning (standards#991), not a failure. - Checks: - currency test 19/19; - the gate on this tree: clean at v0.6.0; - `--self-test`: 4 mutants seeded, all detected. **Measured on rsr-template-repo (the first consumer; that PR follows)** - doctor-hook cases: | hook | PASS / WARN / FAIL | |---|---| | normal | 19 / 1 / 0 | | `exit 3` | 19 / 0 / 1 + PV-E51 | | `set -e; false` | 19 / 0 / 1 + PV-E51 | | `fail` | 18 / 0 / 1 | - `./launcher.sh --doctor`: rc 0 when clean, rc 1 with a failing hook. - `just doctor` 18/0/0, `just validate` pass, `provision-check --dev` 0 FAIL / 0 WARN, shellcheck clean. - `fmt-check`: rc 0 on clean code; a mis-formatted mutant gives rc 1. - Guix, via `metacall/guix` at ae77aeb: - `guix build -f guix.scm`: rc 0. - `guix shell -m manifest.scm --dry-run`: rc 0. - `channels.scm` evaluates to the same pinned commit. - `just registry-check` OK. `check-launcher-standard-currency` OK. **Red checks: none is a required check. Classified:** - **Canon/spine lockstep and Map integrity** are already red on `main`: the constitution hash, dogfood-gate, and the ULTRAPLAN / arena-session-787 / patches / ziz-drop entries. #1088 fixes them. - **Repo self-tests:** - This PR's `CURRENT_VERSION` drift is fixed in b234caf. - The docstring shallow-clone failure is also red on `main`. - **Hypatia:** 6 `eval_in_shell` findings are false positives on the `eval` *verb name*: a comment, the `.eval/` report directory, a `case` label, and the verb list. Nothing here calls the builtin. - **Deferred red checks, by context:** `governance / Validate Hypatia Baseline`, `scan / Hypatia Neurosymbolic Analysis` and `Hypatia` → hyperpolymath/hypatia#892. On 094fd79 the baseline gate kept exactly six findings: `eval_in_shell` at `provision-check.sh:23` and `provision-lib.sh:17,732,733,742,804`, all the *word* `eval`. The same three checks are green on `main` 8cfad82. Renaming the user-facing `eval` verb to satisfy the scanner would be the wrong arm. - Fixed at source in hyperpolymath/hypatia#892, with acceptance criteria and positive and negative controls. - Per the owner ruling, this is tracked as an issue, not a blocker. - The 3 `uuid-v7.yml` baseline findings are fixed by #1088. - #1088 also touches `REGISTRY.a2ml`. If it merges first, regenerate the registry here. **Placement labels (elegance arm)** - The engine is **vendored byte-identical** into each repo, and `provision-set --check` will prove it is equal to canon. **This is the elegant long-term arm.** - Departure considered and rejected: fetching the engine at run time. That would break offline and Guix-hermetic use and add a supply-chain hop. - **`channels.scm` is minted, not engine** (departure, labelled). `toolchain-refresh` re-pins it per repo by design, so a byte-compare would go red after every weekly refresh. Instead it is checked for a 40-hex commit pin. ## Update: one banned list, backends and bare names (heads b01a245, bf7c97a) Found by the 8-repo pilot (launch-scaffolder#67). - **b01a245:** - The deed's `:banned-tools` and the engine's `BANNED_TOOLS` had diverged. They are now one 20-item list, plus a new `:banned-backends ("npm" "pipx" "pip" "go")`. launch-scaffolder tests that the deed and the engine agree. - PV-W23 now reads `mise.toml`, `.mise.toml` and `.tool-versions`. - A tool behind a banned backend is flagged whatever its name (`npm:prettier`). - Controls: `.tool-versions` python + `.mise.toml` `"npm:prettier"` → `[python npm:prettier] rc=1`; clean → `[] rc=0`. - **bf7c97a:** a bare name whose only registry backends are banned is flagged too. `prettier` resolves only to `npm:prettier`. - The lookup uses `mise registry`, which works offline. - Shells with no mise and names mise doesn't know are never flagged on a guess. - Controls: `prettier` → `[prettier] rc=1`; `shfmt`/`zig`/an unknown `jest` → `[] rc=0`. - shellcheck is clean, and docstring coverage is 100%. - Pilot gaps that are canon work but not fixed here are filed as #1107. ## Next - the rsr-template-repo canon fix - the `provision-set` generator and the `provisioning-check.yml` gate - a pilot of about 8 repos, then fan-out in SET batches 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01DAKujx2PXHcVSA7vncTNH1 Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Corrects
docs/SIGNING-POLICY.adoc(merged in #1090, D218). It told apps and bots that "a squash merge of a PR" is one way to get signed commits. That is wrong.required_signatureschecks every commit on the PR branch before it allows the merge. GitHub signs the squash commit, but one unsigned commit on the head still blocks the PR. Measured on pons-asinorum #46 (2026-09-30): withrequired_signaturesas the only active rule, one unsigned bot commit left the PRBLOCKED, andgh pr merge --squashwas refused with "base branch policy prohibits". CodeRabbit raised the same point on rpa-elysium#142.Changes:
createCommitOnBranchandsigned-pushonly, and it points to the new section.git cherry-pick -S, checkinggit diffis empty, then opening a new PR and closing the old one; no force-push and no--admin.The same correction has gone into the per-repo CONTRIBUTING PRs (the 10 open ones were updated, plus kaldor-iiot#98 for the one that had already merged) and into rsr-template-repo#212.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f