fix: repair non-compiling FFI, vacuous gates and three parse-dead workflows by hyperpolymath · Pull Request #53 · hyperpolymath/krl

hyperpolymath · 2026-07-21T12:48:43Z

Part 1 of the KRL work-up: clear the immediate issues so main is green and honest. Strategy (the knot-database positioning and the spec reconciliation) follows as a separate, separately-approved plan.

Everything below was verified by running it. Nothing here is asserted from reading.

Workflows — actionlint 3 errors → 0

File	Root cause
`e2e.yml`	`jobs:` section entirely commented out → "jobs section should not be empty"
`boj-build.yml`	`secrets` context used in a job-level `if:`, where only `github`/`inputs`/`needs`/`vars` are available
`dogfood-gate.yml`	Python at column 0 inside a `run: \|` block scalar whose indent was fixed at 10 spaces — the dedent terminated the scalar

boj-build.yml's gate is removed rather than narrowed to vars, because a vars-only test would silently skip the secret-configured case. The step already exits 0 when the URL is unset.

dogfood-gate.yml now uses a quoted heredoc, which also removes the \" escaping that provoked the dedent. Verified by extracting the step and executing it: no manifest → 0, valid → 0, invalid → 1 with the error annotation.

The FFI shim did not compile at all

src/interface/ffi/src/main.zig declared pub const Handle = opaque { allocator: ..., initialized: ... }. Zig opaque types cannot carry fields, so this shim had never compiled anywhere it was vendored. C consumers only ever hold a *Handle, so a plain struct is ABI-identical — this matches the fix already applied in rpa-elysium. Also callconv(.C) → callconv(.c) (removed in Zig 0.16).

build.zig wired no steps at all. zig build now produces libkrl.a; zig build test runs the three unit tests — 3/3 pass.

Gates that could not fail

aspect_tests.sh grepped src/abi/ and ffi/zig/ — neither exists here (real paths: src/interface/Abi, src/interface/ffi), so the check passed by looking at nothing. It now fails loudly when the scan set is empty.
The same script flagged verification/proofs/README.adoc for containing sorry and unsafeCoerce while documenting them as banned. Scanning is now restricted to source files with comment lines excluded.
Aspect 3 (ABI/FFI correspondence) was commented out with wrong paths. Enabled: 4 %foreign declarations covered by 11 Zig exports.
e2e.sh was entirely TODO — it reported PASS=0 FAIL=0 and exited 0. Now runs four checks, and is negative-controlled: injecting a fault into an exported function yields FAIL=2, exit 2.

Licensing — the sweeper contributed nothing salvageable

The three unpushed sweeper commits were reconciled against canonical SPDX text, not against each other. That inverted the expected conclusion:

CC-BY-SA-4.0.txt on origin/main is already byte-exact canonical. The sweeper's +474/−110 "correction" substituted the Creative Commons plaintext variant — a regression. Dropped.
Neither version of MPL-2.0.txt was canonical (origin/main had http:// where SPDX has https://; the sweeper stripped a significant trailing space). Replaced with canonical SPDX text. Both files now match byte for byte.
LICENSES/AGPL-3.0-or-later.txt dropped — three independent proofs: it contradicts this repo's own deny.toml, no file carries an AGPL SPDX header, and reuse lint reports Unused licenses: AGPL-3.0-or-later.
trailing-whitespace/end-of-file-fixer now exclude LICENSES/. Both canonical texts contain significant trailing whitespace, so these hooks were guaranteed to corrupt them on every commit — this is the mechanism behind that class of damage.
Also dropped: ARCHITECTURE.md (generic boilerplate describing a src/tests/docs/scripts/config layout this repo doesn't have — byte-identical to the one it added to tangle); GOVERNANCE.md, MAINTAINERS, .github/funding.yml (duplicate the existing .adoc/FUNDING.yml); mise.toml (30 tools pinned to "latest", collides with .tool-versions).

Estate-wide findings surfaced here

.pre-commit-config.yaml truncation affects 18 repos. A secret-detection block lost its - repo: key; YAML last-key-wins then overwrote editorconfig-checker's rev with v8.24.3 and set its hooks to null. Net effect: gitleaks silently absent, one hook pointing at a non-existent tag, and no parse error to reveal it. Three further repos' configs don't parse at all.
The opaque-with-fields shim is vendored widely; every copy fails to compile.
rust-ci.yml calls the shared Rust reusable, but there is no Cargo.toml anywhere in this repo — flagged, not removed (it isn't currently red).

Still open — not gated on this PR

Governance job "Workflow security linter" — my SPDX/permissions hypothesis was disproved (every workflow has both). Un-root-caused.
Governance "Check Workflow Staleness", SonarCloud C Security Rating.
GitHub Pages a11y failure on index.md — being handled next.
Instant Sync stays red by design (frozen during the notification-storm remediation).

Draft until CI reports; the Zig 0.16.0 pin in particular needs to survive setup-zig.

…kflows All three workflows in this repo that GitHub refused to parse are fixed, and the gates they were meant to run are made real. Every claim below was verified by executing the thing, not by reading it. Workflows (actionlint: 3 errors -> 0) * e2e.yml had an entirely commented-out `jobs:` section, so the file was rejected with "jobs section should not be empty". It now runs four real jobs against the checked-in scripts. * boj-build.yml used the `secrets` context in a job-level `if:`, where only `github`, `inputs`, `needs` and `vars` are available. The gate is removed rather than narrowed to `vars`, which would have silently skipped the secret-configured case; the step already exits 0 when the URL is unset, which is the documented no-op behaviour. * dogfood-gate.yml embedded Python at column 0 inside a `run: |` block scalar whose indentation was fixed at 10 spaces, terminating the scalar and breaking the YAML. Replaced with a quoted heredoc, which also removes the `\"` escaping that provoked the dedent. Verified by extracting the step and running it against no-manifest / valid / invalid inputs (0 / 0 / 1). FFI (did not compile at all) * src/interface/ffi/src/main.zig declared `pub const Handle = opaque { ... }` with fields. Zig opaque types cannot carry fields, so the shim had never compiled. C consumers only ever hold a `*Handle`, so a plain struct is ABI-identical; this matches the fix already applied in rpa-elysium. * `callconv(.C)` was removed in Zig 0.16; now `callconv(.c)`. * build.zig was scaffolding that wired no steps. `zig build` now produces libkrl.a and `zig build test` runs the three unit tests (3/3 pass). Gates that could not fail * tests/aspect_tests.sh grepped src/abi/ and ffi/zig/, neither of which exists here (the real paths are src/interface/Abi and src/interface/ffi), so its Idris check passed vacuously. It now fails loudly when the scan set is empty, rather than reporting success for having looked at nothing. * The same script flagged verification/proofs/README.adoc for containing the words `sorry` and `unsafeCoerce` while documenting them as banned. Scanning is now restricted to source files, with comment lines excluded. * Aspect 3 (ABI/FFI correspondence) was commented out and its paths were wrong. Enabled: 4 %foreign declarations covered by 11 Zig exports. * tests/e2e.sh was entirely TODO and reported PASS=0 FAIL=0 while exiting 0. It now runs four checks. Negative-controlled: injecting a fault into an exported function yields FAIL=2 and exit 2. Licensing * Reconciled the three unpushed sweeper commits against canonical SPDX text rather than against each other. origin/main's CC-BY-SA-4.0.txt is already byte-exact canonical; the sweeper's +474/-110 rewrite substituted the Creative Commons plaintext variant and was a regression, so it is dropped. * Neither version of MPL-2.0.txt was canonical (origin/main had http:// where SPDX has https://; the sweeper stripped a significant trailing space). Replaced with the canonical SPDX text. Both files now match byte for byte. * LICENSES/AGPL-3.0-or-later.txt is dropped. It contradicts this repo's own .machine_readable/compliance/rust/deny.toml, no file carries an AGPL SPDX header, and `reuse lint` reports it as "Unused licenses: AGPL-3.0-or-later". * trailing-whitespace and end-of-file-fixer now exclude LICENSES/. Both canonical texts contain significant trailing whitespace, so the hooks were guaranteed to corrupt them on every commit. This is the mechanism behind that class of damage. * The rest of the sweeper's output is dropped: ARCHITECTURE.md was generic boilerplate describing a src/tests/docs/scripts/config layout this repo does not have (and was byte-identical to the one it added to tangle); GOVERNANCE.md, MAINTAINERS and .github/funding.yml duplicate the existing GOVERNANCE.adoc, MAINTAINERS.adoc and .github/FUNDING.yml; mise.toml pinned 30 tools to "latest" and collided with .tool-versions. Also * .pre-commit-config.yaml had a truncated secret-detection block with no `- repo:` key. YAML last-key-wins silently overwrote editorconfig-checker's rev with v8.24.3 and set its hooks to null, so gitleaks was absent and one hook pointed at a non-existent tag. Restored. Eighteen other repos in the estate share this exact truncation. * .tool-versions pinned `rust nightly` -- the one language absent from this repo -- while zig and idris2 sat commented out. Corrected. * zig-out/ added to .gitignore.

sonarqubecloud · 2026-07-21T12:53:05Z

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

…ly (#54) Follows #53. Same Part 1 remit: make `main` green **and honest**. This half is the documentation de-conflation. ## The three projects are distinct QuandleDB is the knot database. KRL is its resolution language, developed alongside it. **Tangle is a separate project** — a general language for knot mathematics (topological, algebraic, geometric, logical) that happens to share the subject matter. Documentation here had fused KRL and Tangle into a single compilation pipeline that does not exist. The relationship between KRL and QuandleDB is left intact — it is real and deliberate. What is removed is the false *identity* with Tangle, not the shared domain. ## README.md - Removed the claim that KRL *"lowers through TangleIR into Tangle-level computation"*, and the layer table presenting Tangle as KRL's substrate. **`TangleIR` appears 0 times in the KRL implementation** — the struct definitions the README documented as "the single hardest-designed artifact in the stack" correspond to no code. - Removed `KRLAdapter.jl` as the named canonical implementation. It no longer exists. - Removed the `TanglePL` usage example, which imports packages that don't exist. - Added the **known divergence**: this repo's grammar and QuandleDB's are disjoint on core vocabulary, and `|` is bound to opposite meanings (tensor here, pipeline there). - A short note records that these claims were false, so the correction is legible rather than silent. ### This also fixes the GitHub Pages failure Root cause was **not** generic: Ddraig SSG certifies pages against a decidable a11y predicate requiring exactly one `<h1>` and no heading-level skips. The old README had **8** `<h1>`s: ``` + index.md -> index.html [a11y FAIL] a11y: exactly one <h1> required (found 8) ``` Verified by compiling Ddraig locally (Idris2) and running the real certifier: | README | Result | |---|---| | `origin/main` (old) | `[a11y FAIL]` — exit 1 | | this branch | `[a11y ok]` — exit 0 | ## READINESS.md — Grade D → E The **entire** evidence base for Grade D was a parser, AST, lowering pass and 57-test matrix in `KRLAdapter.jl`. That repository no longer exists, so none of it can be checked. The CRG demotion table gives `D → E` for *"the scope narrows so far that the component barely does anything"* — which is exactly what happened. Replaced with evidence executed on 2026-07-21: grammar smoke 20/20, `zig build test` 3/3, aspect 4/4, e2e 4/4. Limitations stated plainly, including that **no conformance suite exists**, so "conforms to the KRL spec" is not currently a checkable claim. This is a correction to the record, not a regression in the work. ## ASSUMPTIONS.md Seven DESIGN assumptions named code in `KRLAdapter.jl`. The file defines a DESIGN assumption as *"true by construction in our code"* — with the code gone, there is no construction left to be true by. - A-KR-1.1, 1.2, 2.1, 3.2, 4.1 → **UNANCHORED** (statement stands as intent, names no live code) - A-KR-6.1, 6.2 → **VOID** (both presuppose two implementations; only one exists) Verified that **no re-anchoring is possible**: `sigma`, `cup`, `cap`, `r1_simplify` and any pretty-printer appear **0 times** in `quandledb/server/krl/`. The braid generators these assumptions describe are implemented nowhere. The four MATH assumptions are untouched — they rest on external theorems. ## TOPOLOGY.md Was pure RSR-template residue describing the template itself, its dogfood gate, and "500+ RSR-based repositories" downstream. Replaced with KRL's actual topology: the three project boundaries, the ABI/FFI layering, and the spec/implementation seam that no conformance suite currently checks. States that this repo exposes **no** Groove service and has no `.well-known/groove/manifest.json`, rather than implying one exists. ## Verified on this branch `actionlint` 0 errors · aspect 4/4 · e2e 4/4 · smoke 20/20 · Ddraig a11y ok The matching de-conflation pass on `hyperpolymath/tangle` (whose README is titled *"Tangle / KRL"*) follows separately.

…ed (#55) Follows #53 and #54. The Dogfood Gate **could not parse** before #53, so it never ran. Now that it parses, it runs — and immediately reported **2 A2ML errors and 4 K9 errors** on `main`. That's the gate working as intended; this PR clears what it found. Each fix was verified by running the **actual validator** locally, not by reading its source. ## A2ML: 2 errors → 0 ### `docs/governance/TSDM.a2ml` was not defective — the pin was stale This is the [SHA-pinning-defeats-upstream-fixes](https://github.com/hyperpolymath/krl) pattern, caught red-handed: | | | |---|---| | Pinned | `6bff6ec` — PR **#26**, *"recognise s-expression identity/version fields"* | | Fix needed | `6c47174` — PR **#41**, *"recognise colon/brace-block identity"* | TSDM.a2ml declares `id: "tsdm-standard"`, the colon/brace-block form. The validator's own source comment **names this exact file** as the motivating case — so the fix existed upstream, and the pin predated it. Confirmed before changing anything: running the newer validator locally drops the count **2 → 1**. Bumped to current main (`5468b7f`). ### `docs/governance/MAINTENANCE-CHECKLIST.a2ml` genuinely lacked identity The validator exempts four categories — `*AI-MANIFEST*` files, `.machine_readable/` (structural identity), contractile `@directive` shape, and named typed manifests. **None applies here**, and the file has no `name`/`project`/`agent-id`. Added `name` to its `[metadata]` block. ## K9: 4 errors → 0 Unlike the A2ML case, these are **genuine file defects** — the current validator reports the same 4 errors as the pinned one, so pin staleness is ruled out. - Both `container/deploy.k9.ncl` and `.machine_readable/self-validating/methodology-guard.k9.ncl` were missing the mandatory **`K9!` magic number** on line 1. - `deploy.k9.ncl` had `pedigree = component_pedigree,` where the canonical template (`rsr-julia-library-template-repo`) has `pedigree = component_pedigree & { name = "…" },`. Without the merge the pedigree carries no name. Matched to the template. - `methodology-guard.k9.ncl` had **no pedigree block at all**. Added one. > This is template rot with a measurable blast radius: `container/deploy.k9.ncl` is missing the `K9!` line in **6 repos** (lucidscript, pandoc-k9, pseudoscript, squeakwell, stateful-artefacts, systemet) while the newer template has it. ## ⚠️ `K9!` and Nickel contradict each other, estate-wide Worth recording, and **not** changed here: ```console $ nickel typecheck container/deploy.k9.ncl error: unexpected token 1 │ K9! │ ^ ``` The magic number **is not valid Nickel**, so `nickel typecheck` fails on *every* `.k9.ncl` in the estate that carries it — including the canonical template and every currently-passing file. `k9-svc` evidently strips the line before parsing. The consequence is that the `nickel typecheck container/deploy.k9.ncl` usage line **in these files' own headers can never succeed as written**. Pre-existing and estate-wide, so left alone. But I used it as a check: both files were typechecked with the magic line stripped, and **that caught a real error in my first draft**, where the new pedigree block sat at top level in a file whose body is `let … in …` — invalid Nickel. Moved inside the record; the validator matches at any indent. ## Verified | Check | Result | |---|---| | K9 validator | **0 errors** (8 files) | | A2ML validator | **0 errors** (121 files) | | `actionlint` | **0 errors** | | `tests/aspect_tests.sh` | 4/4 | | `tests/e2e.sh` | 4/4 | | `tests/smoke/grammar_smoke.sh` | 20/20 |

…andards pins (#56) Both failing Governance jobs are root-caused and fixed. Follows #53, #54, #55. ## `Workflow security linter` ``` ERROR: .github/workflows/pages.yml missing SPDX header ``` `pages.yml` arrived in #51 and begins directly at `name:`. Every other workflow already carries the header; this was the only one. > **Recording a correction against myself.** Earlier in this programme I audited all workflows, reported that every one had both an SPDX header *and* a top-level `permissions:` block, and marked the SPDX hypothesis **disproved**. That audit was wrong — it must have run against a tree without `pages.yml`. The real cause is exactly the one first suspected. A "disproved" hypothesis is only as good as the test that disproved it. ## `Check Workflow Staleness` ``` governance-reusable.yml pin d7c22711e830 is 63 commit(s) / 24d behind standards HEAD — outside the recency window (>50 commits AND >14d). Refresh toward f9dca6ded2ca ``` Three callers were pinned at `d7c22711e830`: | Workflow | From | To | |---|---|---| | `governance-reusable.yml` | `d7c22711e830…` | `f9dca6ded2cad8ab54044c1cb0489b558ae2682b` | | `hypatia-scan-reusable.yml` | `d7c22711e830…` | `f9dca6ded2cad8ab54044c1cb0489b558ae2682b` | | `scorecard-reusable.yml` | `d7c22711e830…` | `f9dca6ded2cad8ab54044c1cb0489b558ae2682b` | Full 40-char SHAs — the gate's message quotes the abbreviated form, which would weaken the pin. ### Deliberately not touched - **`mirror-reusable.yml`** (`d135b05`) and **`secret-scanner-reusable.yml`** (`c65436e`) — neither was flagged by the staleness gate, and the secret-scanner pin in particular **should not be moved independently of the gitleaks allowlist work**, since re-pinning consumers ahead of the config work reintroduces false positives. - **`scorecard-enforcer.yml`** — the gate asks for its removal, but **this repo doesn't have that file**. That clause is generic advice in the reusable's message, not a finding against krl. ## Note on bumping toward standards HEAD The newer `governance-reusable` has *more* real checks than the pinned one (its previously-dead docs and Guix/Nix jobs were made real, warn-first until 2026-08-21). So this bump may surface new warnings. That is the gate working, and warn-first means it should not turn the build red. ## Verified `actionlint` **0 errors** · all **18** workflows carry an SPDX header

…ode) (#58) `main` is green as of #57. This addresses the one original red that had gone unexamined all programme: **SonarCloud Quality Gate — `C Security Rating on New Code` (required ≥ A)**. ## Getting the findings without dashboard access SonarCloud's project is public, so its API lists them directly: ``` https://sonarcloud.io/api/issues/search?componentKeys=hyperpolymath_krl&types=VULNERABILITY ``` **15 vulnerabilities, all inside the new-code period.** Two are fixed here — including one this programme introduced. ## Fixed ### `e2e.yml` — *"Replace `read-all` with specific permissions"* **This one is mine.** `e2e.yml` was rewritten in #53 and carried the RSR template's `permissions: read-all`. Narrowed to `contents: read`, which is all four jobs need. ### `pages.yml` ×3 — *"Move this read/write permission from workflow level to job level"* The workflow granted `contents:read` + `pages:write` + `id-token:write` to **both** jobs, but only `deploy` needs the pages and id-token scopes. Now split per job: | Job | Permissions | |---|---| | `build` | `contents: read` | | `deploy` | `contents: read`, `pages: write`, `id-token: write` | That matters here beyond satisfying the linter: the `build` job runs a **container image** and executes the SSG over repository content. It should not be holding deploy credentials while doing so. ## Not fixed — deliberately, so this stays reviewable | Finding | Location | |---|---| | Only pass required secrets to this workflow | `secret-scanner.yml:18`, `mirror.yml:12` | | Dependencies without locked resolved versions | `release.yml:38` | | Not enforcing HTTPS | `release.yml:91`, `static-analysis-gate.yml:30,31,229,230`, `setup.sh:144,156` | | Workflow-level permission | `static-analysis-gate.yml:11` | **The rating will not reach A until those are triaged too.** Several of the HTTPS findings may be false positives and need reading in context before anything is changed — which is exactly why they aren't bundled into a PR about permissions. ## Verified `actionlint` **0** · K9 **0 errors** · A2ML **0 errors** · e2e 4/4 · aspect 4/4 · smoke 20/20

…ws (#78) The tangle half of a coordinated two-repo de-conflation pass. The krl half is hyperpolymath/krl#53 (merged) and hyperpolymath/krl#54. ## The three projects are separate **Tangle** is a general language for knot mathematics — topological, algebraic, geometric, logical. **QuandleDB** is a knot database. **KRL** is QuandleDB's resolution language, developed jointly with it. They share a subject matter, not an architecture. Documentation here presented Tangle as the substrate of a KRL compilation stack. That is false in both directions, and the connecting layer does not exist: > **`TangleIR` appears in NO source file in this repository** — 0 hits across `.rs`, `.zig` and `.lean` — **and in NO source file in the KRL implementation.** It existed only in prose, in both repos. The relationship between the projects is left intact. What is removed is a claimed architectural dependency that was never built. ## README.adoc - Retitled from *"Tangle / KRL — Topological Programming Language"* to **"Tangle — a general language for knot mathematics"**; removed *"Tangle (via KRL — Knot Resolution Language) is…"* from the opening line. - Removed the `KRL → TangleIR → Tangle core → QuandleDB + Skein.jl` ladder. - Removed the `== KRL — Knot Resolution Language` section, which restated KRL's four operations as though KRL were *this* project's surface language. - **Strengthened the formal core with a result rather than a claim** (below). - Added an explicit note that only the Lean proofs are CI-gated. ## The formal core is real — and now verified I ran the repository's own documented oracle: ```console $ cd proofs && lean Tangle.lean $ echo $? 0 ``` | Check | Result | |---|---| | `lean Tangle.lean` (pinned `leanprover/lean4:v4.14.0`) | **exit 0, no errors** | | `sorry` count | **0** | | `axiom` count | **0** | | `import` lines | **0** — self-contained, no Mathlib | | `progress`, `preservation`, `determinism`, `type_safety`, `infer_sound`, `infer_complete`, `infer_iff_hasType` | all present with real proof terms | This is worth stating precisely: an `axiom` stub compiles cleanly while proving nothing, so *"the Lean build is green"* and *"the theorems are proved"* are different claims in general. **Here they coincide, and that was checked rather than assumed.** This is Tangle's strongest asset and the README now leads with it. ## AFFIRMATION.adoc — erratum, not edit An affirmation is a dated claim about a past state (`102499d`, 2026-06-19); amending it in place would falsify a record. So the original text is untouched and an erratum is appended. It corrects the *"maintainer-confirmed"* `KRL → TangleIR → VerisimCore → Skein/QuandleDB` stack, and flags that the quotable one-line characterisation shouldn't be quoted while it calls Tangle *"the … TangleIR of the KRL stack"*. It also **discharges one of the affirmation's own acknowledged gaps** — it recorded *"OCaml + Lean not run (absent)"* and concluded *"structure + the repo's proof records are confirmed, not a fresh green build."* The Lean half is now closed, with command and exit code recorded. ## READINESS.md — Grade C → D Grade C means *self-validated in the home context*; the `D → C` trigger is *"dogfood it hard in the home context."* The assessment cited **exactly one** piece of dogfooding evidence: > **Dogfooding:** Used internally as host for the KRL (Knot Resolution Language) DSL That is false — KRL is not built on Tangle. With it withdrawn, C is unsupported. Two further corrections: - **"CI: Clean" was false** — `main` was failing Governance and both Jekyll workflows. - **The test suites are not run by CI.** Eight OCaml test files exist under `compiler/test/`, but **no workflow invokes `dune` or `cargo test`**. The cheapest available uplift is named explicitly: add a workflow running `dune build && dune test`. Eight suites already exist and nothing executes them. ## dialects/README.md - Removed KRL from the dialect table — it was listed as a dialect that had "graduated", and it was never a Tangle dialect. - Replaced the dead absolute path `/var/mnt/eclipse/repos/krl` (another machine) with the GitHub URL. - Dropped "wire through to TangleIR" from the maturation pattern. ## Workflows — two deleted `jekyll.yml` and `jekyll-gh-pages.yml` are GitHub's **sample** Jekyll workflows. This repo has **no `_config.yml` and no `Gemfile`** — there is no Jekyll site to build, so both fail on every push. `pages.yml` (Ddraig SSG, #73) is the real one; three workflows were competing for the same Pages deployment. ## ⚠️ Owner action — GitHub Pages is not enabled `pages.yml` will **still** fail at the deploy step after this PR. Its build succeeds and certifies a11y, but: ``` GET /repos/hyperpolymath/tangle/pages -> 404 Not Found ``` which surfaces as `HttpError: Not Found / Creating Pages deployment failed`. **The same is true of `hyperpolymath/krl`.** Pages needs enabling with source = GitHub Actions on both. That publishes a public site, so I've left it to you rather than doing it. ## Verified on this branch `actionlint` 0 errors · `asciidoctor` renders `README.adoc` and `AFFIRMATION.adoc` clean · `lean Tangle.lean` exit 0

hyperpolymath marked this pull request as ready for review July 21, 2026 12:52

Merge branch 'main' into fix/part1-remediation

efcae67

hyperpolymath merged commit 75bad95 into main Jul 21, 2026
18 of 30 checks passed

hyperpolymath deleted the fix/part1-remediation branch July 21, 2026 12:54

hyperpolymath mentioned this pull request Jul 21, 2026

docs: de-conflate KRL from Tangle, restate the readiness grade honestly #54

Merged

This was referenced Jul 21, 2026

docs: de-conflate Tangle from KRL; drop two dead Jekyll Pages workflows hyperpolymath/tangle#78

Merged

fix(dogfood-gate): repair the manifest defects the revived gate exposed #55

Merged

hyperpolymath mentioned this pull request Jul 21, 2026

fix(governance): add SPDX header to pages.yml, refresh three stale standards pins #56

Merged

hyperpolymath mentioned this pull request Jul 21, 2026

fix(security): least-privilege workflow permissions (SonarCloud New Code) #58

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: repair non-compiling FFI, vacuous gates and three parse-dead workflows#53

fix: repair non-compiling FFI, vacuous gates and three parse-dead workflows#53
hyperpolymath merged 2 commits into
mainfrom
fix/part1-remediation

hyperpolymath commented Jul 21, 2026

Uh oh!

sonarqubecloud Bot commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Jul 21, 2026

Workflows — actionlint 3 errors → 0

The FFI shim did not compile at all

Gates that could not fail

Licensing — the sweeper contributed nothing salvageable

Estate-wide findings surfaced here

Still open — not gated on this PR

Uh oh!

sonarqubecloud Bot commented Jul 21, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant