chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest by hyperpolymath · Pull Request #41 · hyperpolymath/jaffascript

hyperpolymath · 2026-08-05T09:31:44Z

Automated estate top-up. Nothing here invents a value.

Filled — every token with one mechanical answer (owner, repo, forge, author, dates, project name, main branch). Identity from the git remote, dates from the clock, name from the README H1.

Not filled, on purpose — SECURITY_EMAIL (two competing addresses exist in the estate), RESPONSE_TIME, CONDUCT_TEAM (substitutes into "a {{CONDUCT_TEAM}} member", which is not English), WEBSITE, PROJECT_DESCRIPTION, LANG_STACK. More than one defensible answer exists, and a confident wrong value is worse than a visible gap.

Deleted — ARCHITECTURE.md where it is byte-identical to the 346-copy estate boilerplate (blob 607e3d8c). Those 33 lines describe a src/ tests/ docs/ scripts/ config/ tree this repo does not have. Matched by hash, so a genuinely written ARCHITECTURE can never be caught by it.

CODEOWNERS — the solo form from standards/CODEOWNERS-POLICY.adoc Rule 1, which forbids a catch-all where the only owner is the sole maintainer. templates/CODEOWNERS contradicts that policy; the policy is versioned, dated and resolves standards#55, so it wins. Genuine co-owners (Rule 2) are untouched.

Surfaced — REQUIRES_INITIALISATION.md plus a priority action in 0-AI-MANIFEST.a2ml, listing every remaining token, what it means, which files it belongs in, why it was not done already, and that it is to be deleted only when the work is genuinely complete.

Built from a fresh clone of origin/main, never a local checkout — several of those are dirty and hold unpushed commits.

🤖 Generated with Claude Code

@hyperpolymath

…the rest Estate top-up pass. Three separate things, none of which invents a value. FILLED — every token with a single mechanical answer: OWNER, REPO, FORGE, PROJECT, PACKAGE_NAME, PROJECT_NAME, AUTHOR, AUTHOR_EMAIL, CONDUCT_EMAIL, AUTHOR_FIRST/LAST/INITIALS, CURRENT_YEAR, CURRENT_DATE, DATE, MAIN_BRANCH. Identity comes from the git remote, dates from the clock, project name from the README H1 where there is one. Deliberately NOT filled, because more than one defensible answer exists and a confident wrong value is worse than a visible gap: SECURITY_EMAIL (two competing addresses are in use across the estate), RESPONSE_TIME, CONDUCT_TEAM (which substitutes into "a {{CONDUCT_TEAM}} member", not English), WEBSITE, PROJECT_DESCRIPTION, LANG_STACK. DELETED — ARCHITECTURE.md, where it is byte-identical to the 346-copy estate boilerplate (blob 607e3d8). Those 33 lines describe a src/ tests/ docs/ scripts/ config/ tree that this repo does not have, so the file is not merely uninformative, it is wrong. Genuinely written ARCHITECTURE files are matched by hash and left alone. No file beats a confidently false one. CODEOWNERS — rewritten to the solo form mandated by hyperpolymath/standards CODEOWNERS-POLICY.adoc Rule 1, which forbids a catch-all line where the only owner is the sole maintainer. The estate's own templates/CODEOWNERS contradicts that policy; the policy is versioned, dated and resolves standards#55, so it wins. Files naming a genuine co-owner are Rule 2 and are untouched. Note @hyperpolymath and @metadatastician are the same person, so a file naming the other account is a copy artifact that silently routed review requests to the wrong account. SURFACED — REQUIRES_INITIALISATION.md, and a priority action in 0-AI-MANIFEST.a2ml. Tokens that need a decision no script can make are left visibly unfilled rather than faked or quietly deleted. The marker says what each one is, which files it belongs in, why it was not done already, and that it must be deleted only once the work is genuinely finished.

gitar-bot · 2026-08-05T09:35:29Z

+;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 ;;
-;; Guix package definition for {{PROJECT_NAME}}
+;; Guix package definition for What it is


🚨 Bug: PROJECT_NAME filled with README heading text "What it is"

The root README H1 is a section heading (# What it is, followed by the description); the actual project name is "JaffaScript" (README body, repo slug jaffascript). The top-up's "name from README H1" heuristic grabbed the heading and substituted the literal string What it is for every {{PROJECT_NAME}}/{{PROJECT}} token. Because the value contains spaces it produces syntactically broken output: guix.scm has (name "What it is") (Guix package names must be lowercase and space-free) and home-page "https://github.com/hyperpolymath/What it is"; .guix-channel has the invalid Scheme symbol (name 'What it is) and space-containing channel URL; docs/attribution/CITATIONS.adoc emits the invalid BibTeX key @software{What it is_2026, and broken clone URLs; and dozens of prose/label files now read "What it is" as if it were the name. Replace with the real project name (e.g. JaffaScript, slug jaffascript) across all affected files.

_{Was this helpful? React with 👍 / 👎}

gitar-bot · 2026-08-05T09:35:30Z


 [methodology.state-validation]
-reject-if-contains = ["{{PLACEHOLDER}}", "{{PROJECT}}", "rsr-template-repo"]
+reject-if-contains = ["{{PLACEHOLDER}}", "JAFFASCRIPT", "rsr-template-repo"]


⚠️ Bug: State-validation guards now reject the project's own name JAFFASCRIPT

The {{PROJECT}} placeholder inside the anti-template guards was meant to be a token that detects un-substituted state files, but the top-up replaced it with the literal JAFFASCRIPT. The rules now read reject-if-contains = ["{{PLACEHOLDER}}", "JAFFASCRIPT", "rsr-template-repo"] and reject_patterns = [..., "JAFFASCRIPT", ...], i.e. they will flag any legitimate STATE.a2ml that references the project's own uppercase identifier as corrupt/template state. Restore a placeholder-detection sentinel (or drop the JAFFASCRIPT entry) rather than substituting the real name into a reject list.

_{Was this helpful? React with 👍 / 👎}

gitar-bot · 2026-08-05T09:35:32Z

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review 🚫 Blocked 0 resolved / 3 findings

Automated estate top-up replacing placeholders and cleaning up boilerplate. Blocked by critical findings: PROJECT_NAME filled with README heading text "What it is", state-validation guards rejecting the project's own name, and corrupted manual-replace sed commands in documentation.

🚨 Bug: PROJECT_NAME filled with README heading text "What it is"

The root README H1 is a section heading (# What it is, followed by the description); the actual project name is "JaffaScript" (README body, repo slug jaffascript). The top-up's "name from README H1" heuristic grabbed the heading and substituted the literal string What it is for every {{PROJECT_NAME}}/{{PROJECT}} token. Because the value contains spaces it produces syntactically broken output: guix.scm has (name "What it is") (Guix package names must be lowercase and space-free) and home-page "https://github.com/hyperpolymath/What it is"; .guix-channel has the invalid Scheme symbol (name 'What it is) and space-containing channel URL; docs/attribution/CITATIONS.adoc emits the invalid BibTeX key @software{What it is_2026, and broken clone URLs; and dozens of prose/label files now read "What it is" as if it were the name. Replace with the real project name (e.g. JaffaScript, slug jaffascript) across all affected files.

⚠️

Bug: State-validation guards now reject the project's own name JAFFASCRIPT

📄 .machine_readable/bot_directives/methodology.a2ml:104 📄 .machine_readable/contractiles/self-validating/methodology-guard.k9.ncl:47 📄 .machine_readable/agent_instructions/methodology.a2ml 📄 .machine_readable/contractiles/k9/methodology-guard.k9.ncl

The {{PROJECT}} placeholder inside the anti-template guards was meant to be a token that detects un-substituted state files, but the top-up replaced it with the literal JAFFASCRIPT. The rules now read reject-if-contains = ["{{PLACEHOLDER}}", "JAFFASCRIPT", "rsr-template-repo"] and reject_patterns = [..., "JAFFASCRIPT", ...], i.e. they will flag any legitimate STATE.a2ml that references the project's own uppercase identifier as corrupt/template state. Restore a placeholder-detection sentinel (or drop the JAFFASCRIPT entry) rather than substituting the real name into a reject list.

💡 Quality: PLACEHOLDERS.adoc manual-replace sed commands corrupted

📄 .machine_readable/.machine_readable/ai/PLACEHOLDERS.adoc

The manual-replace examples had their placeholder tokens substituted, turning documentation into dangerous/nonsensical commands: sed -i "s/2026/$(date +%Y)/g" would rewrite every occurrence of 2026 in the tree (copyright years, versions), sed -i 's/What it is/my-project/g' matches ordinary prose, and self-referential lines like sed -i 's/github.com/github.com/g' are no-ops. This file is instructional; its examples should keep the {{TOKEN}} form (e.g. s/{{CURRENT_YEAR}}/.../) so copy-pasting them does the right thing. Exclude this reference doc from the token substitution pass.

🤖 Prompt for agents

Code Review: Automated estate top-up replacing placeholders and cleaning up boilerplate. Blocked by critical findings: PROJECT_NAME filled with README heading text "What it is", state-validation guards rejecting the project's own name, and corrupted manual-replace sed commands in documentation.

1. 🚨 Bug: PROJECT_NAME filled with README heading text "What it is"
   Files: guix.scm:4, guix.scm:10, guix.scm:21, guix.scm:66, .guix-channel:4, .guix-channel:9, .guix-channel:10, .guix-channel:17, docs/attribution/CITATIONS.adoc:3, docs/attribution/CITATIONS.adoc:10, docs/attribution/CITATIONS.adoc:14, docs/attribution/CITATIONS.adoc:21, docs/attribution/CITATIONS.adoc:25, docs/attribution/CITATIONS.adoc:29, docs/attribution/CITATIONS.adoc:33, docs/attribution/CITATION.cff:7, container/Containerfile:2, container/Containerfile:72, .devcontainer/Containerfile:4, .devcontainer/Containerfile:6, .devcontainer/Containerfile:27, .devcontainer/devcontainer.json:4, .devcontainer/devcontainer.json:8, .envrc:21

   The root README H1 is a section heading (`# What it is`, followed by the description); the actual project name is "JaffaScript" (README body, repo slug `jaffascript`). The top-up's "name from README H1" heuristic grabbed the heading and substituted the literal string `What it is` for every `{{PROJECT_NAME}}`/`{{PROJECT}}` token. Because the value contains spaces it produces syntactically broken output: `guix.scm` has `(name "What it is")` (Guix package names must be lowercase and space-free) and `home-page "https://github.com/hyperpolymath/What it is"`; `.guix-channel` has the invalid Scheme symbol `(name 'What it is)` and space-containing channel URL; `docs/attribution/CITATIONS.adoc` emits the invalid BibTeX key `@software{What it is_2026,` and broken clone URLs; and dozens of prose/label files now read "What it is" as if it were the name. Replace with the real project name (e.g. `JaffaScript`, slug `jaffascript`) across all affected files.

2. ⚠️ Bug: State-validation guards now reject the project's own name JAFFASCRIPT
   Files: .machine_readable/bot_directives/methodology.a2ml:104, .machine_readable/contractiles/self-validating/methodology-guard.k9.ncl:47, .machine_readable/agent_instructions/methodology.a2ml, .machine_readable/contractiles/k9/methodology-guard.k9.ncl

   The `{{PROJECT}}` placeholder inside the anti-template guards was meant to be a token that detects un-substituted state files, but the top-up replaced it with the literal `JAFFASCRIPT`. The rules now read `reject-if-contains = ["{{PLACEHOLDER}}", "JAFFASCRIPT", "rsr-template-repo"]` and `reject_patterns = [..., "JAFFASCRIPT", ...]`, i.e. they will flag any legitimate STATE.a2ml that references the project's own uppercase identifier as corrupt/template state. Restore a placeholder-detection sentinel (or drop the JAFFASCRIPT entry) rather than substituting the real name into a reject list.

3. 💡 Quality: PLACEHOLDERS.adoc manual-replace sed commands corrupted
   Files: .machine_readable/.machine_readable/ai/PLACEHOLDERS.adoc

   The manual-replace examples had their placeholder tokens substituted, turning documentation into dangerous/nonsensical commands: `sed -i "s/2026/$(date +%Y)/g"` would rewrite every occurrence of 2026 in the tree (copyright years, versions), `sed -i 's/What it is/my-project/g'` matches ordinary prose, and self-referential lines like `sed -i 's/github.com/github.com/g'` are no-ops. This file is instructional; its examples should keep the `{{TOKEN}}` form (e.g. `s/{{CURRENT_YEAR}}/.../`) so copy-pasting them does the right thing. Exclude this reference doc from the token substitution pass.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

`Compact`
`gitar display:verbose`

Important

Your trial ends in 5 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}

gitar-bot

⚠️ This PR is blocked due to unresolved code review findings.

_{Configure merge blocking · Maintainers can dismiss this review.}

github-actions · 2026-08-05T10:03:04Z

🔍 Hypatia Security Scan

Findings: 18 issues detected

Severity	Count
🔴 Critical	0
🟠 High	13
🟡 Medium	5

View findings

[
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 14 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/scorecard.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): BranchProtectionID -- Branch-Protection -- 40 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 41 day(s) old [STALE]",
    "type": "CSA001",
    "file": "push-email-notify.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): FuzzingID -- Fuzzing -- 47 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): SASTID -- SAST -- 47 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): CodeReviewID -- Code-Review -- 47 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): MaintainedID -- Maintained -- 47 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 47 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "10 total open code-scanning alert(s) -- security hygiene review",
    "type": "CSA002",
    "file": "hyperpolymath/jaffascript",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

…t a value The estate top-up sweep substituted {{PROJECT}} here along with every other token. This line is a DETECTOR list: the comment above it says these rules detect corrupt/template/stale state files, so the tokens named in it are the ones whose PRESENCE means a state file is broken. Substituting it did two things. It blinded the {{PROJECT}} leak detector, and it made the detector reject any state file containing this repo's own uppercased name — the opposite of what the rule is for. Same failure class as a template recipe rewriting the incident record that documents its own bug: substituting tokens inside a thing that is ABOUT tokens. Nothing else in this PR changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sonarqubecloud · 2026-08-05T13:12:20Z

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

The previous commit on this branch was written by a script that read the file through a shell command substitution. $(...) strips trailing newlines and printf '%s' does not put one back, so the file lost its final newline and the diff showed "\ No newline at end of file". Content is otherwise byte-identical to that commit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sonarqubecloud · 2026-08-05T13:30:40Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-08-05T14:33:27Z

🔍 Hypatia Security Scan

Findings: 18 issues detected

Severity	Count
🔴 Critical	0
🟠 High	13
🟡 Medium	5

View findings

[
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 14 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/scorecard.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): BranchProtectionID -- Branch-Protection -- 40 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/workflow_audit/missing_timeout_minutes -- Hypatia workflow_audit: missing_timeout_minutes -- 41 day(s) old [STALE]",
    "type": "CSA001",
    "file": "push-email-notify.yml",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): FuzzingID -- Fuzzing -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): SASTID -- SAST -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "update",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Scorecard): CodeReviewID -- Code-Review -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): MaintainedID -- Maintained -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": "no file associated with this alert",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "Code scanning (Scorecard): TokenPermissionsID -- Token-Permissions -- 48 day(s) old [STALE]",
    "type": "CSA001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "escalate",
    "rule_module": "code_scanning_alerts",
    "severity": "high"
  },
  {
    "reason": "10 total open code-scanning alert(s) -- security hygiene review",
    "type": "CSA002",
    "file": "hyperpolymath/jaffascript",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-08-06T22:16:37Z

Closing in favour of a reworked substituter — hyperpolymath/standards#590.

This sweep filled {{TOKEN}} placeholders by plain text replacement across every file. Across the 90 repositories reviewed it drew 141 findings, and one is severe:

sed "s/{{PROJECT_NAME}}/$name/g"  →  sed "s/Conative Gating/$name/g"
sed -e "s/{{DATE}}/$DATE/g"       →  sed -e "s/2026-08-05/$DATE/g"

Those are the scripts whose job is to perform template substitution. Filling the left-hand side of their own sed expressions means template application silently stops working — and the breakage stays invisible until someone mints a repository from the template and gets a half-substituted tree.

Four further shapes came out of the same cause:

release.sh no longer substitutes {{DATE}} into release notes
just's own {{ARGS}} reported as an unfilled token, leaving repos permanently "not initialised"
instructional docs rewritten to "Replace laminar, laminar, {{DEPS}} with actuals"
documentation describing placeholders had its examples filled in

The rule plain replacement cannot express: a placeholder is sometimes a value to fill and sometimes the subject being discussed. standards#590 encodes that distinction and is tested against this exact corruption (9/9, the first three cases reproducing it).

Nothing here is lost — the placeholder filling will be redone with that tool. Closing rather than fixing forward because repairing 289 branches individually would repeat the mistake at the same scale.

gitar-bot Bot reviewed Aug 5, 2026

View reviewed changes

gitar-bot Bot requested changes Aug 5, 2026

View reviewed changes

hyperpolymath and others added 3 commits August 5, 2026 14:11

hyperpolymath and others added 3 commits August 5, 2026 14:26

hyperpolymath closed this Aug 6, 2026

Navigation Menu

chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest - #41

chore: fill derivable placeholders, drop false ARCHITECTURE, surface the rest#41
hyperpolymath wants to merge 7 commits into
mainfrom
chore/estate-topup

hyperpolymath commented Aug 5, 2026

Uh oh!

gitar-bot Bot Aug 5, 2026

Uh oh!

gitar-bot Bot Aug 5, 2026

Uh oh!

gitar-bot Bot commented Aug 5, 2026

Uh oh!

gitar-bot Bot left a comment

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Uh oh!

github-actions Bot commented Aug 5, 2026

Uh oh!

hyperpolymath commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

hyperpolymath commented Aug 5, 2026

Uh oh!

gitar-bot Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

gitar-bot Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

gitar-bot Bot commented Aug 5, 2026

Uh oh!

gitar-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 5, 2026

🔍 Hypatia Security Scan

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Uh oh!

sonarqubecloud Bot commented Aug 5, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Aug 5, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant