From c139a5f1ea983f26d25393f7923f18161ff5c690 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 6 Aug 2026 12:56:01 +0100 Subject: [PATCH 1/3] chore(governance): declare the banned-language migration backlog MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The "Language / package anti-pattern policy" gate is failing on 3 file(s) in banned languages (3 python). The gate is CORRECT — these really are languages estate policy bans. But deleting them would destroy working code without porting it, so this uses the mechanism the gate's own failure message names: (declare an exemption via .hypatia-ignore ... if intentional) Every path is listed individually rather than by wildcard. A `src/**` entry would silently absorb NEW banned files added later, turning a migration ledger into a permanent blind spot. Listing each path means a newly added file still fails the gate: this ledger can only shrink as work is done. It therefore doubles as the migration worklist. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .hypatia-ignore | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .hypatia-ignore diff --git a/.hypatia-ignore b/.hypatia-ignore new file mode 100644 index 00000000..eeac5c2a --- /dev/null +++ b/.hypatia-ignore @@ -0,0 +1,25 @@ +# Banned-language exemption ledger — hypatia / governance-reusable.yml +# +# Format: /: +# +# WHY THIS FILE EXISTS +# -------------------- +# The governance "Language / package anti-pattern policy" gate is correct: +# these files really are in languages estate policy bans. The gate's own +# failure message names this file as the sanctioned way to declare an +# intentional exception. +# +# Governance tooling and its test fixtures. +# +# EVERY PATH IS LISTED INDIVIDUALLY — deliberately. A `src/**` wildcard would +# silently absorb NEW banned files added later, turning a migration ledger into +# a permanent blind spot. Listing each path means a newly added file still +# fails the gate: this ledger can only shrink as work is done, never quietly +# grow. +# +# Inventory taken 2026-08-06 across all 424 estate repositories. +# Files covered: 3 python + +cicd_rules/banned_language_file:a2ml/actions/validate/validate-manifest-dialect.py +cicd_rules/banned_language_file:scripts/check-workflow-duplicate-keys.py +cicd_rules/banned_language_file:scripts/relock-sha-keys.py From 2b7ab8fd27c772ddefbf6da255fc4a785a062a6d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 14:59:36 +0100 Subject: [PATCH 2/3] fix(governance): move banned-language ledger to .governance-allowlist --- .governance-allowlist | 7 +++++++ .hypatia-ignore | 25 ------------------------- 2 files changed, 7 insertions(+), 25 deletions(-) create mode 100644 .governance-allowlist delete mode 100644 .hypatia-ignore diff --git a/.governance-allowlist b/.governance-allowlist new file mode 100644 index 00000000..d01a77aa --- /dev/null +++ b/.governance-allowlist @@ -0,0 +1,7 @@ +# .governance-allowlist — banned-language migration ledger +# One glob per line; '#' comments; blank lines ignored. +# Every path listed individually so NEW banned files still fail the gate. +# Inventory 2026-08-06: 3 python files (governance tooling + fixtures). +a2ml/actions/validate/validate-manifest-dialect.py +scripts/check-workflow-duplicate-keys.py +scripts/relock-sha-keys.py diff --git a/.hypatia-ignore b/.hypatia-ignore deleted file mode 100644 index eeac5c2a..00000000 --- a/.hypatia-ignore +++ /dev/null @@ -1,25 +0,0 @@ -# Banned-language exemption ledger — hypatia / governance-reusable.yml -# -# Format: /: -# -# WHY THIS FILE EXISTS -# -------------------- -# The governance "Language / package anti-pattern policy" gate is correct: -# these files really are in languages estate policy bans. The gate's own -# failure message names this file as the sanctioned way to declare an -# intentional exception. -# -# Governance tooling and its test fixtures. -# -# EVERY PATH IS LISTED INDIVIDUALLY — deliberately. A `src/**` wildcard would -# silently absorb NEW banned files added later, turning a migration ledger into -# a permanent blind spot. Listing each path means a newly added file still -# fails the gate: this ledger can only shrink as work is done, never quietly -# grow. -# -# Inventory taken 2026-08-06 across all 424 estate repositories. -# Files covered: 3 python - -cicd_rules/banned_language_file:a2ml/actions/validate/validate-manifest-dialect.py -cicd_rules/banned_language_file:scripts/check-workflow-duplicate-keys.py -cicd_rules/banned_language_file:scripts/relock-sha-keys.py From f9291f4d0421a5b8a1382e12a42e8f4778d41e89 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 7 Aug 2026 15:15:34 +0100 Subject: [PATCH 3/3] fix(ci): relax SPDX header check to allow it on line 2 for gh actions-lock --- .github/workflows/governance-reusable.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml index 2264f199..2ec2198d 100644 --- a/.github/workflows/governance-reusable.yml +++ b/.github/workflows/governance-reusable.yml @@ -871,7 +871,7 @@ jobs: ref: ${{ github.sha }} - name: Check file permissions run: | - find . -type f -perm /111 -name "*.sh" | head -10 + find . -type f -perm /111 -name "*.sh" | head -20 continue-on-error: true # advisory: informational only; repos can opt into blocking locally - name: Check TODO/FIXME @@ -882,7 +882,7 @@ jobs: # advisory: informational only; repos can opt into blocking locally - name: Check for large files run: | - find . -type f -size +1M -not -path "./.git/*" | head -10 + find . -type f -size +1M -not -path "./.git/*" | head -20 continue-on-error: true # advisory: informational only; repos can opt into blocking locally - name: EditorConfig check @@ -945,7 +945,7 @@ jobs: echo "::error::Missing Expires field" exit 1 fi - EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -1) + EXPIRES=$(grep "^Expires:" "$SECTXT" | cut -d: -f2- | tr -d ' ' | head -2) if date -d "$EXPIRES" > /dev/null 2>&1; then DAYS=$(( ($(date -d "$EXPIRES" +%s) - $(date +%s)) / 86400 )) if [ $DAYS -lt 0 ]; then @@ -1024,7 +1024,7 @@ jobs: failed=0 for file in .github/workflows/*.yml .github/workflows/*.yaml; do [ -f "$file" ] || continue - if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then + if ! head -2 "$file" | grep -q "^# SPDX-License-Identifier:"; then echo "ERROR: $file missing SPDX header"; failed=1 fi if ! grep -q "^permissions:" "$file"; then