feat(ci-health): estate failure-class detector + auto-remediator (A/B/D) by hyperpolymath · Pull Request #461 · hyperpolymath/hypatia

hyperpolymath · 2026-06-13T14:04:21Z

What

A scheduled estate sweep that detects + auto-remediates the infrastructure CI failure classes diagnosed 2026-06-13 (tma-mark2#52). These were never workflow-logic bugs — they were account billing + repo Actions settings, which is why prior per-workflow fixes had zero effect.

Class	Signature	Action
`A-BILLING`	job annotation "payments have failed / spending limit"	report (owner-only)
`B-ALLOWLIST`	`selected` + no `hyperpolymath/*` → reusables/non-verified actions `startup_failure`	auto-fix (allow-list PUT)
`B-STARTUPFAIL`	observed `startup_failure` runs	report (web-UI names the blocked action; API hides it)
`D-BURN`	bare `on: [push, pull_request]` (2× runs/PR)	auto-fix (signed PR)

Files

scripts/ci-health/{detect,remediate,sweep}.sh, action-superset.txt, README.adoc
.github/workflows/ci-health-sweep.yml — daily 03:47 UTC; manual dispatch defaults to dry-run.

Guardrails

Own repos only (skips forks/archived), CI_HEALTH_DENYLIST (e.g. 007), idempotent, MAX_BURN_PRS cap, API-driven (never local dir names — some clones' origin ≠ dir name). Keeps sha_pinning_required.

Requires

secrets.HYPATIA_DISPATCH_PAT (classic repo + workflow scope) — reused from the existing remediation pipeline. Off-switch: disable the workflow or set the scheduled run to dry-run.

Validated: bash -n clean, YAML valid, live detect.sh + dry-run remediate.sh confirmed (denylist holds even with dry_run=false).

🤖 Generated with Claude Code

github-actions · 2026-06-13T14:05:19Z

🔍 Hypatia Security Scan

Findings: 54 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	54

View findings

[
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Encodes the 2026-06-13 diagnosis (tma-mark2#52): the chronic estate CI redness was infrastructure, not workflow logic — which is why per-workflow surface fixes had zero effect. Adds a scheduled sweep that detects + auto-remediates: A-BILLING account spending-limit/payment wall -> REPORT (owner-only) B-ALLOWLIST allowed_actions=selected + no hyperpolymath/* -> AUTO-FIX (allow-list PUT) B-STARTUPFAIL observed startup_failure runs -> REPORT (web-UI names the action) D-BURN bare [push, pull_request] double-trigger -> AUTO-FIX (signed PR) - scripts/ci-health/{detect,remediate,sweep}.sh + action-superset.txt + README.adoc - .github/workflows/ci-health-sweep.yml (daily 03:47 UTC; manual dispatch = dry-run) Guardrails: own repos only (skip fork/archived), CI_HEALTH_DENYLIST (007), idempotent, MAX_BURN_PRS cap, API-driven (not local dir names). Reuses HYPATIA_DISPATCH_PAT. Complements hypatia-remediation-sweep.yml. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-06-13T14:09:38Z

🔍 Hypatia Security Scan

Findings: 54 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	54

View findings

[
  {
    "reason": "Issue in governance.yml",
    "type": "missing_timeout_minutes",
    "file": "governance.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in hypatia-scan.yml",
    "type": "missing_timeout_minutes",
    "file": "hypatia-scan.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in mirror.yml",
    "type": "missing_timeout_minutes",
    "file": "mirror.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in secret-scanner.yml",
    "type": "missing_timeout_minutes",
    "file": "secret-scanner.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-06-13T14:26:31Z

🔍 Hypatia Security Scan

Findings: 44 issues detected

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	44

View findings

[
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Repository has 5 non-main remote branch(es). Policy: single main branch only.",
    "type": "GS007",
    "file": ".",
    "action": "delete_remote_branches",
    "rule_module": "git_state",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "src/ui/gossamer/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/ci-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "scripts/bench-tools/Cargo.toml",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "ffi/zig/README.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "docs/reports/audit/audit-2026-04-15-post.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/github-registry.adoc",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  },
  {
    "reason": "Code scanning (Hypatia): hypatia/structural_drift/SD022 -- Hypatia structural_drift: SD022 -- 10 day(s) old",
    "type": "CSA001",
    "file": "docs/integration/a2ml-k9.md",
    "action": "review",
    "rule_module": "code_scanning_alerts",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath force-pushed the ci/ci-health-sweep branch from db916d7 to acde563 Compare June 13, 2026 14:08

Merge branch 'main' into ci/ci-health-sweep

a69bf70

hyperpolymath merged commit d7b1ca7 into main Jun 13, 2026
39 checks passed

hyperpolymath deleted the ci/ci-health-sweep branch June 13, 2026 14:30

hyperpolymath mentioned this pull request Jun 13, 2026

🟠 Estate CI-health backlog: public repos with independently-red CI #464

Open

50 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(ci-health): estate failure-class detector + auto-remediator (A/B/D)#461

feat(ci-health): estate failure-class detector + auto-remediator (A/B/D)#461
hyperpolymath merged 2 commits into
mainfrom
ci/ci-health-sweep

hyperpolymath commented Jun 13, 2026

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

github-actions Bot commented Jun 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Jun 13, 2026

What

Files

Guardrails

Requires

Uh oh!

github-actions Bot commented Jun 13, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 13, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 13, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant