feat(protocols): proven-epistemic disclosure core (#95) + estate standardization stack by hyperpolymath · Pull Request #21 · hyperpolymath/proven-servers

hyperpolymath · 2026-06-11T21:36:07Z

What

Two workstreams that accumulated on this branch:

proven-epistemic — protocol skeleton #95

A provably non-amplifying tiered-disclosure core (the formal reference for flat-mate's conceal lattice):

Epistemic.Lattice: Tier chain (Band < Relational < Full), meet, and machine-checked laws — meetSym (reciprocity), meetLowerLeft/Right (never above either party's grant), meetGreatest, bandAbsorbs (deny-by-default absorbs), decidable ordering
Epistemic.Transitions: session FSM with impossibility proofs (terminal Closed, no skipped consent); Disclosable witnesses make over-tier disclosure unrepresentable; WellGoverned (Sensitive ⇒ Full) with sensitiveNeverAtBand/Relational
Idris2 0.8.0, %default total, zero believe_me/assert_total; typechecks clean (idris2 --typecheck exit 0)
ADR-0002 documents the Denning→Fagin lineage and the scope boundary vs differential privacy / SMPC / FHE
README catalog: 108→109 components, 94→95 skeletons

Estate standardization (pre-existing on branch)

Governance docs, contractiles, CI/CD cleanup, TruffleHog secret-scan standardization — the sweep commits that preceded this work.

Verification

idris2 --typecheck proven-epistemic.ipkg → exit 0 (note: --build blocked locally by a missing chez/support.ss in the asdf install — toolchain, not code)
banned-pattern grep clean

🤖 Generated with Claude Code

The pin `goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608` at .github/workflows/e2e.yml:42 is fabricated (`gh api repos/goto-bus-stop/ setup-zig/commits/7ab2955... -> 422`). The fake SHA's first 16 hex chars collide with v2.2.0's real SHA `7ab2955...2802d` but the rest is fabricated — a partial collision that would have escaped visual review. Replaced with verified v2.2.1 pin `abea47f85e598557f500fa1fd2ab7464fcb39406`. Provenance: propagated from rsr-template-repo#81 (merged); discovered while wiring CI for snifs (hyperpolymath/snifs#30); 3 of 3 fan-out PRs alongside odds-and-sods-package-manager#39 and proven#93.

- C001: CodeQL language fixes - C002: License identifier standardization - C003: Outdated actions audit - C004: Pin standards refs to SHA 861b5e9 - C005: Add workflow-level permissions

…eanup

…d disclosure (skeleton #95) Epistemic disclosure core: Tier lattice (Band < Relational < Full) with machine-checked laws (meetSym reciprocity, meetLowerLeft/Right never-above- either-grant, meetGreatest, bandAbsorbs), session FSM with impossibility proofs, Disclosable witnesses making over-tier disclosure unrepresentable, WellGoverned (Sensitive => Full). Idris2 0.8.0, %default total, zero escape hatches; typechecks clean. Lineage documented (Denning 1976 -> Fagin et al.); scope boundary vs DP/SMPC/FHE in ADR-0002. First consumer: flat-mate's conceal lattice mirrors this core. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

- instant-sync.yml: a step fragment (K9-SVC Validation) was appended at the jobs level, outside any job — folded into the dispatch job's steps - dogfood-gate.yml: the embedded python3 -c script sat at column 1 inside a run literal block, terminating the block — uniformly indented so the YAML strip restores it to column 0 (embedded python verified to parse) These caused every push-triggered run on this branch to die in 0s (startup_failure) and suppressed all PR checks on #21. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

instant-sync.yml, boj-build.yml, dogfood-gate.yml show name==path in the Actions registry (malformed-at-creation cache; every run 0s startup_failure regardless of content). Rename forces fresh registration — estate precedent paint-type#38. Content unchanged (YAML repairs landed in previous commit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…-zig-sha # Conflicts: # .github/workflows/codeql.yml # .github/workflows/e2e.yml

github-actions · 2026-06-11T21:59:19Z

🔍 Hypatia Security Scan

Findings: 280 issues detected

Severity	Count
🔴 Critical	213
🟠 High	17
🟡 Medium	50

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync-dispatch.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync-dispatch.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/ldap.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/caldav.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/authserver.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/nfs.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/pqc.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/media.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

These gates never executed before this branch (registry-stuck + invalid YAML), so their first runs exposed pre-existing debt: - container/deploy.k9.ncl: add the K9! magic line (matching the passing templates); expose a validator-visible pedigree identity block {name, version, leash}; fix pre-existing infinite recursion (deployment/scripts let-bindings shadowed by same-name record fields — the file had never been evaluable). Verified: nickel export now evaluates; pedigree.name/version/leash resolve. - dogfood-checks.yml: extend a2ml-validate paths-ignore (defaults reproduced) with audits/assail-classifications.a2ml — panic-attack's S-expression ledger, not a TOML-style manifest (hypatia#243 rule). - e2e.yml: Zig 0.15.0 does not exist in the download index; pin 0.15.1 (the toolchain the FFI was authored against). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

github-actions · 2026-06-11T22:12:07Z

🔍 Hypatia Security Scan

Findings: 280 issues detected

Severity	Count
🔴 Critical	213
🟠 High	17
🟡 Medium	50

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in release.yml",
    "type": "missing_timeout_minutes",
    "file": "release.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync-dispatch.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync-dispatch.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "codeql_missing_actions_language",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/ldap.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/caldav.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/authserver.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/nfs.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/pqc.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/proven-servers/proven-servers/bindings/python/proven_servers/media.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath · 2026-06-11T22:14:05Z

CI triage (close-out pass, 2026-06-11)

Gates resurrected by this PR (registry-stuck + invalid YAML — they had never executed):

Gate	First-run result	Resolution
Validate A2ML manifests	❌ 1 error	✅ fixed — `audits/assail-classifications.a2ml` is panic-attack's S-expression ledger, not a TOML manifest → added to `paths-ignore` (defaults reproduced; hypatia#243 rule)
Validate K9 contracts	❌ 2 errors	✅ fixed — `container/deploy.k9.ncl` gained the `K9!` magic, a validator-visible pedigree identity block, a literal `'Hunt` leash, and a fix for pre-existing infinite recursion (`scripts = scripts` self-reference; the file had never been evaluable — `nickel export` now succeeds)
E2E FFI round-trip	❌ Install Zig	✅ fixed — workflow pinned Zig 0.15.0which does not exist in the download index; now 0.15.1 (the toolchain the FFI was authored against)

Hypatia code-scanning (red, left red deliberately): 102 errors / 18 warnings are pre-existing branch-wide debt attributed to this PR because the diff exceeded scoping ("code changes were too large"). Sample: unsafe_block warnings across every Rust FFI binding, unwrap_without_check in benches, and CSA003 debt-aging meta-alerts (e.g. "scorecard_publish_with_run_step at scorecard-enforcer.yml is 11 days old — overdue"), which reference the known-parked scorecard startup_failure issue. Per the estate's Hypatia deference policy these route to the hypatia→gitbot remediation pipeline, not this PR. Nothing in the proven-epistemic Idris code is flagged.

🤖 Generated with Claude Code

hyperpolymath and others added 13 commits May 30, 2026 14:41

ci: fix CI/CD configuration (campaigns C001-C005)

ce06014

- C001: CodeQL language fixes - C002: License identifier standardization - C003: Outdated actions audit - C004: Pin standards refs to SHA 861b5e9 - C005: Add workflow-level permissions

docs: add OpenSSF Best Practices registration badge

bfe61ed

chore: rename k9 directories to self-validating for clarity

ed83358

chore: flatten self-validating directory structure

15c4d71

chore: rename agent_instructions to bot_directives for spec alignment

a3a787f

docs: Add CODEOWNERS, MAINTAINERS, and GOVERNANCE documents

74f63d3

Apply estate standardization: governance docs, contractiles, CI/CD cl…

eeb18c1

…eanup

security: standardize secret scanning on TruffleHog

b7f24b2

Merge remote-tracking branch 'origin/main' into claude/fix-fake-setup…

a92ac05

…-zig-sha # Conflicts: # .github/workflows/codeql.yml # .github/workflows/e2e.yml

hyperpolymath enabled auto-merge (rebase) June 11, 2026 22:09

hyperpolymath disabled auto-merge June 11, 2026 22:11

hyperpolymath merged commit 5a09203 into main Jun 11, 2026
12 of 15 checks passed

hyperpolymath deleted the claude/fix-fake-setup-zig-sha branch June 11, 2026 22:12

hyperpolymath mentioned this pull request Jun 11, 2026

FFI test segfaults (signal 11): proven-amqp channel_open, proven-diode create — under Zig 0.15.1 #22

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(protocols): proven-epistemic disclosure core (#95) + estate standardization stack#21

feat(protocols): proven-epistemic disclosure core (#95) + estate standardization stack#21
hyperpolymath merged 14 commits into
mainfrom
claude/fix-fake-setup-zig-sha

hyperpolymath commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jun 11, 2026

Uh oh!

hyperpolymath commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

hyperpolymath commented Jun 11, 2026

What

proven-epistemic — protocol skeleton #95

Estate standardization (pre-existing on branch)

Verification

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

github-actions Bot commented Jun 11, 2026

🔍 Hypatia Security Scan

Uh oh!

hyperpolymath commented Jun 11, 2026

CI triage (close-out pass, 2026-06-11)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants