feat(rsr): standards RSR compliance pass — Bronze (58% → 86%) by hyperpolymath · Pull Request #390 · hyperpolymath/standards

hyperpolymath · 2026-06-18T11:12:20Z

Summary

The standards RSR compliance pass — continuation of the standards end-to-end (the Idris ABI fix landed separately in #389). Takes the standards self-audit from 58.46% → 85.92% (🥉 BRONZE).

1. Real gaps (additive) — `feat(rsr)`

.well-known/security.txt (RFC 9116: Contact/Expires/Preferred-Languages → GitHub Security Advisory + SECURITY.md)
.well-known/ai.txt (AI usage/training policy; summary of the estate bot-exclusion registry + 0-ai-gatekeeper-protocol)
.well-known/humans.txt (humanstxt.org attribution)
Justfile validate recipe (registry-check hard-dep + RSR self-audit)

2. Audit-script de-brittle — `fix(rsr-audit)`

rsr-audit.sh was mis-calibrated for this GitHub/.adoc estate, failing repos on deliberate, policy-correct choices. De-brittled format/case only in the two core helpers + the CI check — licence content checks untouched:

credit .adoc docs (estate docs policy mandates AsciiDoc), Justfile case, bare LICENSE
accept GitHub Actions (.github/workflows/*.y*ml) as first-class (not just GitLab CI / a hardcoded ci.yml) — the estate runs on GitHub; the RSR satellite CLAUDE.md itself notes the old GitLab guidance is superseded.

Improves scoring for all 10 estate repos, not just standards.

🔒 Flagged for owner (NOT changed — licence guardrail)

rsr-audit.sh hardcodes MIT AND Palimpsest as the required LICENSE content (≈ lines 194/424/430), which contradicts the estate's MPL-2.0-for-sole-owner policy. Updating what licence the standard mandates is an owner decision — left as-is.

Residual (honest)

3 checks still fail, all content-pattern brittleness for content the estate phrases differently: SECURITY "24 hours" literal (standards has a Response Timeline section), the exact TPCF perimeter strings, and "fork workflow" (standards uses the TPCF perimeter model, not a fork workflow). BRONZE (≥75%) is achieved; these can be de-brittled in a follow-up.

🤖 Generated with Claude Code

https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

Generated by Claude Code

Editing rhodium-standard-repositories/rsr-audit.sh changed that spec home's content-addressed source_hash; regenerated REGISTRY.a2ml via the sanctioned generator (bash scripts/build-registry.sh) to clear the "Registry + topology in sync" drift on PR #390. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

github-actions · 2026-06-18T11:14:39Z

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

Editing rhodium-standard-repositories/rsr-audit.sh changed that spec home's content-addressed source_hash; regenerated REGISTRY.a2ml via the sanctioned generator (bash scripts/build-registry.sh) to clear the "Registry + topology in sync" drift on PR #390. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

github-actions · 2026-06-18T11:48:25Z

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-06-18T11:52:37Z

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

The merge of main into the PR branch changed a spec-home content hash; regenerated REGISTRY.a2ml via the sanctioned generator to clear the "Registry + topology in sync" check on #390. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019awZjBD1qx61tvmEuEKNpn

github-actions · 2026-06-18T11:55:58Z

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-06-18T13:49:13Z

🔍 Hypatia Security Scan

Findings: 148 issues detected

Severity	Count
🔴 Critical	60
🟠 High	75
🟡 Medium	13

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in scorecard.yml",
    "type": "missing_workflow",
    "file": "scorecard.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": ".github/workflows/scorecard.yml",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/scripts/check-ts-allowlist.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (5 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/avow-protocol/public/demo.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "innerHTML assignment -- XSS risk, use textContent or SafeDOM (1 occurrences, CWE-79)",
    "type": "js_innerhtml",
    "file": "/home/runner/work/standards/standards/axel-protocol/src/Tea.res.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "HTTP URL in Nickel config -- must use HTTPS (1 occurrences, CWE-319)",
    "type": "ncl_http_url",
    "file": "/home/runner/work/standards/standards/k9-svc/register.ncl",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath force-pushed the claude/hopeful-babbage-pn0l4o branch from a377b29 to 29cf386 Compare June 18, 2026 11:47

hyperpolymath marked this pull request as ready for review June 18, 2026 11:47

hyperpolymath enabled auto-merge (squash) June 18, 2026 11:47

hyperpolymath disabled auto-merge June 18, 2026 11:48

hyperpolymath enabled auto-merge (squash) June 18, 2026 11:49

hyperpolymath disabled auto-merge June 18, 2026 11:51

hyperpolymath enabled auto-merge (squash) June 18, 2026 11:51

hyperpolymath disabled auto-merge June 18, 2026 12:07

hyperpolymath enabled auto-merge (squash) June 18, 2026 13:16

hyperpolymath disabled auto-merge June 18, 2026 13:19

hyperpolymath enabled auto-merge (squash) June 18, 2026 13:34

hyperpolymath disabled auto-merge June 18, 2026 13:34

feat(rsr): standards RSR compliance pass

388f3fe

hyperpolymath force-pushed the claude/hopeful-babbage-pn0l4o branch from fad601b to 388f3fe Compare June 18, 2026 13:47

hyperpolymath merged commit f290d4a into main Jun 18, 2026
22 checks passed

hyperpolymath deleted the claude/hopeful-babbage-pn0l4o branch June 18, 2026 13:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(rsr): standards RSR compliance pass — Bronze (58% → 86%)#390

feat(rsr): standards RSR compliance pass — Bronze (58% → 86%)#390
hyperpolymath merged 1 commit into
mainfrom
claude/hopeful-babbage-pn0l4o

hyperpolymath commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

github-actions Bot commented Jun 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Jun 18, 2026

Summary

1. Real gaps (additive) — feat(rsr)

2. Audit-script de-brittle — fix(rsr-audit)

🔒 Flagged for owner (NOT changed — licence guardrail)

Residual (honest)

Uh oh!

github-actions Bot commented Jun 18, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 18, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 18, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 18, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jun 18, 2026

🔍 Hypatia Security Scan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

1. Real gaps (additive) — `feat(rsr)`

2. Audit-script de-brittle — `fix(rsr-audit)`