Issues · hyperpolymath/standards

Estate: needs me

hyperpolymath/standards#1109 · opened

on Oct 1, 2026

Secret-Scan-Floor (D243/D244): sweep results and open items with acceptance criteria

hyperpolymath/standards#1108 · opened

on Oct 1, 2026

1

Provisioning canon: four gaps found by the 8-repo pilot (doctor provenance, toolchain floors, per-user artefacts, offline mint)

hyperpolymath/standards#1107 · opened

on Oct 1, 2026

Fork-PR security gate has never started: the pull_request_target event is refused by Actions policy (30/30 startup_failure)

hyperpolymath/standards#1102 · opened

on Sep 30, 2026

Carve-outs via subtree split strip every commit signature (lol, #680) — procedure must choose squash-import or a ruled exception

hyperpolymath/standards#1101 · opened

on Sep 30, 2026

codeql-action: ~53 repos startup-dead from 4.38.2 bumps without the lock record; 4.38.1 was never broken

hyperpolymath/standards#1093 · opened

on Sep 30, 2026

D217/D215b: convert unsigned commit producers, then enforce signatures on 61 repos

hyperpolymath/standards#1091 · opened

on Sep 30, 2026

1

OWASP gate gap: method policy, ASVS probe and SSRF rule are declared but not gated

hyperpolymath/standards#1089 · opened

on Sep 30, 2026

Launcher census: 20 launchers still put their PID file under ${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}} (CWE-377)

hyperpolymath/standards#1086 · opened

on Sep 30, 2026

1

k9-coordination: actor grants — fence (WHERE) × leash (WHAT), deny-by-default for agent/bot commits, compiled to bypass lists, bot configs and a PreToolUse hook (D213/D214)

hyperpolymath/standards#1085 · opened

on Sep 30, 2026

SonarCloud never reports on standards PRs; removed from ruleset 23787415 until it does

hyperpolymath/standards#1082 · opened

on Sep 30, 2026

2

Ruleset 23787415 requires 'SonarCloud Code Analysis', which no PR ever receives (SonarCloud parked, #443)

hyperpolymath/standards#1081 · opened

on Sep 30, 2026

Debtfile gate-scripts-without-tests probe cannot see actions-policy-486-test.sh (over-counts by up to 3)

hyperpolymath/standards#1080 · opened

on Sep 30, 2026

check-uuid-v7: only the LAST UUID on a line is checked (<v4> <v7> passes)

hyperpolymath/standards#1079 · opened

on Sep 30, 2026

Umbrella: machine-readable currency deferred follow-ups — one estate-common list for 4 repos

hyperpolymath/standards#1071 · opened

on Sep 30, 2026

Umbrella: 14 per-repo triages of pre-existing red checks surfaced by the actions.lock cure

hyperpolymath/standards#1070 · opened

on Sep 30, 2026

cargo-audit producer opens vulnerability trackers but never closes them (umbrella for 9 live trackers)

hyperpolymath/standards#1069 · opened

on Sep 30, 2026

yq -i is not idempotent: a second run moves a comment block (tag-ruleset-canon.yml)

hyperpolymath/standards#1068 · opened

on Sep 30, 2026

LANGUAGE-POLICY.adoc says Idris2-only; spec.scm/language-policy.scm still sanctions Agda

hyperpolymath/standards#1066 · opened

on Sep 30, 2026

1

apply-branch-gates: a path-filtered pull_request trigger is reported PR-reachable (#1040 residual)

hyperpolymath/standards#1065 · opened

on Sep 30, 2026

decide the attestation/orchestration chain: canon → .deed → .k9 → Nickel → environment → serialization, with derivation (never restatement) as the invariant

hyperpolymath/standards#1059 · opened

on Sep 28, 2026

1

grammar artifacts: .k9 has no grammar or contract at all, and deed.abnf states both “sole normative” and “pending owner ruling”

hyperpolymath/standards#1058 · opened

on Sep 28, 2026

1

slavia #100 closure: class determinations for #994, startup-death mechanics + Dependabot recurrence for #968 (comment-perms cross-file)

hyperpolymath/standards#1056 · opened

on Sep 28, 2026

Orphan refs: automated agents leave unrelated-history branches that no gate can see (8 arena/* refs estate-wide; #1005's AC2 population has drifted again)

hyperpolymath/standards#1055 · opened

on Sep 28, 2026

Estate listing: 35 repositories are below the RSR 7-topic minimum

hyperpolymath/standards#1049 · opened

on Sep 26, 2026