fix: restore guix.scm identity and licence (squisher-corpus clobber is live on main) - #143
Merged
Merged
Conversation
…is live on main
`guix.scm` on main currently declares this repository as **squisher-corpus**
under **PMPL-1.0-or-later**. It is neither. This repo is maa-framework, MPL-2.0.
- (name "squisher-corpus") + (name "maa-framework")
- (synopsis "squisher-corpus") + (synopsis "maa-framework")
- (home-page ".../squisher-corpus") + (home-page ".../maa-framework")
- "PMPL-1.0-or-later" + "MPL-2.0"
Restored verbatim from 7b6a293, the last commit where it was correct.
How it got here: an automated sweep on 2026-07-26 ~16:00 BST copied
`hyper-repos/squisher-corpus/guix.scm` byte-for-byte into a large number of
estate repos instead of generating one per repo — the sweep's own commit
message, `chore: update guix.scm from squisher-corpus`, names the bug. In this
repo it landed as local commit f06ea94, which was dropped from local main on
2026-07-27 because origin/main was still clean at 7b6a293.
It reached origin/main anyway, via #142 (`fix(ci): repoint codeql-action at a
SHA that exists`) — a CI fix that swept up an unrelated dirty working-tree file.
Two harms, and the second is the serious one:
1. identity — the package advertises the wrong name and home-page
2. **licence** — MPL-2.0 was replaced with PMPL-1.0-or-later on a public
default branch
Note that absolute-zero/.claude/CLAUDE.md lists PMPL-1.0 / PMPL-1.0-or-later as
BANNED ("License: MPL-2.0 only"), so this is a policy violation as well as a
factual error.
Scope check: `.editorconfig` and `aletheia/.editorconfig` on main are clean, so
`guix.scm` is the only file affected in this repository.
This is one instance of an estate-wide incident — a scan of 279 repos against
their ORIGIN refs finds 65 clobbered `guix.scm` files across 52 repositories,
including `standards`. Tracked separately; this commit fixes only this repo.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
Note Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime. Code Review ✅ Approved 1 resolved / 1 findingsRestores the correct package name, homepage, and MPL-2.0 license to guix.scm after an automated sweep clobbered it. Consider updating the license URI which still points to the palimpsest license record.
✅ 1 resolved✅ Quality: License URI still points to palimpsest-license under MPL-2.0
OptionsDisplay: compact → Showing less information. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Gitar |
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
|
|
hyperpolymath
added a commit
that referenced
this pull request
Jul 28, 2026
…ch the code (#144) Three independent commits, each droppable on its own. Two fix gates that could never fail; one fixes documentation that actively misdirects. --- ## 1. `docs:` — two files misstate the code they describe ### `PROOF-NEEDS.md` Claimed *"1 `Admitted` in `proofs/coq/lambda/LambdaCNO.v` (y_not_cno)"*. Measured against `absolute-zero 87902bb7`: ``` $ grep -rn "Admitted" absolute-zero --include=*.v | wc -l 0 $ grep -rn "^Axiom" absolute-zero --include=*.v | wc -l 23 ``` **Zero `Admitted`. Twenty-three `Axiom`s across 6 files.** The old wording was wrong in *both* directions — it overstated the incompleteness and understated the trusted base 23×. > **Why this matters operationally:** an `Axiom` **passes** a "no `sorry` / no `Admitted`" gate silently. Counting only `Admitted` measures the wrong thing. `y_not_cno` is a **KEPT AXIOM** with a written rationale (`LambdaCNO.v:388-399`), not an unproven hole — and it is *not* the "concrete, closable proof obligation" the old text claimed. The in-source note explains it needs an invariant closed under the full reduction congruence, or a coinductive/step-indexed argument. The doc now defers to the **AXIOM AUDIT** already in `physics/LandauerDerivation.v`, which is notably self-critical — it records that `cno_zero_energy_dissipation_derived` is an axiom *despite its `_derived` name*, and that the triage docs' "DISCHARGE" marks are inaccurate. **Promoted to the top of "What Needs Proving"** — the audit's own SOUNDNESS WARNINGS: `prob_nonneg` and `prob_normalized` are false over unconstrained function-type distributions, and `shannon_entropy_maximum`'s inequality is **backwards** (asserts uniform *minimises* entropy). All three are currently **unused** — cheap now, expensive later. ### `aletheia/CLAUDE.md` Said *"all core logic lives in `src/main.rs` (~950 lines)"* and *"don't split into modules unless >1000 lines"*. It has been **5 modules / 995 lines** for a while, `main.rs` at 121. That instruction would tell the next agent to **undo the existing structure**. Also corrected: 23 workflows → 16; `flake.nix` listed but absent; 18 integration tests → 32. Added a prominent warning that those 16 nested workflows have **never run** (root-only discovery) — the fault that let this crate stay uncompilable for a month. --- ## 2. `fix(aletheia):` — the SHA-pinning check could never fail ```rust if line.contains("@v") && !line.contains("@") { ``` `contains("@v")` **implies** `contains("@")`, so the second clause is always false and `has_unpinned` could never be set. Proven before changing anything: ``` uses: actions/checkout@v4 old_detects_unpinned=false ``` This is aletheia's Silver-level *"GitHub Actions SHA pinning"* check — and pointedly, the exact check that would have caught `SonarSource/sonarqube-scan-action@master`, the unpinned action that broke this repo's Governance and CodeQL in #139. Replaced with `uses_line_is_pinned`, requiring 40 hex chars after the final `@`, which also: - accepts the inline `- uses:` form (the estate's existing linter anchors to line-start and misses it) - ignores a trailing `# v7.0.1` provenance comment, so a correct pin with a stale comment isn't a false positive - exempts `./…` local actions/reusables and `docker://` refs Also replaced `assert!(true)` in `test_file_exists` with a real assertion, anchored on `env!("CARGO_MANIFEST_DIR")` so it is deterministic regardless of CWD. **Verified:** 29 unit tests (was 26) · `cargo fmt --check` clean · clippy 25 → 23. End-to-end `cargo run -- .` now reports `[FAIL] GitHub Actions SHA pinning`, correctly finding the one genuinely unpinned action — where before the fix it reported a pass. Refs #125. --- ## 3. `fix(#99):` — root `Justfile` was a fake gate ```make build: @echo "Build not configured yet" ``` `build`, `test`, `fmt`, `lint`, `clean` all printed a string and **exited 0**. Wired to the same commands root `rust-ci.yml` runs, in the same order, so `just check` means what CI means. Two deliberate limits, documented **in the recipes** so nobody "fixes" them: - `test` is `--bins` only — the integration suite is a spec for a CLI that doesn't exist; 27/29 fail by design (#124). Adding `--tests` would make the bar green by breaking it. - `lint` is not yet `-D warnings` (#125). When that closes it must be added **here and to `rust-ci.yml` together**, so local and CI never disagree. **Verified by running them, not reading them:** `just deps-check` → `OK: zero dependencies`; `just test` → 29 passed; `just check` → exit 0. **And verified the gate can actually fail** — appending badly-formatted Rust makes `just fmt` exit 1 while `just build` still exits 0; reverting restores 0. A gate nobody has watched fail is not a gate. Closes #99. --- ## Not in this PR - **#124** — still blocked on the source-of-truth question for RSR checks - **`guix.scm`** identity/licence clobber — separate, more urgent: #143 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
hyperpolymath
added a commit
that referenced
this pull request
Jul 29, 2026
…ut (#145) ## The last red check on `main` `.claude/worktrees/maa-ci-repair` is committed on `main` as a **gitlink** (mode `160000`, pointing at `0392152`) with **no matching entry in `.gitmodules`**. Git treats that as an unmapped submodule and refuses: ``` ##[error]fatal: No url found for submodule path '.claude/worktrees/maa-ci-repair' in .gitmodules ##[error]The process '/usr/bin/git' failed with exit code 128 ``` That is the **OSSF Scorecard** failure on `main`. It dies during checkout, **before running a single scorecard probe** — so the red tick says nothing about this repo's actual security posture. It also breaks any `git clone --recurse-submodules` and any `actions/checkout` with `submodules: true`. ## Where it came from A Claude Code worktree is local scratch and must never be tracked. It was committed by accident in **#142** (`fix(ci): repoint codeql-action at a SHA that exists`) — the same `commit -a`-on-a-dirty-tree that carried the `squisher-corpus` `guix.scm` clobber onto `main` (fixed separately in #143). One careless `-a`, two unrelated defects. ## Why this shape matters **This repo has been bitten by exactly this before.** Commit `639f389` (2026-02-21) left `aletheia` as a gitlink with no `.gitmodules` entry. A gitlink *without* its mapping resolves to a silently-empty directory — git's quietest failure mode — and that one went unnoticed for over a month until the pointer was swept away and 361 files were vendored in its place. ## Fix - `git rm --cached .claude/worktrees/maa-ci-repair` — index only, contents untouched on disk - add `.claude/worktrees/` to `.gitignore` so it cannot recur ## Verification ``` $ git submodule status 87902bb770e767c10e065d9ac75d111e80a01be1 absolute-zero (heads/main) # exit 0 $ git check-ignore -v .claude/worktrees/maa-ci-repair .gitignore:136:.claude/worktrees/ .claude/worktrees/maa-ci-repair ``` Only `absolute-zero` remains, which is the one genuine submodule and is correctly mapped. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Urgent: a licence misstatement is currently live on the public default branch
guix.scmonmaindeclares this repository assquisher-corpusunderPMPL-1.0-or-later. It is neither — this ismaa-framework, MPL-2.0.Restored verbatim from
7b6a293, the last commit where it was correct. One file, six lines.How it got here
An automated sweep on 2026-07-26 ~16:00 BST copied
hyper-repos/squisher-corpus/guix.scmbyte-for-byte into a large number of estate repos rather than generating one per repo. The sweep's own commit message names the bug:chore: update guix.scm from squisher-corpus.In this repo it first appeared as local commit
f06ea94, which was dropped on 2026-07-27 —origin/mainwas still clean at7b6a293at that point.It reached
origin/mainanyway, via #142 (fix(ci): repoint codeql-action at a SHA that exists), a CI fix that swept up an unrelated dirty working-tree file. This is thecommit -aon a dirty tree hazard.Why this matters beyond cosmetics
PMPL-1.0-or-lateron a public default branch.absolute-zero/.claude/CLAUDE.mdlistsPMPL-1.0/PMPL-1.0-or-lateras BANNED ("License: MPL-2.0 only"), so this is a policy violation as well as a factual error.Scope check
.editorconfigandaletheia/.editorconfigonmainare clean —guix.scmis the only affected file in this repository.Wider context (not fixed here)
A scan of 279 repos against their ORIGIN refs finds 65 clobbered
guix.scmfiles across 52 repositories, includingstandards. An earlier scan against local working trees reported only 9 — it undercounted roughly 6× because repos whose local checkout lags origin were invisible to it. Tracked separately; this PR fixes only this repository.🤖 Generated with Claude Code