Skip to content

fix(001): gate the cargo jobs on a spine output and purge the hqgit residue - #3

Merged
bartekus merged 1 commit into
mainfrom
001-harness-hqgit-lessons
Sep 6, 2026
Merged

fix(001): gate the cargo jobs on a spine output and purge the hqgit residue#3
bartekus merged 1 commit into
mainfrom
001-harness-hqgit-lessons

Conversation

@bartekus

@bartekus bartekus commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Every govern.yml run on this repository failed at startup: hashFiles is not allowed in a job-level if, and GitHub reports that as a workflow file issue with no checks. The spine job now probes the tree after checkout and publishes has_cargo and has_deny; the cargo and deny jobs gate on those. Recorded as spec 001 D-3, learned from rahi's D-4 and hqgit's D-3.
  • Bumped actions/checkout and actions/upload-artifact to v7, which supersedes the two open dependabot PRs.
  • Dropped the dependabot npm entry for /web, which spec 001 D-1 rules out and which failed on every scheduled run.
  • Replaced the hqgit vocabulary the harness copy carried in the skills and agents (ledger-guardian, trust-reviewer, L0/L1, golden vectors, fuzz/, executor/, web/, REAPI, fact kinds, predicates) with the memory invariants, this product's crates, and its seams.
  • Regenerated the .derived shards for spec 001.

Testing

  • make spine and make ci green locally; couple checked 17 paths with no drift.
  • actionlint .github/workflows/govern.yml passes.
  • This PR is the first run of govern.yml that can get past workflow parsing, so its checks are themselves the test.

…esidue

Every govern.yml run on this repository failed at startup because
`hashFiles` is not allowed in a job-level `if`; GitHub reported it as a
workflow file issue with no checks. The spine job now probes the tree
after checkout and publishes has_cargo and has_deny, and the cargo and
deny jobs gate on those (spec 001 D-3, learned from rahi's D-4 and
hqgit's D-3). Actions bumped to checkout@v7 and upload-artifact@v7,
which closes the two open dependabot PRs.

- drop the dependabot npm entry for /web (D-1: no npm anywhere), which
  failed on every scheduled run
- replace the hqgit vocabulary the D-2 copy carried into the skills and
  agents (ledger-guardian, trust-reviewer, L0/L1, golden vectors, fuzz/,
  executor/, web/, REAPI, fact kinds, predicates, aicortex-ledger,
  aicortex-cli, hq) with the memory invariants, this product's crates,
  and its seams
- regenerate the .derived shards for spec 001
@bartekus
bartekus merged commit 2f98bf0 into main Sep 6, 2026
4 checks passed
@bartekus
bartekus deleted the 001-harness-hqgit-lessons branch September 6, 2026 02:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant