feat(shelf): T2–T4 books + Phase-4 policy — the wave's registry closes - #1675
Conversation
…s live THEORIA 12 · POIESIS 18 · TAXIS 18 · LOGOS 3 · KOINONIA 11 (contrib hub + 5 kept forks) · KERYGMA 5 · meta-organvm 10 (all superprojects) · ERGON +2 = the whole advertised backbone now holds its contents (~80 transfers, redirects live). dot-github--X renamed to .github in each org — every shelf face renders. padavano moved to the personal estate (the name-site belongs to the name). Archived stays in the attic (attic doctrine); homebrew-limen stays engine-room (live brew tap). Books: full shelf_assignments (127 placements), shelf_public class, 20 row re-keys + visual-substrate-inquiry judgment row, access never_grant re-keys. Census: owners() skips glob-derived prefixes; org outside-rolls route user-scoped off the canonical org. Doctor: class P clean over all 8 shelves; N+O zero drift; sole live drift is the pre-existing landed-branch backlog (Phase 3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VHjMkFUZJ1pK21oyv1ropN
|
Multi-agent review roll call (CodeRabbit and Claude review automatically. Reviewers: post substantive findings only. Authors/agents: address every thread, push fixes to this branch, reply and resolve, then re-request review.) |
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
To use Codex here, create a Codex account and connect to github. |
📝 WalkthroughWalkthroughThe pull request expands GitHub estate and repository governance configuration, updates denylisted namespaces and repository classifications, and refines owner and outside-collaborator handling in the GitHub census script. ChangesGitHub governance and census
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/gitvs.py`:
- Around line 1028-1033: Update the organization census flow around _gh_user and
_gh so failed or malformed rolls for declared shelf and canonical organizations
set ok = False, preventing out["complete"] from being true when organization
data is missing. Preserve the existing personal-account 404 exception, which
should remain non-fatal.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 550f11f5-0c75-4bc6-b097-8bee839d1f96
📒 Files selected for processing (3)
institutio/github/access.yamlinstitutio/github/estate.yamlscripts/gitvs.py
| # Non-canonical org rolls (shelf orgs) sit outside the App installation — user-scoped. | ||
| org_args = ["api", f"/orgs/{org}/outside_collaborators?per_page=100", "--jq", "[.[].login] | sort"] | ||
| if _org_class(org, estate)[0] == "canonical": | ||
| r = _gh(org_args, token, timeout=30) | ||
| else: | ||
| r = _gh_user(org_args, timeout=30) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Do not report a complete census after a shelf-org roll fails.
When _gh_user fails for a declared shelf org, its roll becomes None but ok remains true, so out["complete"] can be true with missing organization data. Keep the personal-account 404 exception, but set ok = False for failed or malformed declared shelf/canonical-org rolls.
Proposed fix
for org in owners(estate):
+ declared_org = (
+ org in (estate.get("shelf_assignments") or {}).get("shelves", {})
+ or _org_class(org, estate)[0] is not None
+ )
org_args = ["api", f"/orgs/{org}/outside_collaborators?per_page=100", "--jq", "[.[].login] | sort"]
if _org_class(org, estate)[0] == "canonical":
r = _gh(org_args, token, timeout=30)
else:
r = _gh_user(org_args, timeout=30)
try:
- out["org_outside"][org] = json.loads(r.stdout or "[]") if r.returncode == 0 else None
+ out["org_outside"][org] = json.loads(r.stdout or "[]") if r.returncode == 0 else None
+ if r.returncode != 0 and declared_org:
+ ok = False
except ValueError:
out["org_outside"][org] = None
+ if declared_org:
+ ok = FalseAs per coding guidelines, “Do not claim completion until the relevant executable predicate exits successfully.”
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Non-canonical org rolls (shelf orgs) sit outside the App installation — user-scoped. | |
| org_args = ["api", f"/orgs/{org}/outside_collaborators?per_page=100", "--jq", "[.[].login] | sort"] | |
| if _org_class(org, estate)[0] == "canonical": | |
| r = _gh(org_args, token, timeout=30) | |
| else: | |
| r = _gh_user(org_args, timeout=30) | |
| for org in owners(estate): | |
| declared_org = ( | |
| org in (estate.get("shelf_assignments") or {}).get("shelves", {}) | |
| or _org_class(org, estate)[0] is not None | |
| ) | |
| # Non-canonical org rolls (shelf orgs) sit outside the App installation — user-scoped. | |
| org_args = ["api", f"/orgs/{org}/outside_collaborators?per_page=100", "--jq", "[.[].login] | sort"] | |
| if _org_class(org, estate)[0] == "canonical": | |
| r = _gh(org_args, token, timeout=30) | |
| else: | |
| r = _gh_user(org_args, timeout=30) | |
| try: | |
| out["org_outside"][org] = json.loads(r.stdout or "[]") if r.returncode == 0 else None | |
| if r.returncode != 0 and declared_org: | |
| ok = False | |
| except ValueError: | |
| out["org_outside"][org] = None | |
| if declared_org: | |
| ok = False |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/gitvs.py` around lines 1028 - 1033, Update the organization census
flow around _gh_user and _gh so failed or malformed rolls for declared shelf and
canonical organizations set ok = False, preventing out["complete"] from being
true when organization data is missing. Preserve the existing personal-account
404 exception, which should remain non-fatal.
Source: Coding guidelines
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d234131ad
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # visibility and the split protocol are the only sauce levers. | ||
| sauce_policy: | ||
| provenance: "Phase 4 2026-07-30 — verdicts derive from class + moat-guard rows + split registrations (the never-a-second-list law)" | ||
| derivation: {private_classes: [vault_private, operation_private, private_unreviewed, conductor], guard_registry: moat-guard.json, split_predicate: scripts/check-split-hygiene.py} |
There was a problem hiding this comment.
When this derivation is applied, every conductor and operation_private repository is labeled PRIVATE solely by class. However, conductor explicitly declares visibility: public, and visibility_drift() treats operation_private rows with publish_candidate as desired-public; this commit includes several such rows. Public repositories such as organvm/limen and published candidates therefore receive the verdict documented as meaning census-private, creating a false moat posture. Derive PRIVATE from effective/observed visibility or account for these public exceptions.
Useful? React with 👍 / 👎.
| shelf_public: "no LICENSE by default — the published FORM, all rights reserved; a per-repo grant is a judgment-row fact" | ||
| portal_public: "permissive only where the README already claims it (a-i-chat--exporter ships MIT — grandfathered); new grants are per-repo judgment rows" |
There was a problem hiding this comment.
When a repository needs the exception explicitly permitted here, there is nowhere to record it: repo_overrides is the only sanctioned per-repo judgment block, but VALID_OVERRIDE_KEYS rejects any license or grant field, and a repo-wide search finds no other registry or consumer for license_policy. Consequently a LICENSE can change without a declared judgment, while adding the required judgment makes parity fail, so this policy cannot be enforced. Add a validated per-repo license field or registry and an owning predicate.
AGENTS.md reference: AGENTS.md:L179-L182
Useful? React with 👍 / 👎.
| timeout=30, | ||
| ) | ||
| # Non-canonical org rolls (shelf orgs) sit outside the App installation — user-scoped. | ||
| org_args = ["api", f"/orgs/{org}/outside_collaborators?per_page=100", "--jq", "[.[].login] | sort"] |
There was a problem hiding this comment.
When a login already has one legitimate grant, this newly readable shelf-org roll cannot detect that login's undeclared access to a different shelf repository. Class N later builds one estate-wide declared_logins set and treats any occurrence in any org roll as declared, while its per-repo census only probes repositories already listed under grants or never_grant_repos. A partner granted on one 4444J99 project can therefore retain unnoticed access anywhere in a shelf org, violating the registry's exact-project partition; retain repository information and compare each live grant to its specific repo.
Useful? React with 👍 / 👎.
| organvm/persona-fleet: {class: vault_private, why: "persona corpus — private data"} | ||
| organvm/personal: {class: vault_private, why: "personal memory store — private data"} | ||
| organvm/portfolio: {class: portal_public, why: "traction/value lure — portal tier"} | ||
| organvm-vii-kerygma/portfolio: {class: portal_public, why: "traction/value lure — portal tier"} |
There was a problem hiding this comment.
After this transfer, census rows use organvm-vii-kerygma/portfolio, but positioning-seeds.json and value-repos.json still key organvm/portfolio; this batch similarly moves cind-and-sol-foundation without updating its value-repo key. Consumers compare these names exactly (repo-metadata-sync.py checks repo in pos, while the SEO backlog and product ledger build exact sets), so the portfolio loses its curated metadata seed and appears unseeded while priority/product records remain attached to the obsolete owner. Rekey every owner-qualified registry/default during the transfer or normalize canonical aliases before comparison.
AGENTS.md reference: AGENTS.md:L294-L300
Useful? React with 👍 / 👎.
1 participant
The closing estate books of custody v4.0.0.
T2–T4 (ground truth already live): all eight shelves populated (~80 further transfers — THEORIA 12, POIESIS 18, TAXIS 18, LOGOS 3, KOINONIA 11, KERYGMA 5, meta 10, ERGON +2); every
dot-github--Xrenamed.github(all seven shelf faces render); padavano → personal. Books: fullshelf_assignments(127 placements),shelf_publicclass, 20 row re-keys + visual-substrate-inquiry judgment row, access never_grant re-keys, owners() glob-skip, org outside-rolls user-scoped. Live doctor: class P clean across all 8 shelves, N+O real verdicts at zero drift, census complete=true.Phase 4:
sauce_policy— the verdict derivation law (PRIVATE/SPLIT/GUARD/CLEAN derive from class + moat-guard + split registrations; enforcement = composition of shipped predicates; vox pair adjudicated independent-siblings).license_policy— the estate's first written license doctrine (all-rights-reserved default, per-surface posture, grants are judgment rows).Gates: yaml valid · parity drift==∅ · verify-scoped PASS.
🤖 Generated with Claude Code
https://claude.ai/code/session_01VHjMkFUZJ1pK21oyv1ropN
Summary by CodeRabbit
Governance
Bug Fixes