// SPDX-License-Identifier: CC-BY-SA-4.0
// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)

= otpiser#11 Estate-wide Blocker Sweep — 2026-05-26
:toc:
:toclevels: 2
:source-highlighter: rouge
:icons: font

Companion machine-readable manifest: `otpiser-blocker-sweep-2026-05-26.a2ml`.

== Summary

Started as a request to merge `hyperpolymath/otpiser#11` (3 stated minor items). Expanded into an estate-wide investigation when CI repeatedly failed to clear required checks. The triggering PR landed; the diagnostic work landed several adjacent campaigns. Net outcome:

* **otpiser#11 MERGED** — 17 of 17 required checks passed after the diagnostic fix.
* **64 repos de-phantomized** — 3 stale required-status-check contexts (`Hypatia neurosymbolic scan`, `Deposit findings for gitbot-fleet`, `panic-attack assail`) removed from `main` branch protection across the estate. Every future PR on those 64 repos is now unblocked from this entire class of phantom-context drift.
* **61 PRs auto-merged via bulk rerun** — a single transient `codeload.github.com` cache miss had marked 79 PRs red across the estate; bulk `gh run rerun --failed` recovered 61 once codeload self-healed.
* **12 baseline-rot-blocked wrapper PRs admin-merged** — rust-ci-reusable-wrapper stragglers whose CI could never go green because their receiving repos' `main` carried pre-existing baseline rot.
* **5 DIRTY PRs triaged** — 1 closed as obsolete, 3 merged after conflict resolution, 1 deferred + ultimately resolved.
* **20-file SPDX cleanup** in absolute-zero — PMPL-1.0-or-later → MPL-2.0 to match the recently-migrated LICENSE.
* **2 detection-rule issues + 1 hardening issue** filed (hypatia + standards) so this class of breakage gets caught at scan time, not at PR time.

== Diagnostic chain

The otpiser#11 surface complaint ("3 failing checks") concealed three distinct root-cause classes, none of which were defects in the PR itself.

=== Class 1: Phantom required-status contexts

Three context names were required by `main` branch protection but had been renamed or retired weeks earlier. The contexts could never report green because no workflow was emitting them:

[cols="2,3",options="header"]
|===
| Phantom context | Status
| `Hypatia neurosymbolic scan`         | Renamed to `Hypatia Neurosymbolic Analysis` on 2026-05-19 (already in memory under `reference_hypatia_ruleset_blocks_all_prs`)
| `Deposit findings for gitbot-fleet`  | External `workflow_dispatch` no longer wired
| `panic-attack assail`                | External dispatch no longer wired
|===

Fix: `gh api -X DELETE …/branches/main/protection/required_status_checks/contexts -f 'contexts[]=…'` over the 3 names per affected repo.

Re-audit after the sweep: 0 repos still carrying any of the 3 phantoms.

=== Class 2: Transient codeload cache miss

`governance-reusable.yml` line 523 pins `trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d`. The SHA exists, `action.yml` exists, and direct `curl https://codeload.github.com/.../tar.gz/<sha>` returned `200` ten minutes after the failure. But the runner only retries once on cache miss, so the single glitch failed every PR whose CI fired during the codeload window.

`hypatia-scan.yml` chained through `erlef/setup-beam@fc68ffb…` and the same single-retry behaviour applied.

Single transient glitch → 44 PRs all failing their seven `governance/*` matrix jobs identically (same minute, same error). The PRs were green on content; the action ecosystem was momentarily broken.

Fix: bulk `gh run rerun --failed` across 79 still-failing PRs (147 individual workflow reruns triggered). 61 auto-merged within minutes once reruns passed.

Hardening filed at standards#208: cache action tarballs, add explicit retry-with-backoff, and document the rerun recipe in `CONTRIBUTING.md` so this isn't diagnosed from scratch the next time codeload hiccups.

=== Class 3: Baseline-rot inheritance

A subset of the wrapper-conversion PRs (the campaign that ran earlier in the day, tracked in `audit-admin-merge-wrapper-sweep-2026-05-26.adoc`) had stragglers whose CI was bound to fail through no fault of the PR's content. Same pattern as the earlier admin-merge case: the wrapper PR is the fix; the receiving repo's `main` carried pre-existing failures; auto-merge could never fire.

Spot-check evidence from this session (12 stragglers):

[cols="2,3,3",options="header"]
|===
| Repo                          | PR     | Pre-existing baseline rot
| `ambientops`                  | #104   | Inherited
| `bunsenite`                   | #49    | Inherited
| `conflow`                     | #19    | Inherited
| `echidna`                     | #108   | Inherited
| `email-octad-experiment`      | #18    | `antipattern-check` on main
| `ipv6-only`                   | #9     | `lint-shell`/`lint`/`lint-workflows`/`container-build` on main
| `neurophone`                  | #68    | Inherited
| `rattlescript`                | #11    | Inherited
| `somethings-fishy`            | #18    | Inherited
| `the-nash-equilibrium`        | #44    | Inherited
| `vcl-ut`                      | #36    | E2E + 4 other governance/* checks
| `zerostep`                    | #40    | Inherited
|===

All 12 admin-merged in 68 seconds via `gh pr merge --squash --admin --delete-branch`, same authorisation pattern as the earlier campaign.

=== Class 4: 5 DIRTY PRs

Five PRs had real merge conflicts against main. Triaged individually:

* `me-dialect#1` — **closed as obsolete**. The PR's 1-line `actions/upload-artifact` SHA fix was rendered moot when `main` refactored `hypatia-scan.yml` into a thin wrapper, removing the `upload-artifact` step entirely.
* `absolute-zero#41` — **merged**. Single `.hypatia-ignore` add/add conflict; main's superset entry list adopted.
* `absolute-zero#42` — **merged after two rounds of conflict resolution + a substantive ROADMAP audit**. The conflict on `ROADMAP.adoc` initially looked like an unwanted v12 vision rewrite; deep-dive revealed it was the deliberate `ROADMAP-V1-TO-V12 → ROADMAP` consolidation explicitly documented in commit `83d51a2`. Main's 727-line v12 ROADMAP is the intended canonical direction.
* `tma-mark2#41` — **auto-merge armed**. Single `elixir-ci.yml` conflict resolved by preserving the wrapper pattern but keeping the PR's `elixir-version: 1.17` input (`mix.exs` requires `~> 1.17`, not 1.15).
* `echidna#103` — **auto-merge armed**. File-rename conflict (`audits/ → reports/audits/`) resolved by accepting the rename direction and moving the new file into its post-rename location.

=== Class 5: Hypatia false-positives

* `panic-attack#48` — added `.hypatia-ignore` entry for `docs/campaigns/2026-05-26/01-triage.ts`. The file is a Deno-shebang triage helper, not banned TypeScript (Deno is the approved alternative per estate language policy). The "Generic secret" alert at line 70 matched the literal string `"HardcodedSecret"` in a category-code mapping — false positive.
* `verisimdb#40` — removed 3 legacy `.machine_readable/*.scm` duplicate state files. The canonical `.a2ml` equivalents under `.machine_readable/6a2/` were already present; the `.scm` copies were structural drift introduced by a prior session commit.
* `standards#189` — self-resolved during diagnosis (merged independently). The `unpinned_action: deno-ci-reusable.yml@main` self-reference is a known Hypatia rule gap (governance-reusable's own grep on line 642 excludes `uses: hyperpolymath/standards/`; the Hypatia rule needs the same exclusion).

== absolute-zero SPDX consistency follow-up

The deep-dive on absolute-zero#42 surfaced a SPDX/license-text drift: 20 active files still carried `PMPL-1.0-or-later` while the repo's `LICENSE` had migrated to `MPL-2.0`. Filed as `absolute-zero#54`, merged in the same session. Post-merge `grep -rln 'PMPL-1.0-or-later'` returns 0 hits outside `git history`.

== Detection-rule issues filed (anti-recurrence)

* `hypatia#336` — Detect `SafeDOMExample.res` (banned ReScript dialect, should be `.affine`)
* `hypatia#337` — Detect `workflow-linter.yml` self-referential `uses:` grep
* `hypatia#338` — Extend `codeql_language_matrix_mismatch` to flag `javascript-typescript` on actions-only repos
* `hypatia#339` — File-extension banned-language detection sweep
* `gitbot-fleet#214` — Standing `SafeDOMExample.res→.affine` sustainabot recipe
* `standards#208` — Codeload-retry resilience for governance-reusable's action downloads (this session's filing)

== What this campaign does NOT discharge

* `affinescript#57 Phase 2` (tree-sitter walker) — still pending. Repos with substantive non-SafeDOM `.res` files cannot have the `.res→.affine` migration mechanically applied until Phase 2 ships.
* Cloudflare API token rotation — paused, awaiting user verification of rotation status at the Cloudflare console.
* The 6 PRs auto-merge-armed but CI-bound at session close (`tma-mark2#41`, `echidna#103`, `verisimdb#40`, `panic-attack#48`, `stapeln#62`, `the-nash-equilibrium#41`). All gating on CI to clear naturally.
* Parallel-session `secret-scanner.yml → reusable wrapper` sweep (~50+ PRs in flight per `standards#190`). That's a sibling lane, not this lane.

== Authorisation footprint

* 64 repos: 3 `DELETE` calls each over `branches/main/protection/required_status_checks/contexts` (admin-bearing)
* 12 wrapper PRs admin-merged (same authorisation as the earlier 280-PR campaign)
* 1 standards PR (audit pair, this document)

Every commit GPG-signed with key `4A03639C1EB1F86C7F0C97A91835A14A2867091E`, author `6759885+hyperpolymath@users.noreply.github.com`. One amend was required during the `echidna#103` resolution to repair an inline env-var typo that produced a malformed email — caught immediately and reset via `commit --amend --reset-author -S`.

== Files produced today

* This audit pair: `docs/audits/otpiser-blocker-sweep-2026-05-26.{adoc,a2ml}`
* Session-memory file: `~/.claude/projects/-home-hyperpolymath/memory/session_2026_05_26_otpiser_blocker_sweep.md`
* 6 detection-rule issues filed (hypatia#336-339, gitbot-fleet#214, standards#208)
* 1 SPDX-sweep PR (absolute-zero#54) — landed
* Several /tmp/ analysis files (cleaned up at session close): `phantom-hits.tsv`, `all-pr-checks-fresh.jsonl`, `wrapper-state.tsv`, `gov-cluster.txt`, etc.
