From 7b426c7ead663d6f7b30e267041a1ccf1b0280d0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 27 Aug 2026 13:38:17 +0100 Subject: [PATCH] policy(validators): the contractile enforced Deno-only, blocking the Bun ruling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Owner ruling 2026-08-27: migrate the validators first. MUST.contractile asserted: (must "no npm/bun/yarn/pnpm dependencies — Deno only") which named Bun itself as a prohibited dependency source. The estate-wide Bun ruling of 2026-08-26 requires package.json + bun.lock, so an agent obeying .claude/CLAUDE.md in this repo produced a change its own K9 validators reject. CodeRabbit put it exactly: "These instructions can produce changes that fail repository validation." That is why this repo was held out of the fleet rollout. The instruction and the enforcement disagreed, and the agent had no way to know which won. Now: (must "JS deps via Bun — package.json + bun.lock; no npm/yarn/pnpm lockfiles") The prohibition is preserved where it still applies — competing npm, yarn and pnpm lockfiles remain banned — and lifted only for Bun, which canon now mandates. This is a narrowing of the rule to match ratified policy, not its removal. With this landed, the Bun policy change for this repo can follow without producing a self-contradictory state. Co-Authored-By: Claude Opus 5 --- .machine_readable/MUST.contractile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.machine_readable/MUST.contractile b/.machine_readable/MUST.contractile index 4610704..2c9a6da 100644 --- a/.machine_readable/MUST.contractile +++ b/.machine_readable/MUST.contractile @@ -46,7 +46,7 @@ (must "no new TypeScript files") (must "no new Python files") (must "no new Go files") - (must "no npm/bun/yarn/pnpm dependencies — Deno only") + (must "JS deps via Bun — package.json + bun.lock; no npm/yarn/pnpm lockfiles") ; Dangerous patterns (must "no believe_me (Idris2)")