CI/CD reds on main: 6 distinct workflows failing — root causes catalogued

[hyperpolymath]

Background

Deep audit 2026-06-01 — analogue of verisimdb#82/#83. Six distinct workflows are failing on main. This issue catalogues root causes; PR #40 addresses the two highest-leverage ones (correspondence + ECHIDNA) at source.

Status snapshot (main, 2026-06-01)

Workflow	Status	Root cause	Fix
Correspondence Validation	FAIL	scripts/validate-correspondence.sh uses ((var++)) which returns 1 when var=0, tripping set -e at the first PASS	PR #40 (auto-merge armed)
ECHIDNA Validation	FAIL	scripts/validate-with-echidna.sh passes --prover lean4; echidna CLI accepts only --prover lean. Plus same ((var++)) bug	PR #40 (auto-merge armed)
Governance	FAIL	Language / package anti-pattern policy step exits 1; Workflow security linter step exits 1 ("missing SPDX header" or "missing top-level permissions"); Trusted-base reduction policy exits 1	Needs per-workflow audit; see below
OpenSSF Scorecard Enforcer	FAIL	Token-permissions, code-review (single-author), packaging metric all level=error	Single-author repo; ENFORCER threshold may be too aggressive
Mirror to Git Forges	FAIL	gitlab.com:hyperpolymath/valence-shell.git push rejected (likely auth/credential issue)	Out of scope for code fix; needs owner action on GitLab token
Instant Sync	FAIL	Bad credentials - https://docs.github.com/rest — sync token expired/revoked	Owner action: refresh PAT / GITHUB_TOKEN secret
Dependabot Update #1391649628	FAIL	github_actions update job — needs log inspection	Likely transient or stale config
ClusterFuzzLite Batch Fuzzing	FAIL	(6h26m runtime) — likely OOM or genuine fuzz finding	Investigate log; could be real bug
Scorecards supply-chain	startup_failure	Action setup fails before running	Owner action: refresh permissions on caller

Going-green-pending-merge

After PR #40 lands:

• 2 of 6 distinct red workflows go green (Correspondence, ECHIDNA step 1)
• ECHIDNA may surface secondary failures (the lean4-name error was masking step 2-7). Re-audit after merge.

Remaining work (4 issues to drill into separately, NOT in scope of #40)

A. Governance failures (3 sub-steps red)

Three sub-steps fail in .github/workflows/governance.yml:

1. Language / package anti-pattern policy — likely the affinescript compile failed — drift check skipped warning is being escalated to an error somewhere in the policy check. Check .github/workflows/governance.yml for the drift-check exit-code handling.
2. Workflow security linter — checks every workflow for SPDX header + permissions: block. The audit confirmed both ARE present on the canonical workflows; this might be a false-positive on a recently-added workflow like workflow-linter.yml itself. Recommend running the linter locally first to find which file fails.
3. Trusted-base reduction policy — needs investigation.

B. OpenSSF Scorecard Enforcer (level=error on 4 metrics)

Scorecard itself runs (and CodeQL Security Analysis is green). The Enforcer is what fails — it's stricter. Errored metrics per the log:

1. Token-Permissions — some workflow has permissions: write-all or no top-level permissions. Estate-standards: top-level read-all or contents: read, write at job-level only.
2. Code-Review — single-author repo, all recent merges by hyperpolymath. Estate has known mitigation (admin-merge-after-resolving-cicd-at-source pattern); Enforcer may need a configured exclusion.
3. Packaging — Scorecard looks for actions/upload-release-asset / GH packages publishing; valence-shell publishes to crates.io but the Scorecard heuristic doesn't detect it.
4. Branch-Protection / Required-Reviewers — possibly downstream of chore(deps): bump the actions group across 1 directory with 10 updates #2.

C. Mirror to Git Forges (GitLab push rejected)

Out of scope for code-level fix. Likely the GITLAB_TOKEN secret has rotated or hit a permissions boundary. Owner action.

D. Instant Sync (Bad credentials)

Same shape — owner action to refresh PAT.

E. ClusterFuzzLite Batch Fuzzing (6h26m, then fail)

Worth a closer look — this could be a real finding rather than infrastructure. Inspect run 26705173970 logs.

Suggested next PRs

1. PR fix(ci): set-e safe counter increments + lean4→lean prover name #40 (this audit) — MERGE — fixes 2 of 6 reds. Already armed for auto-merge.
2. Per-workflow drill into governance.yml — separate PR.
3. Scorecard Enforcer threshold review — separate PR or owner-config-change ticket.
4. CFLite log inspection — could become a security advisory or a tests/fuzz corpus addition.

References

• PR fix(ci): set-e safe counter increments + lean4→lean prover name #40: fix(ci): set-e safe counter increments + lean4→lean prover name #40
• estate-memory: [Admin-merge after CI resolved at source], [scorecard.yml caller needs job-level permissions]
• estate-memory: [Estate admin-merge sweep 2026-05-30] — pattern of how 27 PRs were merged across the estate same shape

🤖 Filed by deep audit 2026-06-01

[hyperpolymath]

Closed by PR #54 (auto-merged 2026-06-01 18:06Z).

Fixed at source (8 workflows):

• Workflow Security Linter (rust-toolchain SHA pin)
• Security policy checks / R5b (version-line cleanup across 5 docs)
• Language anti-pattern policy (.hypatia-ignore for STEP 8 hold)
• Trusted-base reduction (full-path enumeration in PROOF-NEEDS.md)
• dogfood-gate.yml (Python heredoc → shell+grep+awk; also addresses estate Python ban)
• OpenSSF Scorecard Enforcer (cascaded from dogfood-gate YAML fix; score 6.7)
• Scorecards supply-chain (cascaded)
• ClusterFuzzLite (Containerfile → Dockerfile rename — action hard-codes filename; not a real fuzz finding)
• a2ml-validate-action SHA bump for s-exp identity support

Owner-action remaining (out of code scope):

• Mirror to Git Forges — refresh GITLAB_TOKEN secret
• Instant Sync — refresh PAT used to dispatch to .git-private-farm

Acknowledged single-author exemptions:

• Scorecard Code-Review (0/30 approved — repo single-author by design)
• Scorecard Branch-Protection / CII-Best-Practices / Signed-Releases — separate work
• CodeQL Security Analysis PR-event red — pre-existing flakiness, no JS/TS to extract

Surfaced downstream (not in #46 scope):

• pr_fuzzing rust toolchain layout issue — separate follow-up needed.