You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Read workspace members from chant's read contract, and add CODEOWNERS #62
Audit 2026-09-30 against chant main 1c1a04a90 and github-warden main b25424a (v0.6.1)
Criterion
State
Evidence
The warden reads the member list from chant workspace ls --json
not met
github-warden/src has no reference to workspace, and its dependencies are @intentius/chant ^0.72.1. chant workspace ls --json shipped in 0.81.0 (#2593), with output schema ls.schema.json (#2643), so the warden has to move to at least 0.81 first
It also reads generated job names and lifecycle paths from the contract
not met, and the contract does not hold job names
ledger and gate paths on chant/lifecycle are in status.schema.json (chant workspace status --json). Generated job names are in no contract document (ls, graph, status and check schemas). That needs a chant-side addition
Required checks can be declared per member pipeline
not met
per-member CI pipelines exist in chant (#2542, member-pipeline.ts), but the warden has nothing for them and, per the point above, nothing tells it their job names
The chant/lifecycle branch can be protected by a ruleset
not met
no ruleset for it in the warden source. The branch name is a constant in the status contract (lifecycle.ref)
CODEOWNERS entries can be declared per member directory
not met
no CODEOWNERS code in the warden. Member directories are in ls --json (members[].dir), so this part is unblocked once the warden moves to 0.81 or later
Status: not started. Blockers: the chant 0.72.1 to 0.81+ bump in the warden, and job names missing from the read contract. The level-0 and "works on the chant repo" lines are not in this issue.
PR #63 merged. Met: the warden reads members from chant workspace ls --json (contract 1), and CODEOWNERS entries per member directory (github-warden codeowners). The chant range is now ^0.100.0.
Reading lifecycle paths from status --json and a ruleset for chant/lifecycle: not started; the ref name is lifecycle.ref in the status contract. Independent of #3050.
Activity
lex00 commentedon Sep 30, 2026
Audit 2026-09-30 against chant main 1c1a04a90 and github-warden main b25424a (v0.6.1)
chant workspace ls --jsongithub-warden/srchas no reference toworkspace, and its dependencies are@intentius/chant^0.72.1.chant workspace ls --jsonshipped in 0.81.0 (#2593), with output schemals.schema.json(#2643), so the warden has to move to at least 0.81 firstchant/lifecycleare instatus.schema.json(chant workspace status --json). Generated job names are in no contract document (ls,graph,statusandcheckschemas). That needs a chant-side additionmember-pipeline.ts), but the warden has nothing for them and, per the point above, nothing tells it their job nameschant/lifecyclebranch can be protected by a rulesetlifecycle.ref)ls --json(members[].dir), so this part is unblocked once the warden moves to 0.81 or laterStatus: not started. Blockers: the chant 0.72.1 to 0.81+ bump in the warden, and job names missing from the read contract. The level-0 and "works on the chant repo" lines are not in this issue.
feat: read workspace members from chant's read contract and generate …
lex00 commentedon Oct 1, 2026
PR #63 merged. Met: the warden reads members from
chant workspace ls --json(contract 1), and CODEOWNERS entries per member directory (github-warden codeowners). The chant range is now ^0.100.0.Left:
status --jsonand a ruleset forchant/lifecycle: not started; the ref name islifecycle.refin the status contract. Independent of #3050.feat: read the chant/lifecycle ledger paths and ruleset from the stat…