hyperpolymath
diff --git a/‎.github/workflows/hypatia-scan.yml‎
Lines changed: 6 additions & 3 deletions b/‎.github/workflows/hypatia-scan.yml‎
Lines changed: 6 additions & 3 deletions
diff --git a/‎.github/workflows/rsr-antipattern.yml‎
Lines changed: 0 additions & 77 deletions b/‎.github/workflows/rsr-antipattern.yml‎
Lines changed: 0 additions & 77 deletions
diff --git a/‎.github/workflows/secret-scanner.yml‎
Lines changed: 3 additions & 1 deletion b/‎.github/workflows/secret-scanner.yml‎
Lines changed: 3 additions & 1 deletion
@@ -206,11 +206,14 @@ jobs:
           # build paths normalised to repo-relative.
           if [ -f .hypatia-baseline.json ]; then
             # Normalise + project just the comparable keys from the current scan.
+            # Identity is the 4-tuple (severity, rule_module, type, file) per
+            # the contract above. `action` is advisory metadata that varies
+            # by run/strategy and MUST NOT be part of finding identity —
+            # including it made every baseline entry fail to match.
             jq '[ .[] | select(.severity == "critical" or .severity == "high")
                        | {severity, rule_module, type,
                           file: (.file | sub("^/home/runner/work/[^/]+/[^/]+/"; "")
-                                       | sub("^/github/workspace/"; "")),
-                          action} ]' hypatia-findings.json > findings-current.json
+                                       | sub("^/github/workspace/"; "")) } ]' hypatia-findings.json > findings-current.json
 
             # Subtract baseline. A current finding is "new" iff there's no
             # element in baseline equal to it (by-value).
@@ -224,7 +227,7 @@ jobs:
               jq -r '.[] | "  [\(.severity)] \(.rule_module)/\(.type) — \(.file)"' findings-new.json
               echo
               echo "If these are intentional, regenerate .hypatia-baseline.json:"
-              echo "  jq '[.[] | select(.severity == \"critical\" or .severity == \"high\") | {severity, rule_module, type, file, action}] | sort_by(.severity, .rule_module, .type, .file)' hypatia-findings.json > .hypatia-baseline.json"
+              echo "  jq '[.[] | select(.severity == \"critical\" or .severity == \"high\") | {severity, rule_module, type, file}] | sort_by(.severity, .rule_module, .type, .file)' hypatia-findings.json > .hypatia-baseline.json"
               exit 1
             fi
             echo "All critical/high findings present in baseline — gate passes."
 
@@ -138,83 +138,6 @@ jobs:
           print(f"✅ No TypeScript files outside allowlist ({len(exemption_patterns)} per-repo exemption(s) parsed).")
           PYEOF
 
-          # Universal builtin allowlist — bridges that need no per-repo declaration.
-          # Files matching any of these patterns are always allowed.
-          BUILTIN_GLOBS = [
-              '*.d.ts',
-              '**/bindings/**',
-              '**/tests/**', '**/test/**',
-              '**/scripts/**',
-              '**/mcp-adapter/**',
-              '**/*vscode*/**',
-              '**/cli/**',
-              '**/mod.ts',
-              '**/lsp-server.ts', '**/lsp_server.ts', '**/lsp.ts', '**/*-lsp.ts',
-              '**/deno-*/**',
-              '**/node_modules/**',
-              '**/vendor/**',
-              '**/examples/**',
-              '**/ffi/**',
-          ]
-
-          # Per-repo exemptions parsed from .claude/CLAUDE.md "TypeScript Exemptions" table.
-          # Single source of truth — adding a row here unblocks CI for that path.
-          # Format expected:
-          #   ### TypeScript Exemptions ...
-          #   | Path | Files | Rationale | Unblock condition |
-          #   |---|---|---|---|
-          #   | `path/to/file.ts` | 1 | ... | ... |
-          #   | `dir/*.ts` | 6 | ... | ... |
-          exemptions = []
-          claude_md = pathlib.Path('.claude/CLAUDE.md')
-          if claude_md.exists():
-              in_table = False
-              for line in claude_md.read_text(encoding='utf-8').splitlines():
-                  if re.search(r'TypeScript [Ee]xemptions', line):
-                      in_table = True
-                      continue
-                  if in_table and line.startswith(('### ', '## ', '# ')):
-                      break
-                  if in_table and line.startswith('|'):
-                      m = re.match(r'\|\s*`([^`]+)`', line)
-                      if m:
-                          exemptions.append(m.group(1))
-
-          # Find all .ts and .tsx files
-          found = []
-          for ext in ('ts', 'tsx'):
-              found.extend(str(p) for p in pathlib.Path('.').rglob(f'*.{ext}'))
-
-          def allowed(path):
-              p = path.lstrip('./')
-              for g in BUILTIN_GLOBS + exemptions:
-                  if fnmatch.fnmatchcase(p, g):
-                      return True
-                  # also treat glob ending with / as a directory prefix
-                  base = g.rstrip('/').rstrip('*').rstrip('/')
-                  if base and (p == base or p.startswith(base + '/')):
-                      return True
-              return False
-
-          bad = sorted(f for f in found if not allowed(f))
-          if bad:
-              print("❌ TypeScript files detected outside the allowlist.\n")
-              for f in bad:
-                  print(f"  {f}")
-              print()
-              print("To resolve, either:")
-              print("  (a) migrate the file to AffineScript")
-              print("      (see Human_Programming_Guide.adoc migration chapter), OR")
-              print("  (b) move it to an allowlisted bridge path")
-              print("      (bindings/, tests/, scripts/, mcp-adapter/, *vscode*/, cli/, deno-*/, etc.), OR")
-              print("  (c) add an entry to the 'TypeScript Exemptions' table in .claude/CLAUDE.md")
-              print("      with rationale + unblock condition.")
-              if exemptions:
-                  print(f"\n(Currently {len(exemptions)} exemption(s) parsed from .claude/CLAUDE.md.)")
-              sys.exit(1)
-          print(f"✅ No TypeScript files outside allowlist ({len(exemptions)} per-repo exemption(s) parsed).")
-          PYEOF
-
       - name: Check for Go
         run: |
           if find . -name "*.go" | grep -q .; then
 
@@ -21,7 +21,9 @@ jobs:
       - name: TruffleHog Secret Scan
         uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3
         with:
-          extra_args: --only-verified --fail
+          # The action already passes --fail itself; repeating it errors
+          # ("flag 'fail' cannot be repeated"). Only pass --only-verified.
+          extra_args: --only-verified
 
   gitleaks:
     runs-on: ubuntu-latest