repo: the term wall — names this organisation does not use, refused in CI - #8
Merged
Conversation
…n CI A composite action every repo's ci job runs: it scans tracked content, file paths, the change's commit messages (base...head via the API, or the pushed commit), the pull request title and body, and the branch name for names that must not appear here — not affirmed, not negated, not cited. The wall never spells what it refuses and masks every hit it prints; a surface it could not read is a hit, never a pass. This repo's own ci runs it and then proves it fires on a planted fault and stays quiet on a clean neighbour. Verified locally: 10/10 cases (clean tree and PR; planted content, path, title, branch name, commit message via API and via push; API unreachable) exit as specified, and the action's files pass their own wall. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Two producers read the contract differently: the location of a hit (with or without a colon), the pull request title and body as one surface or two, and the names of the refusal classes. The contract now pins all three in a table; the implementation moves to it, the tests stand. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Authored from the contract by a producer other than the implementer: each test runs term-wall.sh as a subprocess in its own temporary git repository with a test-only pattern, simulating pull_request and push events, and asserts exit code and output shape. Red at this commit: 13 of 15 fail, identically over three runs. Source: original Co-Authored-By: GPT-5.6 Sol <noreply@openai.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T225145Z-apply-push-ca3088 Patch-SHA256: 5c280fccf2f955ddce536df7b4d99ca4c652c5a7edd059354eab12a985bb92e1
…token term-wall.sh reads its pattern only from TERM_WALL (the action takes it from vars.TERM_WALL) and refuses on the wire when it is unset; commit messages come from git (base..head, or the head commit on a branch creation), fetched offline, never from an API, so the action holds no token; every hit is masked; the self-test plants vars.TERM_WALL_PLANT and proves the refusal. CONTRACT.md carries the contract verbatim. Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T225148Z-apply-push-dc1f97 Patch-SHA256: 3f59b7252e7ae3b3e0c7894ec551f7e1811d1811f7ed285ef585232bb740fddb
A composite action cannot read vars (GitHub refuses the template: 'Unrecognized named-value: vars', PR#8 run 33568333825), so the calling step passes env TERM_WALL from vars.TERM_WALL and the action refuses when it did not. Same for the self-test's planted fault. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
The pinned wire: one summary line on a clean run, one
`<surface>: <location>: <line>` per hit with the location never
carrying a colon, four refusal classes. The pattern now arrives from
the calling step (`env: TERM_WALL: ${{ vars.TERM_WALL }}`) because the
runner refuses `vars` inside a composite action; the action refuses
when the step passed nothing. ci.yml passes it.
Source: original
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY
Apply-Push-Job: 20260901T230235Z-apply-push-4be45d
Patch-SHA256: c8606262ab7780275c529792f1882bd9c94478fff501ad995d318c286ef7eeb7
xor-machine
marked this pull request as ready for review
September 1, 2026 23:06
xor-machine
pushed a commit
to minspec/skeleton
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230919Z-apply-push-06b283 Patch-SHA256: 7eb098b1f00ca663978af20a1f5ec92c9645ba363405dab7326f696e5b14441b
xor-machine
pushed a commit
to minspec/workbench-fixtures
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230927Z-apply-push-a3666b Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
xor-machine
pushed a commit
to minspec/recipes
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
xor-machine
pushed a commit
to minspec/discussions
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7
xor-machine
pushed a commit
to minspec/docker
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
xor-machine
pushed a commit
to minspec/minspec
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230949Z-apply-push-c1566b Patch-SHA256: 9f7300089b57e722772a526f33521eadef2b4a5f1a60f0488375c59343486831
xor-machine
pushed a commit
to minspec/workbench
that referenced
this pull request
Sep 1, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T231003Z-apply-push-db7712 Patch-SHA256: 35bebcb925860d46a10042fcd31e8877c9a1208df74397d30dbda1672a7e2728
xor-machine
pushed a commit
to minspec/workbench
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T231003Z-apply-push-db7712 Patch-SHA256: 35bebcb925860d46a10042fcd31e8877c9a1208df74397d30dbda1672a7e2728
xormania
pushed a commit
to minspec/workbench
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T231003Z-apply-push-db7712 Patch-SHA256: 35bebcb925860d46a10042fcd31e8877c9a1208df74397d30dbda1672a7e2728
xor-machine
pushed a commit
to minspec/workbench-fixtures
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230927Z-apply-push-a3666b Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
xor-machine
pushed a commit
to minspec/docker
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
xor-machine
pushed a commit
to minspec/minspec
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230949Z-apply-push-c1566b Patch-SHA256: 9f7300089b57e722772a526f33521eadef2b4a5f1a60f0488375c59343486831
xor-machine
pushed a commit
to minspec/discussions
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7
xor-machine
pushed a commit
to minspec/skeleton
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230919Z-apply-push-06b283 Patch-SHA256: 7eb098b1f00ca663978af20a1f5ec92c9645ba363405dab7326f696e5b14441b
xor-machine
pushed a commit
to minspec/recipes
that referenced
this pull request
Sep 2, 2026
Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The term wall: a composite action at
.github/actions/term-wallthat every repo'scijob runs. It refuses names this organisation does not use — in tracked content, file paths, the change's commit messages, the PR title and body, and the branch name. It never spells what it refuses and masks every hit it prints; a surface it cannot read is a hit, never a pass.This repo's own
ciruns the wall and then proves it: fires on a planted fault, quiet on a clean neighbour.Evidence
Rollout
After this merges, every other repo's
cijob gets one step,uses: minspec/.github/.github/actions/term-wall@dev. Seven PRs follow.🤖 Generated with Claude Code
https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY