repo: the term wall — names this organisation does not use, refused in CI by xor-machine · Pull Request #8 · minspec/.github

xor-machine · 2026-09-01T22:21:21Z

What

The term wall: a composite action at .github/actions/term-wall that every repo's ci job runs. It refuses names this organisation does not use — in tracked content, file paths, the change's commit messages, the PR title and body, and the branch name. It never spells what it refuses and masks every hit it prints; a surface it cannot read is a hit, never a pass.

This repo's own ci runs the wall and then proves it: fires on a planted fault, quiet on a clean neighbour.

Evidence

Local: 10/10 surface cases exit as specified (clean tree and PR; planted content, path, title, branch name, commit message via API and via push; API unreachable).
The action's files pass their own wall (grep count 0).
The self-test step ran locally with the same script CI runs: exit 0.

Rollout

After this merges, every other repo's ci job gets one step, uses: minspec/.github/.github/actions/term-wall@dev. Seven PRs follow.

🤖 Generated with Claude Code

https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY

…n CI A composite action every repo's ci job runs: it scans tracked content, file paths, the change's commit messages (base...head via the API, or the pushed commit), the pull request title and body, and the branch name for names that must not appear here — not affirmed, not negated, not cited. The wall never spells what it refuses and masks every hit it prints; a surface it could not read is a hit, never a pass. This repo's own ci runs it and then proves it fires on a planted fault and stays quiet on a clean neighbour. Verified locally: 10/10 cases (clean tree and PR; planted content, path, title, branch name, commit message via API and via push; API unreachable) exit as specified, and the action's files pass their own wall. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY

Two producers read the contract differently: the location of a hit (with or without a colon), the pull request title and body as one surface or two, and the names of the refusal classes. The contract now pins all three in a table; the implementation moves to it, the tests stand. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY

Authored from the contract by a producer other than the implementer: each test runs term-wall.sh as a subprocess in its own temporary git repository with a test-only pattern, simulating pull_request and push events, and asserts exit code and output shape. Red at this commit: 13 of 15 fail, identically over three runs. Source: original Co-Authored-By: GPT-5.6 Sol <noreply@openai.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T225145Z-apply-push-ca3088 Patch-SHA256: 5c280fccf2f955ddce536df7b4d99ca4c652c5a7edd059354eab12a985bb92e1

…token term-wall.sh reads its pattern only from TERM_WALL (the action takes it from vars.TERM_WALL) and refuses on the wire when it is unset; commit messages come from git (base..head, or the head commit on a branch creation), fetched offline, never from an API, so the action holds no token; every hit is masked; the self-test plants vars.TERM_WALL_PLANT and proves the refusal. CONTRACT.md carries the contract verbatim. Source: original Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T225148Z-apply-push-dc1f97 Patch-SHA256: 3f59b7252e7ae3b3e0c7894ec551f7e1811d1811f7ed285ef585232bb740fddb

A composite action cannot read vars (GitHub refuses the template: 'Unrecognized named-value: vars', PR#8 run 33568333825), so the calling step passes env TERM_WALL from vars.TERM_WALL and the action refuses when it did not. Same for the self-test's planted fault. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY

The pinned wire: one summary line on a clean run, one `<surface>: <location>: <line>` per hit with the location never carrying a colon, four refusal classes. The pattern now arrives from the calling step (`env: TERM_WALL: ${{ vars.TERM_WALL }}`) because the runner refuses `vars` inside a composite action; the action refuses when the step passed nothing. ci.yml passes it. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230235Z-apply-push-4be45d Patch-SHA256: c8606262ab7780275c529792f1882bd9c94478fff501ad995d318c286ef7eeb7

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230919Z-apply-push-06b283 Patch-SHA256: 7eb098b1f00ca663978af20a1f5ec92c9645ba363405dab7326f696e5b14441b

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230927Z-apply-push-a3666b Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230949Z-apply-push-c1566b Patch-SHA256: 9f7300089b57e722772a526f33521eadef2b4a5f1a60f0488375c59343486831

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T231003Z-apply-push-db7712 Patch-SHA256: 35bebcb925860d46a10042fcd31e8877c9a1208df74397d30dbda1672a7e2728

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230927Z-apply-push-a3666b Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230943Z-apply-push-7fbc6a Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230949Z-apply-push-c1566b Patch-SHA256: 9f7300089b57e722772a526f33521eadef2b4a5f1a60f0488375c59343486831

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230938Z-apply-push-37f496 Patch-SHA256: b4531359ae7de13e8c3971798360d09faad4bb1369d9460ef9d09472c51e51e7

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230919Z-apply-push-06b283 Patch-SHA256: 7eb098b1f00ca663978af20a1f5ec92c9645ba363405dab7326f696e5b14441b

Add the organisation's term wall to the `ci` job, right after checkout, pinned to the commit under review in minspec/.github#8. The step reads its pattern from the repository variable TERM_WALL and refuses when that is unset, so an unconfigured repository fails instead of passing. Source: original Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012Jj94rkp3tfHAxUkTCthgY Apply-Push-Job: 20260901T230933Z-apply-push-0f6370 Patch-SHA256: 0d9aa35bda8397899809cd755995161542086025a803d40448a8e8df2458cce6

xormania and others added 6 commits September 1, 2026 18:21

xor-machine marked this pull request as ready for review September 1, 2026 23:06

xor-machine requested a review from xormania as a code owner September 1, 2026 23:06

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/skeleton#12

Merged

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/workbench-fixtures#7

Merged

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/recipes#9

Merged

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/discussions#7

Merged

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/docker#7

Merged

xor-machine mentioned this pull request Sep 1, 2026

repo: run the term wall in CI minspec/minspec#7

Merged

xor-machine merged commit 8411021 into dev Sep 1, 2026
1 check passed

xor-machine deleted the repo/term-wall branch September 1, 2026 23:12

Navigation Menu

Uh oh!

repo: the term wall — names this organisation does not use, refused in CI - #8

repo: the term wall — names this organisation does not use, refused in CI#8
xor-machine merged 6 commits into
devfrom
repo/term-wall

xor-machine commented Sep 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

xor-machine commented Sep 1, 2026

What

Evidence

Rollout

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants