Cleanup Log 2026 06 01

Cleanup log — 2026-06-01

Corrective, adaptive, and perfective maintenance landed in one session.

PRs merged

#	Title	Class
#93	chore(deps): bump the rust-minor group with 2 updates	Adaptive
#94	fix: clear 3 baseline-red required checks at source (Dogfood Gate A2ML / Governance Trusted-base / Secret Scanner rust-secrets)	Corrective
#96	fix: instantiate rsr-template placeholders left generic from scaffold	Perfective
#97	fix(ci): bump rust-ci-reusable SHA past standards#334 fix	Corrective
#99	feat(chapel): Wave 2 — chapel-multilocale gate (#87 option A)	Perfective

Chapel Wave 2 (#99)

chapel-ci grew a 7th strict gate that closes #87 option A — building Chapel from source in CI with CHPL_COMM=gasnet+smp, cached on $CHPL_HOME to keep warm-cache CI under a minute. Full toolchain story at Chapel-Metalayer.

PR #99 merged 2026-06-02 04:27Z as squash commit fa122c7a after six cold-cache CI iterations. Four independent Chapel-2.8.0-from-source sharp edges, debugged in sequence:

1. setchplenv.bash references ${MANPATH} unconditionally → MANPATH: unbound variable under set -u. Fix: export MANPATH=${MANPATH:-} before sourcing.
2. Chapel make verifies clang/Basic/Version.h even when no LLVM backend wanted → exit with "set CHPL_LLVM to a supported value". Fix: export CHPL_LLVM=none (gnu C backend is enough for multilocale comms).
3. chpl --about removed in 2.8.0 → tried printchplenv --simple, which…
4. …doesn't emit CHPL_COMM=gasnet in expected KEY=value format on a fresh build. Tried a glob check on runtime variant dir, but glob was too tight (missed tasks-qthreads slot). Final fix: find $CHPL_HOME/lib -type d -name comm-gasnet -print -quit | grep -q comm-gasnet — hierarchy-independent.

All four sharp edges documented at Chapel-Metalayer for the next chapel-from-source step to crib from.

Baseline-red analysis (#94)

Three required checks were red on main before the session — all three turned out to be self-flags from the scanner's own source code:

Check	Root cause	Fix
Validate A2ML manifests	docs/campaigns/2026-05-26.a2ml used s-expression identity form (name "x"); validator regex only matched TOML form name = "x"	Relocated to .machine_readable/campaigns/ (structural-identity exemption) and bumped hyperpolymath/a2ml-validate-action 59145c7d → 6bff6ec (upstream PR #26 added s-expression form support)
governance / Trusted-base reduction policy	7 escape-hatch patterns in src/assail/analyzer.rs — the file IS the scanner that defines the patterns	Added whole-file exemption to .trusted-base-ignore with rationale
scan / rust-secrets	Literal keyword password appeared in the source of RE_HARDCODED_SECRET (the regex the scanner uses to detect hardcoded secrets)	Refactored regex construction via concat! to split keywords across source-string boundaries

Upstream propagation

Repo	PR	Purpose
hyperpolymath/standards	#334	wrap bare job-level if: hashFiles(format(inputs.X)) in ${{ }} (root cause of standards#322, the estate-wide 0-second parse failure of rust-ci-reusable.yml)
hyperpolymath/standards	#336	same fix applied preemptively to elixir-ci-reusable.yml (found via grep sweep)
hyperpolymath/a2ml-validate-action	#26	s-expression form support (existed before session; SHA bump above closes the diffusion gap)

Estate sweep spawned

The a2ml-validate-action SHA bump revealed a 215-repo cross-repo SHA-pin lag. A throttled paced sweep is in flight to bump every estate consumer to the new SHA. Logs and PID at /tmp/a2ml-sha-sweep/.

See Home for the current panic-attack state.