fix(validate-action): exclude non-pedigree files from K9 checks

[hyperpolymath]

Summary

validate-action currently treats every *.k9/*.k9.ncl file as a K9
pedigree contract and demands the K9! magic line + pedigree = {...}
block. Two file families that share the extension by estate convention
are not pedigree contracts and were never meant to satisfy that schema:

• coordination.k9 / session/custom-checks.k9 — the estate-standard
  session-management coordination bindings (plain YAML, ~40 repos, see
  session/README.md in any repo that has them).
• self-validating/methodology-guard.k9.ncl — a K9 validator
  definition (methodology-constraint rules), not a target pedigree
  file — see its own header comment.

This is currently producing 6 of the 8 "Validate K9 contracts" errors
blocking open PRs in bitfuckit, contractiles, recon-silly-ation,
and (on main) stateful-artefacts.

Change

Adds the three path fragments to validate-action's default
paths-ignore, matching the existing pattern from
hyperpolymath/hypatia#243 (a validator must distinguish its target from
a file that legitimately contains the pattern being checked, just for a
different flavour of false positive: wrong schema entirely rather than
a fixture/vendored copy).

Test plan

• bash validate-action/validate-k9.sh against bitfuckit,
  contractiles, recon-silly-ation, stateful-artefacts locally with
  the new default: errors 8→2, 8→2, 8→2, 2→0 respectively (the
  remaining 2 in the first three are a separate, genuine
  container/deploy.k9.ncl content defect fixed directly in each
  of those repos' own PRs).
• Confirmed coordination.k9/session/custom-checks.k9 are
  consistently named/pathed across ~40 estate repos via
  grep -rl '^session_management:' --include='*.k9'.

Wrapper repos pin this action to a commit SHA, so this alone doesn't
unblock anyone — those repos also carry a local paths-ignore
override as a stopgap; the SHA pin can be refreshed to point past this
commit once merged, at which point the local overrides become
redundant (harmless either way).

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gitar-bot]

CI failed: CI failures occurred due to an unresolved external action repository and a git submodule authentication failure when cloning a dependent repository.

Overview

Two distinct dependency-related failures occurred in the CI run: an inability to resolve and download a custom GitHub Action (hyperpolymath/a2ml-validate-action) and a git submodule authentication failure (fatal: could not read Username) while attempting to clone a repository.

Failures

Missing or Inaccessible GitHub Action (confidence: high)

• Type: dependency
• Affected jobs: 90104976531
• Related to change: yes
• Root cause: The workflow references an action 'hyperpolymath/a2ml-validate-action' that either does not exist, has been deleted, or resides in a private repository without proper access permissions.
• Suggested fix: Verify the repository name and owner for 'hyperpolymath/a2ml-validate-action', ensure it is public or accessible with proper credentials, or update the workflow reference.

Git Submodule Authentication Failure (confidence: high)

• Type: dependency
• Affected jobs: 90104976439
• Related to change: unclear
• Root cause: The CI job failed to clone a git submodule because git could not authenticate or read credentials (No such device or address).
• Suggested fix: Configure the workflow with a personal access token (PAT) or deploy key with permissions to access the private submodules, or ensure proper checkout configuration.

Summary

• Change-related failures: 1 failure regarding missing action resolution.
• Infrastructure/flaky failures: 0 infrastructure failures (1 authentication/submodule setup issue).
• Recommended action: Verify repository permissions and access tokens for both the custom GitHub Action and the git submodules referenced in the workflow.

Code Review ✅ Approved 1 resolved / 1 findings

Excludes non-pedigree session and validator files from validate-action checks to prevent false schema validation errors. Consider anchoring the coordination.k9 paths-ignore fragment to avoid unintended over-matching.

Auto-approved: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria.

✅ 1 resolved

✅ Edge Case: Unanchored 'coordination.k9' fragment can over-match real contracts

📄 validate-action/action.yml:70-72
paths-ignore fragments are matched as unanchored substrings (validate-k9.sh:51, [[ "$p" == *"$frag"* ]]). The new coordination.k9 entry therefore also skips any genuine pedigree file whose path merely contains that substring — e.g. network-coordination.k9 or a coordination.k9.ncl variant — silently exempting it from K9 validation. If estate naming guarantees these are always exactly coordination.k9, this is acceptable; otherwise consider anchoring to the basename (e.g. /coordination.k9) to avoid accidental carve-outs. The session/custom-checks.k9 and self-validating/methodology-guard.k9.ncl entries are path-qualified and less prone to this.

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[gitar-bot]

Gitar has auto-approved this PR (configure)