chore: remove nested duplicate trees

[hyperpolymath]

Summary

This removes two tracked duplicate trees, each nested inside the directory it copies: verification/verification/ and www/.well-known/.well-known/. The removal was first part of the licence PR #74. It moved here so that #74 contains only the licence change and stays under CodeRabbit's 100-file review limit.

The two PRs change no file in common, so they can merge in either order.

Changes

• Deleted verification/verification/ (28 files), a copy of verification/.
• Deleted www/.well-known/.well-known/ (3 files), a copy of www/.well-known/.
• Nothing else changes.

30 of the 31 files match their outer copy line for line, apart from SPDX and copyright lines. 15 of them carry the retired PMPL header. The 31st, verification/verification/README.adoc, also has a title line, = Verification Pillar. #74 adds that title and the copyright line to the outer verification/README.adoc. If this PR merges first, the outer README simply lacks the title until #74 lands; no content is lost.

📌 New pins

• Head SHA: 31fd364ba67f7497c715599b47cbb518357c76bb
• None. No action uses:, actions.lock, lockfile or container digest is added or changed.

RSR Quality Checklist

Required

• Tests pass: n/a. Only duplicate copies are deleted; no source, proof or test that is built or run changes.
• Code is formatted: n/a, nothing is added.
• Linter is clean: no file is added or edited.
• No banned language patterns: nothing is added.
• No unsafe blocks: n/a, no Rust changed.
• No banned functions: n/a, no source or proofs added.
• SPDX license headers: n/a, the PR only deletes files.
• No secrets or credentials.

As Applicable

• .machine_readable/*.a2ml updated: no. A2ML is retired. 9 of the deleted files are .a2ml duplicates (verification/verification/0.1-AI-MANIFEST.a2ml and one 0.2-AI-MANIFEST.a2ml in each of its 8 subdirectories). Their outer copies are unchanged.
• Documentation updated: n/a, no document refers to the deleted paths except the signed historical record below.
• TOPOLOGY.md: n/a.
• CHANGELOG: not updated, since only duplicates are removed.
• New dependencies: none.
• ABI/FFI: n/a.

Testing

• Each deleted file was compared with its outer copy, ignoring SPDX lines, copyright lines and bare <!-- / --> lines. Result: 30 files have no difference. verification/verification/README.adoc differs only by its title line, which is described above.
  • Positive control: a copy of verification/verification/proofs/0.2-AI-MANIFEST.a2ml with one planted line reported 1 differing line.
  • Limit: the comparison is line-based. It shows that the outer copy keeps every non-licence line of the inner one. It says nothing about which licence header is correct, which is chore(licence): MPL-2.0 for code, CC-BY-SA-4.0 for prose #74's subject.
• No dangling references: git grep -nE 'verification/verification|\.well-known/\.well-known' origin/main matches only docs/AFFIRMATION.adoc:213-214, the signed affirmation that records this duplicate. It is left unchanged.
• No overlap with chore(licence): MPL-2.0 for code, CC-BY-SA-4.0 for prose #74: comm -12 of the two PRs' file lists is empty.

Red checks on this head

• governance / Actions lockfile verify is red on main (589e1be) as well. It is fixed by ci: restore block YAML so the actions-lock gate can read the pins #73 together with fix(governance): make the actions-lock ledger reachable under bash -e standards#1209, and this PR does not touch it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GpUzjdhWFi26k6s7AWxYcf

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 01ae8eb3-de67-4e02-9021-fbebbbedf50f

📥 Commits

Reviewing files that changed from the base of the PR and between 589e1be and 31fd364.

📒 Files selected for processing (31)

• verification/verification/0.1-AI-MANIFEST.a2ml
• verification/verification/README.adoc
• verification/verification/benchmarks/0.2-AI-MANIFEST.a2ml
• verification/verification/benchmarks/README.adoc
• verification/verification/coverage/0.2-AI-MANIFEST.a2ml
• verification/verification/coverage/README.adoc
• verification/verification/fuzzing/0.2-AI-MANIFEST.a2ml
• verification/verification/fuzzing/README.adoc
• verification/verification/proofs/0.2-AI-MANIFEST.a2ml
• verification/verification/proofs/README.adoc
• verification/verification/proofs/agda/Properties.agda
• verification/verification/proofs/coq/TypeSafety.v
• verification/verification/proofs/idris2/ABI/Compliance.idr
• verification/verification/proofs/idris2/ABI/Foreign.idr
• verification/verification/proofs/idris2/ABI/Layout.idr
• verification/verification/proofs/idris2/ABI/Platform.idr
• verification/verification/proofs/idris2/ABI/Pointers.idr
• verification/verification/proofs/idris2/Types.idr
• verification/verification/proofs/lean4/ApiTypes.lean
• verification/verification/proofs/tlaplus/StateMachine.tla
• verification/verification/safety_case/0.2-AI-MANIFEST.a2ml
• verification/verification/safety_case/README.adoc
• verification/verification/simulations/0.2-AI-MANIFEST.a2ml
• verification/verification/simulations/README.adoc
• verification/verification/tests/0.2-AI-MANIFEST.a2ml
• verification/verification/tests/README.adoc
• verification/verification/traceability/0.2-AI-MANIFEST.a2ml
• verification/verification/traceability/README.adoc
• www/.well-known/.well-known/ai.txt
• www/.well-known/.well-known/humans.txt
• www/.well-known/.well-known/security.txt

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 59 issues detected

Severity	Count
🔴 Critical	6
🟠 High	26
🟡 Medium	27

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "scorecard.yml delegates to hyperpolymath/standards `scorecard-reusable.yml` but the file does not declare `security-events: write`. Reusable called-workflow permissions are CAPPED by the caller's grants; the reusable's own job-level grant cannot exceed what the caller provides. Result: ossf/scorecard-action cannot upload SARIF and the run fails with `startup_failure` (no logs, no findings). Add `permissions: {security-events: write, id-token: write}` at the job level (preferred) or workflow level.",
    "type": "scorecard_wrapper_missing_job_permissions",
    "file": ".github/workflows/scorecard.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "high",
    "fix_recipe": "add_job_level_scorecard_perms"
  },
  {
    "line": 38,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 82,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 52,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 33,
    "reason": "workflow .github/workflows/labels.yml:33 job `sync` has no `timeout-minutes:` — defaults to 360 min on hang",
    "type": "WH006",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "medium"
  },
  {
    "line": 47,
    "reason": "workflow .github/workflows/label-triage.yml:47 job `triage` has no `timeout-minutes:` — defaults to 360 min on hang",
    "type": "WH006",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "medium"
  },
  {
    "line": null,
    "reason": "workflow .github/workflows/hypatia-scan.yml uploads SARIF to code scanning but masks the scanner's failure (`|| true` / `|| echo 0`) and never asserts the findings artefact is a non-empty array. When the scanner fails, this uploads a SARIF with zero results, and GitHub AUTO-CLOSES every previously-open alert for that category — silently, with the job green.",
    "type": "WH014",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence