Run the real A2ML/K9 validators; fix a startup_failure in boj-build.yml

[hyperpolymath]

Follow-up to #58, which merged while these were in flight.

1. Both dogfood validators pointed at repositories that do not exist

##[error]Unable to resolve action hyperpolymath/k9-validate-action,
         repository not found

gh api returns 404 for both hyperpolymath/k9-validate-action and hyperpolymath/a2ml-validate-action. Neither has ever existed, so neither job has ever validated anything — both failed at Set up job, pinned to a SHA in a repository that isn't there.

The canonical implementations are RSR template files. Installed from rsr-template-repo origin/main (byte-identical to the copies lithoglyph already carries) and wired in directly — they take the same INPUT_PATH/INPUT_STRICT interface the actions were passed.

validator	result
A2ML	0 errors, 3 warnings → pass
K9	1 error → a real finding, see below

2. The K9 error was a validator limitation, not a bad file

verisimdb/connectors/test-infra/deploy.k9.ncl:1
Pedigree block missing 'name' field

The file is correct. It builds the pedigree separately and attaches it:

let component_pedigree = {
  metadata = { name = "verisimdb-test-infra", version = "0.1.0", ... },
} in
{ pedigree = component_pedigree, ... }

The validator is line-oriented: it starts brace-counting at pedigree = ..., but pedigree = component_pedigree, carries no brace, so depth never rises, the block reads as empty and name is invisible.

Rewriting the file to satisfy a grep would have been the wrong direction — and especially here: this is a Hunt-level component that spawns seven database containers and binds eleven ports. It's the last file to restructure casually.

So the validator now resolves a one-hop let indirection. Proved it fixes the scanner rather than blinding it:

name present	0 errors, exit 0
name removed	Pedigree block missing 'name' field, exit 1

One hop only — chasing aliases needs a real evaluator, and nickel typecheck is unavailable because the mandatory K9! magic line isn't valid Nickel. Belongs upstream in rsr-template-repo; the same fix is applied to lithoglyph's copy in its PR #9 so the two stay identical (02845a4c).

3. boj-build.yml used secrets in a job-level if: — startup_failure

Every push produced a 0-second failed run named after the file path rather than the workflow's name:, with no jobs and no check run.

if: ${{ vars.BOJ_SERVER_URL != '' || secrets.BOJ_SERVER_URL != '' }}

secrets is not available in a job-level conditional — GitHub exposes that context only in env:, with: and step-level expressions. The file is valid YAML (yaml.safe_load parses it happily), so nothing local caught it and the workflow linter didn't either. Actions rejected the whole file at load time.

Pre-existing on main, not introduced by #58.

The guard was redundant as well as fatal — the step already does if [ -z "$BOJ_URL" ]; then … exit 0, and resolves the secret in env: where that context is legal. The workflow's own header calls it "a no-op if BOJ_SERVER_URL is not set"; now it actually is one.

4. verisimdb/playground/package.json removed

deno.json sits beside it carrying every task and dependency, with node build.mjs correctly rewritten to deno run -A build.mjs. Nothing references the package.json. npm manifests are banned estate-wide.

Verification

Check	Result
validate-a2ml.sh	PASS (was: job never ran)
validate-k9.sh	PASS (was: job never ran)
K9 still fails on a real fault	exit 1 ✅
boj-build.yml parses + no secrets in job if:	PASS
Actions resolving	all
package.json / .ts / .tsx	0 / 0 / 0

Still red, and honestly so

Language / package anti-pattern policy — 44 .res files remain: verisimdb/ (40) and typeql-experimental/ (4). Both are legacy directories awaiting the same extraction lithoglyph/ just completed, and porting their ReScript is the AffineScript migration proper, blocked upstream on affinescript#56.

#58 already took that count from 140 → 44 by removing the duplicated Lithoglyph tree. The gate is correct; the work it asks for is a project, not a fix.

🤖 Generated with Claude Code