Skip to content

HISS Compliance Matrix

The High-Integrity Systems Standard (HISS) defines 21 invariants, HISS-01 through HISS-21. This matrix lists each one for cordanaLLM/praetor: its enforcement, its failure action, and whether this repository's AGENTS.md gates it (HISS-Invariants shows the gated rules). The rows come from the core HISS rule catalog, the registry the standards_explain_rule MCP tool serves. The Enforcement column describes the checks praetor's own repository runs; an adopted repository runs the checks its adoption generates.

Invariant Title Gated Enforcement Failure action
HISS-01 Control Flow - Acyclic DAG Control Flow yes The internal/hiss scanner, deciding a subset per language. Go: goto, direct recursion, and mutual or indirect recursion between plain functions (a cycle through methods is not decided). Rust, Python, JavaScript, TypeScript, Svelte and shell: direct recursion only, shell including the run: blocks of GitHub Actions workflows. C and C++: goto only, less the single-level forward cleanup gotos a declared hiss.exceptions.c_goto_cleanup accepts (hiss.CleanupGoto). Each claim replays against .config/hiss/coverage.yaml via 'praetorctl hiss coverage --verify'. Immediate build failure.
HISS-02 Loops & I/O - Bounded Loops & Mandatory I/O Timeouts yes The internal/hiss scanner, deciding a subset per language. Go: a for statement without a condition, a context without a deadline reaching a call except in four accepted shapes (lifecycle-owned, log/slog and channel sinks, a same-module callee that bounds it, an allow-listed third-party constructor at a checked version), and the context-less exec.Command, net.Dial and http.Get families, outside tests and main.main. Rust, Python, C, JavaScript, TypeScript and Svelte: unbounded loop shapes only. Shell, including the run: blocks of GitHub Actions workflows: unbounded loop shapes and a curl transfer without --max-time. systemd units: a oneshot service without a start timeout, a disabled timeout, and a restarting service without a start rate limit. Each claim replays against .config/hiss/coverage.yaml via 'praetorctl hiss coverage --verify'. Pre-commit and CI blocker.
HISS-03 Zero Frame Malloc no NOT ENFORCED. No allocation benchmark gate exists in this repository. None today; the rule is advisory until a check is attached.
HISS-04 Complexity Bounds & Modular Sizing yes gocyclo, gocognit and funlen via golangci-lint (.golangci.yml) at its configured thresholds; the HISS scanner enforces function length and measures cyclomatic, cognitive and statement counts without enforcing them, the measurement standards_inspect_symbols and standards-lsp share. Build sweep blocker.
HISS-05 Variable Scoping no NOT ENFORCED. No executable check exists in this repository, and no configured linter decides this rule. None today; the rule is advisory until a check is attached.
HISS-06 Bounded Concurrency no NOT ENFORCED for the axiom. The race detector cannot observe an unbounded pool: a lock-order inversion or an unbounded but race-free fan-out produces no data race. 'go test -race' runs, but it does not decide this rule. None today; the rule is advisory until a check is attached.
HISS-07 Checked Errors & Zero Unwrap yes golangci-lint (errcheck and wrapping rules) in make lint. Compiler / linter error.
HISS-08 Static Determinism & Banned Functions no Semgrep rules. Admission rejection.
HISS-09 Reference Safety & Mandatory Safety Proofs no AST check. Immediate AST check rejection.
HISS-10 5-Layer Zero-Warnings Cascade yes go vet and golangci-lint in make lint; any finding fails the run. Exit code 1.
HISS-11 Hermetic Supply Chain no CI attestation gate. Deployment rejection.
HISS-12 Secret Leak Prevention no 'make secrets' runs gitleaks over repository history inside verify-all. Verification gate rejection.
HISS-13 Monotonic Debt Ratchet no 'praetorctl baseline' and the gate's HISS stage, evaluated against .standards-baseline.json. The scan feeding it refuses to certify a scope it did not fully examine. PR status gate rejection.
HISS-14 Append-Only ABI & Migration Footers no praetorctl forge check-commits in CI, over every commit of a pull request, and praetorctl forge check-message in a commit-msg hook reject a breaking-change marker without a Migration: footer, whatever the language, and a subject that is not a Conventional Commits subject (build, chore, ci, docs, feat, fix, perf, refactor, revert, style or test, an optional scope and !) or one git wrote for a merge or a revert. Where api:public-contract is declared and git tracks a go.mod, the Go API Compatibility workflow (.github/workflows/praetor-api.yml) runs tools/apicompat/gate/main.go, which compares the exported API of every Go module with the base using go-apidiff: before a v1 root release tag it reports an incompatible change, from v1 on it rejects one, and a comparison that did not run fails. No other language's API is compared. PR blocker.
HISS-15 3D Test Discipline yes CI coverage gate (go test -race -coverprofile with a minimum statement-coverage floor enforced by 'go tool cover') and PR checklist validation of the 3D test attestation. Merge gate rejection.
HISS-16 Canonical AGENTS.md & Server Gates yes Pre-commit blocker, server-side admission. Merge blocker.
HISS-17 State Ledger Discipline yes Pre-commit state-sync hook and the CI / pre-push state audit. Pre-commit / CI gate rejection.
HISS-18 CI Efficiency yes CI filter step exporting run_* outputs that every heavy gate's condition consumes. CI optimization gate.
HISS-19 Reuse Before Writing yes 'praetorctl dedupe scan .' function-level clone and utility-sprawl detection, run by 'make dedupe' inside verify-all. Verification gate rejection.
HISS-20 Replayable Enforcement Evidence yes 'praetorctl hiss coverage --verify', run inside verify-all against '.config/hiss/coverage.yaml'. Verification gate rejection.
HISS-21 Platform Neutrality yes Platform Neutrality matrix in CI. Verification gate rejection.

Pull Request Admission

Every pull request is admitted by standardsctl forge validate-pr, which requires all three of the following in the PR description:

  1. A checked HISS-16 context-integrity box.
  2. A checked HISS-15 3D-testing box.
  3. A fenced ```receipt (or ~~~receipt) block carrying the .standards-receipt.json envelope produced by praetorctl gate run. The block is parsed as JSON, its Ed25519 signature is verified against receipt.public_key pinned in .standards.yaml, its recorded output hash is checked against the gate output it carries, that gate output must open with praetor-gate-output/v2, and its commit_sha must equal the pull request head. Prose, a bare code block, or the words "Exit-0 Receipt" satisfy nothing. A receipt minted before v2 is refused, because its stage lines recorded skipped stages as passed.

A checked box is a task-list item (- [x], * [x], 1. [x]); a [x] quoted mid-sentence or inside a code fence is not counted. A description that ends inside an unclosed fence is rejected, because everything after the opening delimiter renders as code. The rules live in internal/forge/pr.go and are pinned by internal/forge/pr_template_test.go.

The Verification Ladder

Four verification tiers from editor LSP to git hooks, local gate stages, and CI PR admission re-checking Exit-0 receipts.
Verification ladder
Text description
  • Local Workstation: 1. Editor LSP (cmd/standards-lsp), Blocked locally (commit or push refused), 2. Git Hooks (lefthook pre-commit & pre-push), Signing Key (env var or key file), 3. Gate Pipeline (6 stages in internal/gating), .standards-receipt.json (Exit-0 receipt).
  • Remote CI & Admission: Pull Request (checklist & ```receipt block), 4. CI Re-check (standardsctl forge validate-pr), Admitted (PR check passes), Rejected (validate-pr exits 1).
  • 1. Editor LSP → 2. Git Hooks (save / stage) → 3. Gate Pipeline (commit / push).
  • Signing Key → 3. Gate Pipeline (LoadSigningKey) → .standards-receipt.json (signed v2) → Pull Request (fenced in body) → 4. CI Re-check (validate-pr) → Admitted (valid receipt).
  • 2. Git Hooks → Blocked locally (hook exit 1).
  • 4. CI Re-check → Rejected (receipt invalid).
  • Scenario 1, clean change -> admitted: A clean change passes all four tiers and is admitted by CI. Editor LSP reports zero diagnostics as code is written. Pre-commit and pre-push hooks run local checks and linters. Gate runs 6 stages; Ed25519 signing key is loaded. Stage output signed; .standards-receipt.json minted for HEAD commit. PR is opened with checked HISS boxes and fenced receipt block. CI runs standardsctl forge validate-pr on the PR description. Signature, clean worktree, and head SHA match: PR is admitted.
  • Scenario 2, a hook blocks locally: A local hook blocks commit or push before CI runs. Change introduces an error or invariant violation. Lefthook pre-commit or pre-push hook rejects the change locally.
  • Scenario 3, CI rejects invalid receipt: CI rejects a pull request with a missing or invalid receipt. Code is edited and committed. Local checks pass. PR submitted with missing, unpinned, or mismatched receipt. CI step runs standardsctl forge validate-pr. Receipt verification fails: commit mismatch, dirty tree, or missing block.
  • Verification escalates through four tiers: real-time editor diagnostics, local git hooks, the six-stage gate pipeline, and CI PR admission.

Tier 4, the CI re-check, is the "Validate PR Governance Checklist & Exit-0 Receipts" step in .github/workflows/ci.yml, which runs standardsctl forge validate-pr as described under Pull Request Admission. Adopter CI runs the checks: .config/github-app/manifest.json specifies an example app but nothing provisions it, and internal/forge/pr.go requests a review bot.