docs: mark AFFIRMATION as agent-authored DRAFT (not owner-affirmed)

[hyperpolymath]

Summary

Marks the AFFIRMATION landed in #69 as an agent-authored DRAFT, not affirmed by the owner. It adds a :status: attribute and a visible [IMPORTANT] block. The owner's rule (dev-notes for-jonathan-todo.adoc §7, 2026-10-07) is that an agent must not sign an affirmation. #69 was committed by an agent with the machine key, so it does not carry the owner's affirmation. Owner chose this correction on 2026-10-07. No claim in the file changes.

Type of change

• 📖 Documentation. Two status lines only.

📌 New pins

Head SHA: dff2f0e. No pins are added or changed.

How has this been verified?

• git diff shows 8 lines added and 0 removed.
• The commit is G (signed). This status-marker commit is agent-signed by design; the owner's affirmation is still to come.
• The standards affirmation-check/check.sh shows the document passes its content checks. Locally, signature verification reports the previous squash commit's GitHub web-flow signature as unverifiable, because the GitHub key is not in the local keyring. Treat that as a limit of the local copy, not a verdict.

Checklist

• My commits are signed.
• No code changed. The only check that bears on this change is the affirmation checker (above).
• SPDX: the existing CC-BY-SA-4.0 header is unchanged.
• No public claim now overstates anything. This PR exists to remove an overstatement.
• No soundness hole introduced.

Notes for reviewers

Next step for the owner: once you have reviewed the file, re-anchor it, then land it with git commit -S and remove the DRAFT lines.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GpUzjdhWFi26k6s7AWxYcf

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e7c89619-8a48-4804-b854-6ae74d8886af

📥 Commits

Reviewing files that changed from the base of the PR and between 1ff2314 and dff2f0e.

📒 Files selected for processing (1)

• docs/AFFIRMATION.adoc

 ______________________________________________________
< CUDA: Carrot Utilization for Debugging Acceleration. >
 ------------------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🔍 Hypatia Security Scan

Findings: 75 issues detected

Severity	Count
🔴 Critical	6
🟠 High	26
🟡 Medium	43

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": ".github/workflows/labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "line": 38,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 82,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 52,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 24,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 44,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 64,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  },
  {
    "line": 84,
    "reason": "job in .github/workflows/mirror.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence