One of the four checks protecting master was an echo

.github/workflows/check-now-freshness.yml

@@ -13,8 +13,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
-      - name: Check freshness
-        run: |
-          # Add freshness check logic here in future
-          echo "Checking repository freshness..."
+      # This job's name, `check`, is one of four required by the
+      # t27-master-protection ruleset. Its only step used to be
+      #
+      #     # Add freshness check logic here in future
+      #     echo "Checking repository freshness..."
+      #
+      # so one of the four gates protecting master asserted nothing, and had
+      # passed every pull request it ever ran on. The ruleset is not this
+      # file's to edit, so the job keeps its required name and is given
+      # something real to do.
+      #
+      # NOW Sync Gate already requires that an entry was ADDED; it does not
+      # read it. The two are complementary:
+      #     NOW Sync Gate  ->  "you wrote one"
+      #     this           ->  "what you wrote says something"
+      - name: Negative control
+        run: python3 tools/check_now_entry_shape.py --self-check
+
+      - name: The docs/now/ entry this PR adds must say something
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: python3 tools/check_now_entry_shape.py

docs/now/2026-08-28-one-of-the-four-checks-protecting-master-was-an-echo.md

@@ -0,0 +1,8 @@
+# NOW -- One of the four checks protecting master was an echo (2026-08-28)
+
+## One of the four checks protecting master was an echo (Refs #2754)
+
+- t27-master-protection requires check-now-freshness, validate, check, check-linked-issue -- and the job named `check` ran one step: echo, with a comment saying add logic here in future
+- it passed every pull request it ever ran on, and its green meant nothing
+- the ruleset is not mine to edit, so the job keeps its required name and now asserts that the docs/now entry a PR adds is well formed -- which NOW Sync Gate, which only checks that one was added, does not read
+- zero entries is a FAILURE here, not a pass: a check that reports success over an empty set is the shape being replaced

proofs/lean4/.trinity/seals/coder_igla-coder-arch.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:27f7e12ea1ab7b143531a411ccb3e0db1d62be92134f3315988594aa767e2344",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/arch.t27"
-}
+  "spec_path": "specs/igla/coder/arch.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-bench-proxy.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:ce043dc4d90da4e1a979d75e248f85f218c3a035ebf3018c83faeee51c2218db",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/bench_proxy.t27"
-}
+  "spec_path": "specs/igla/coder/bench_proxy.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-benchmark.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:afce874ad5ea6d926adecae1bc996369d3f5aa96df1e9351517a993db8b333b2",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/benchmark.t27"
-}
+  "spec_path": "specs/igla/coder/benchmark.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-dataset.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:f6577284f166b60ee93dc4cf5a199e9db5c7024e90958d888da573f2fe0272e7",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/dataset.t27"
-}
+  "spec_path": "specs/igla/coder/dataset.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-eval.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:e476f20c37723ae197b73a5d40bd767bb6924a1a1dd5f32e84ab243529cc8afd",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/eval.t27"
-}
+  "spec_path": "specs/igla/coder/eval.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-pipeline.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:df8eeb58a4866d76d9372221a73cbc7d52244e568601e04effe8ab8952d8df34",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/pipeline.t27"
-}
+  "spec_path": "specs/igla/coder/pipeline.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-prm.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:3000719354d4a3cc9992502860a0a4f1ea2570c4ebb4952afc77d9ba9fa8c0ea",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/prm.t27"
-}
+  "spec_path": "specs/igla/coder/prm.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-tokenizer.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:a082bceb80b41d6207340fb74d39e61b10de5d88dae7047b629b03adc2cf3fe6",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/tokenizer.t27"
-}
+  "spec_path": "specs/igla/coder/tokenizer.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-training.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:b6af78e0d33e9602cb98e00de6c18ee6068b624af4dc0d0b925e3284f1d07280",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/training.t27"
-}
+  "spec_path": "specs/igla/coder/training.t27"
+}

proofs/lean4/.trinity/seals/coder_igla-coder-weights.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:bc792f4def7a9cbc149706e8f0df32eca7e7f07b00ff726881da4c1b3c5b1326",
-  "spec_path": "/Users/playra/t27/specs/igla/coder/weights.t27"
-}
+  "spec_path": "specs/igla/coder/weights.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-adder-tree.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:f357b3492de44f19257be21e9d5a75405e595e27d1f70a923538e6d065d7490b",
-  "spec_path": "/Users/playra/t27/specs/igla/race/adder_tree.t27"
-}
+  "spec_path": "specs/igla/race/adder_tree.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-backend.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:1b46e3170c8fa50ca98145dd6791c16c85f9d3688678982ac213e39522620129",
-  "spec_path": "/Users/playra/t27/specs/igla/race/backend.t27"
-}
+  "spec_path": "specs/igla/race/backend.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-bram-weights.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:a15d813aa989904c22ed27ea4849db3f61165c6f8f239cb547e97468602d3795",
-  "spec_path": "/Users/playra/t27/specs/igla/race/bram_weights.t27"
-}
+  "spec_path": "specs/igla/race/bram_weights.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-cordic-fixed.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:08e4b454cd08143b5f79ac7da87c31536c5a528bffd448ccc8832887bbd30b9e",
-  "spec_path": "/Users/playra/t27/specs/igla/race/cordic_fixed.t27"
-}
+  "spec_path": "specs/igla/race/cordic_fixed.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-cordic-top.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:e1fe99a177a63e2d7ac365bd3e3d068b0a9380759aac5d9f03b185be66c0ceb7",
-  "spec_path": "/Users/playra/t27/specs/igla/race/cordic_top.t27"
-}
+  "spec_path": "specs/igla/race/cordic_top.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-cordic.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:dee80f800e7efb377e3383e20771609f7d5c88c9ce9e0193e805634863243eab",
-  "spec_path": "/Users/playra/t27/specs/igla/race/cordic.t27"
-}
+  "spec_path": "specs/igla/race/cordic.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-eda.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:c01f0dc9d0c38f565e301ee40a21286f30331ab738ed7f82a5c924123cce25cd",
-  "spec_path": "/Users/playra/t27/specs/igla/race/eda.t27"
-}
+  "spec_path": "specs/igla/race/eda.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-formal.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:22Z",
   "spec_hash": "sha256:f1da7838010c0a72c70e64fd37c642c66fca4bba0285268151d7dc865f12f4aa",
-  "spec_path": "/Users/playra/t27/specs/igla/race/formal.t27"
-}
+  "spec_path": "specs/igla/race/formal.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-gemm.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:d25ab7cbd58320b007f12d8b3f0fc2274c1e72745d8a9ad5c9678a2bddb8a4e3",
-  "spec_path": "/Users/playra/t27/specs/igla/race/gemm.t27"
-}
+  "spec_path": "specs/igla/race/gemm.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-opcodes.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:a16d4c6eaa9b2d1c6666e3936ec1c5e0f1b46fb3daf782d16bfd00c8ce0c5af9",
-  "spec_path": "/Users/playra/t27/specs/igla/race/opcodes.t27"
-}
+  "spec_path": "specs/igla/race/opcodes.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-rtl.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:326abce4a3a4ac58ec106f2914aeb7c57fc9b713a1a3ca7fa0e95194cf6cd8bf",
-  "spec_path": "/Users/playra/t27/specs/igla/race/rtl.t27"
-}
+  "spec_path": "specs/igla/race/rtl.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-systolic-array.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:c784bd6931791d71f90cf3e33ffbfe8dfe7ae8aa1063ae41eb2fe5aadda3438a",
-  "spec_path": "/Users/playra/t27/specs/igla/race/systolic_array.t27"
-}
+  "spec_path": "specs/igla/race/systolic_array.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-systolic-ternary.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:e6a1833428296a3803979e69c0ba3c86414627071a645feb48a9a7b928be6499",
-  "spec_path": "/Users/playra/t27/specs/igla/race/systolic_ternary.t27"
-}
+  "spec_path": "specs/igla/race/systolic_ternary.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-ternary-gemm.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:d950b7e77d15124102b3ba2b99d42324c528db7f76361c04458a2afe3febd2a8",
-  "spec_path": "/Users/playra/t27/specs/igla/race/ternary_gemm.t27"
-}
+  "spec_path": "specs/igla/race/ternary_gemm.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-ternary-inference.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:588d9d16edb5b9defbf6f3a9aab83b780e380f3ccaf21a5305fb4a44e39db7d5",
-  "spec_path": "/Users/playra/t27/specs/igla/race/ternary_inference.t27"
-}
+  "spec_path": "specs/igla/race/ternary_inference.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-ternary-mac.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:5b7da1ecbdd319447a4731d0aa400783ee388b9cc0d4cb73865003486d49dd2a",
-  "spec_path": "/Users/playra/t27/specs/igla/race/ternary_mac.t27"
-}
+  "spec_path": "specs/igla/race/ternary_mac.t27"
+}

proofs/lean4/.trinity/seals/race_igla-race-yosys.json

@@ -7,5 +7,5 @@
   "ring": 12,
   "sealed_at": "2026-06-23T07:33:23Z",
   "spec_hash": "sha256:0bc486f8ed0079fbcd856bc41564797e73b614ee9b7e0a5c03a7986a1b5f24a5",
-  "spec_path": "/Users/playra/t27/specs/igla/race/yosys.t27"
-}
+  "spec_path": "specs/igla/race/yosys.t27"
+}

scripts/fix_v09_latex.py

@@ -59,7 +59,7 @@ def fix_latex(content):
     return content
 
 # Read original file
-with open('/Users/playra/t27/research/trinity-pellis-paper/G2_ALPHA_S_PHI_FRAMEWORK_V0.9.tex', 'r') as f:
+with open(str(ROOT / "research/trinity-pellis-paper/G2_ALPHA_S_PHI_FRAMEWORK_V0.9.tex"), 'r') as f:
     original = f.read()
 
 # Apply fixes

scripts/gen_w367_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w368_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w369_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w370_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w371_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w372_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"
 
 

scripts/gen_w373_lean.py

@@ -3,7 +3,13 @@
 
 from pathlib import Path
 
-ROOT = Path("/Users/playra/t27")
+# The repository root, derived from where this file sits, not from the
+# machine it was written on. This was an absolute path into one
+# developer's home directory, so it could run for exactly one person --
+# and the secret-scan gate rejects that path, which is how it was found.
+# (The old literal is deliberately not quoted here: a comment naming it
+# trips the same gate.)
+ROOT = Path(__file__).resolve().parent.parent
 LEAN_FILE = ROOT / "proofs" / "lean4" / "Trinity" / "TernaryInference.lean"