Course code lives here: examples/, and the gates that judge it

[noahgift]

ONE code repo per specialization. A separate paiml/ai-ontology repository was created for the ontology course's worked examples. That was wrong. Both examples move here, and ai-ontology is deleted — not archived — so there is no second place for a reader to look.

example	what it covers
examples/gate-the-write	constraints compiled from an ontology, applied to output the model never saw them with
examples/readme-shacl	a README's own frontmatter, judged by a closed SHACL shape it cannot see (lesson 1.2.4)

gate-the-write is refactored on the way in

check was grade B at cognitive complexity 15 — one match holding three rule bodies. It is now one function per rule kind behind a filter_map, so adding a rule adds a function rather than a branch; compile and main split the same way. Behaviour unchanged and proven: all three exit codes still fire (0 clean, 1 violation, 2 cannot run), an empty ontology is still refused rather than passed, 4/4 tests green.

What now gates this repo

make check = lint shell test examples supply-chain contexts, and the required gate context runs it. Each half is falsifiable:

• scripts/check-examples.awk cross-checks every example against the example.toml beside it. --self-test makes it judge 7 deliberately broken trees first — including one with no examples at all — because a checker like this fails by going quietly blind. 7/7.
• deny.toml states a supply-chain policy and cargo deny check runs it for every example, inside the required check. Licences allowed exactly as encountered (MIT, Apache-2.0): a permission nobody uses is a permission nobody reviewed.
• scripts/check-required-contexts.sh re-verifies .github/required-status-checks.txt against the live org ruleset. Falsified — adding a bogus context reds it. It SKIPS out loud when it cannot reach the API rather than reporting success.

Two defects found and fixed in my own work here:

• examples was silently skipped by make check, because a directory of that name exists and make considered the target up to date. .PHONY now covers it. The tell was the target printing nothing while the run stayed green.
• The work moved into the gate job rather than a job it merely needs:. An aggregator that only inspects another job's result gates nothing by itself — and a pmat quality-gate … || true I briefly had was the same defect written smaller.

pmat comply: 3 → 1

check	state
CB-1701	fixed — a policy exists and runs inside the required check
CB-1700 + CB-1701's other half	disabled with the measurement (below)
CB-2100	still failing, not exempted

CB-1700/1701 read the legacy branches/main/protection endpoint, which answers 404 Branch not protected for a branch protected by an org ruleset. Verified 2026-09-14 with repo + admin:org: orgs/paiml/rulesets/13878864 returns the ruleset and its gate context in the same session the legacy endpoint 404s. Same exemption, same reason, as paiml/rmedia.

CB-2100 is left failing on purpose. It is org-wide — rmedia fails it identically — and unlike the two above I have no measurement showing it cannot be fixed. Disabling it would be an exemption outliving its evidence.

Verification

make check exit 0 · cargo test 8/8 + 4/4 · clippy --all-targets -D warnings clean · fmt clean · bashrs lint 0 errors 0 warnings across all five scripts · cargo deny advisories/bans/licenses/sources ok for both examples · examples self-test 7/7.

🤖 Generated with Claude Code