chore: sync public portfolio governance

CHANGELOG.md

@@ -57,6 +57,9 @@ when releases begin.
 
 ### Changed
 
+- Registered Data Toolbox and JSON YAML Swiss in the public settings policy,
+  synchronized PE Version Info's `v0.1.0-alpha.1` release, and enabled the
+  missing JSON YAML Swiss secret-scanning controls.
 - Synchronized the settings policy and release policy with CSV Sculptor's
   verified `v0.1.0-alpha.1` release and protected `main` branch.
 - Synchronized Developer Primitives `v0.2.0`, including its browser-local IANA

config/github-settings-policy.json

@@ -109,6 +109,16 @@
         "rulesMinimum": {"applicability": "CURRENT", "value": 1},
         "releases": {"applicability": "CURRENT", "value": 1}
       },
+      "data_toolbox": {
+        "sourcePublished": {"applicability": "CURRENT", "value": true},
+        "topics": {"applicability": "CURRENT", "value": ["ai-agents", "ai-tools", "cli", "csv", "data-quality", "data-validation", "developer-tools", "local-first", "privacy", "rust", "tinkora", "tsv", "webassembly"]},
+        "issues": {"applicability": "CURRENT", "value": true},
+        "discussions": {"applicability": "CURRENT", "value": true},
+        "projects": {"applicability": "CURRENT", "value": true},
+        "codeScanning": {"applicability": "CURRENT", "value": "configured"},
+        "rulesMinimum": {"applicability": "CURRENT", "value": 2},
+        "releases": {"applicability": "CURRENT", "value": 0}
+      },
       "developer_primitives": {
         "sourcePublished": {"applicability": "CURRENT", "value": true},
         "topics": {"applicability": "CURRENT", "value": ["ai-agents", "cli", "datetime", "developer-tools", "local-first", "rust", "timestamp", "timezone", "ulid", "uuid", "uuidv7", "webassembly"]},
@@ -168,14 +178,24 @@
         "rulesMinimum": {"applicability": "CURRENT", "value": 1},
         "releases": {"applicability": "CURRENT", "value": 1}
       },
+      "json_yaml_swiss": {
+        "sourcePublished": {"applicability": "CURRENT", "value": true},
+        "topics": {"applicability": "CURRENT", "value": ["configuration", "developer-tools", "json", "rust", "tinkora", "toml", "wasm", "yaml"]},
+        "issues": {"applicability": "CURRENT", "value": true},
+        "discussions": {"applicability": "CURRENT", "value": true},
+        "projects": {"applicability": "CURRENT", "value": false},
+        "codeScanning": {"applicability": "CURRENT", "value": "configured"},
+        "rulesMinimum": {"applicability": "CURRENT", "value": 1},
+        "releases": {"applicability": "CURRENT", "value": 1}
+      },
       "pe_version_info": {
         "sourcePublished": {"applicability": "CURRENT", "value": true},
         "topics": {"applicability": "CURRENT", "value": ["ai-agents", "developer-tools", "pe", "rust", "tinkora", "windows"]},
         "issues": {"applicability": "CURRENT", "value": true},
         "discussions": {"applicability": "CURRENT", "value": true},
         "codeScanning": {"applicability": "CURRENT", "value": "not-configured"},
         "rulesMinimum": {"applicability": "FUTURE_GATE", "gate": "independentSecondOwner", "value": 1},
-        "releases": {"applicability": "CURRENT", "value": 0}
+        "releases": {"applicability": "CURRENT", "value": 1}
       },
       "jwt_inspector": {
         "sourcePublished": {"applicability": "CURRENT", "value": true},

docs/ACCESS_MODEL.md

@@ -39,7 +39,7 @@ must not be converted into current failures merely because they appear in a
 | Setting | Current | Target | Apply when |
 | --- | --- | --- | --- |
 | Release publishers | Only the organization owner may deliberately create a protected project release tag; no organization-wide or unattended publisher is authorized | Separate build verification from least-privilege release publication | A project reaches its documented release gate, the exact commit and hosted evidence are reviewed, and tag creation is separately authorized |
-| High-privilege automation | `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized |
+| High-privilege automation | `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` limit `contents: write` to their final tag-triggered publication jobs; their release Environments have no independent reviewer on GitHub Free | Require a protected Environment or appropriately scoped GitHub App with non-author approval | A second trusted owner is active, credentials and recovery are tested, and the exact automation is explicitly authorized |
 
 During the solo stage, a deliberate protected-tag push is an accountable owner
 authorization, not independent review. It is permitted only under

docs/INCIDENT_RESPONSE.md

@@ -20,7 +20,7 @@ public disclosure of sensitive evidence.
 | Setting | Current | Target | Apply when |
 | --- | --- | --- | --- |
 | Emergency access restriction | No standing incident-specific remote rule is claimed | Temporarily revoke or narrow compromised access with least privilege | An authorized owner verifies a credible active risk, identifies exact affected access, records recovery privately, and approves the action |
-| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace`; organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause |
+| Workflow or release pause | Project-specific protected-tag release automation exists for `cert_viewer`, `cron_maker`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace`; `data_toolbox` and `pe_version_info` currently produce candidate evidence without an unattended publication job, and organization release evidence remains read-only | Disable affected automation or publication while preserving evidence | A credible compromise could affect builds or releases, the incident lead records scope and rollback, and an authorized owner applies the pause |
 | Repository interaction limits | No incident restriction is pre-authorized | Temporarily limit interactions only when abuse or disclosure cannot be contained otherwise | The incident lead documents necessity and duration, an authorized owner approves it, and restoration criteria are defined |
 | Public advisory | No security advisory channel is claimed ready | Coordinate a minimal, accurate advisory and corrected release when appropriate | A private intake exists, affected scope and mitigation are understood, disclosure risk is reviewed, and publication is explicitly authorized |
 

docs/RELEASE_POLICY.md

@@ -4,8 +4,8 @@
 
 | Setting | Current | Target | Apply when |
 | --- | --- | --- | --- |
-| Release automation | `cert_viewer`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered workflows; the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization |
-| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer` and `jwt_inspector` at `v0.1.1`; `csv_sculptor` and `curl_builder` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized |
+| Release automation | `cert_viewer`, `cron_maker`, `csv_sculptor`, `curl_builder`, `developer_primitives`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `json_yaml_swiss`, `jwt_inspector`, `mcp_doctor`, `qr_forge`, and `tool_call_trace` have project-specific, tag-triggered publication workflows; `data_toolbox` and `pe_version_info` currently build candidates without an unattended publication job, and the organization reusable workflow remains read-only | Build and verify reproducibly, then publish from a protected tag with least privilege and project-owned verification | A project has stable hosted checks, immutable release inputs, a documented artifact contract, and explicit owner authorization |
+| Versioning | Published releases are `developer_primitives` and `tool_call_trace` at `v0.2.0`; `cert_viewer`, `json_yaml_swiss`, and `jwt_inspector` at `v0.1.1`; `csv_sculptor`, `curl_builder`, and `pe_version_info` at `v0.1.0-alpha.1`; and `cron_maker`, `diff_viz`, `dmg_background`, `encoding_toolbox`, `favicon_kit`, `image_to_icns`, `mcp_doctor`, and `qr_forge` at `v0.1.0` | Use Semantic Versioning for public versions and document pre-`1.0.0` instability | A project declares a public contract and its first release is authorized |
 | Changelog | This governance repository contains only an `Unreleased` section | Maintain Keep a Changelog categories and move entries to a dated version only during release | A reviewed release candidate is approved; do not create historical entries without release evidence |
 | Git tags | Every published release above has a `vMAJOR.MINOR.PATCH` tag; repository rules protect current release tags from deletion or mutation | Use protected, immutable `vMAJOR.MINOR.PATCH` tags that point to the reviewed release commit | Tag protection is verified, the release commit and version agree, and tag creation is explicitly authorized |
 | Artifacts | Release assets and verification material are project-specific; binary projects publish checksums, SBOMs, and attestations defined by their release contract | Publish platform artifacts with cryptographic checksums, an SBOM, and provenance appropriate to the build system | Artifact generation is reproducible, consumer verification instructions exist, and the release is approved |

profile/README.md

@@ -32,6 +32,13 @@ machine-readable contracts, and behavior that can be verified in CI.
   locally and generates escaped cURL, Fetch, Python, Go, Rust, and Node.js
   snippets without executing the request.
   [Open the tool](https://tinkora.github.io/curl_builder/).
+- [CSV Sculptor](https://github.com/Tinkora/csv_sculptor) inspects, filters,
+  sorts, and converts CSV/TSV data locally in the browser.
+  [Open the Alpha](https://tinkora.github.io/csv_sculptor/).
+- [Data Toolbox](https://github.com/Tinkora/data_toolbox) reports CSV/TSV
+  shape, delimiter ambiguity, jagged rows, and spreadsheet-formula risks
+  without silently changing the input.
+  [Open the Draft](https://tinkora.github.io/data_toolbox/).
 - [Developer Primitives](https://github.com/Tinkora/developer_primitives)
   generates and inspects UUID/ULID values, converts explicit timestamps across
   IANA time zones, and exposes DST gaps and folds through a browser-local
@@ -62,9 +69,17 @@ machine-readable contracts, and behavior that can be verified in CI.
 - [image_to_icns](https://github.com/Tinkora/image_to_icns) is a privacy-first
   macOS `.icns` generator with a browser editor and an MCP server.
   [Open the tool](https://tinkora.github.io/image_to_icns/).
+- [JSON YAML Swiss](https://github.com/Tinkora/json_yaml_swiss) validates,
+  formats, and deliberately converts JSON, YAML, and TOML while reporting
+  lossy boundaries.
+  [Open the Alpha](https://tinkora.github.io/json_yaml_swiss/).
 - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) statically diagnoses local
   stdio MCP server configuration, paths, environment, and transport contracts.
   [View the release](https://github.com/Tinkora/mcp_doctor/releases/latest).
+- [PE Version Info](https://github.com/Tinkora/pe_version_info) provides the
+  cross-platform `pevi` CLI for inspecting and safely updating Windows PE
+  `VERSIONINFO` resources and icons.
+  [Download the Alpha](https://github.com/Tinkora/pe_version_info/releases/tag/v0.1.0-alpha.1).
 - [QR Forge](https://github.com/Tinkora/qr_forge) is a browser-local QR,
   Code 128, and EAN-13 generator with SVG and PNG exports.
   [Open the tool](https://tinkora.github.io/qr_forge/).

profile/README.zh-CN.md

@@ -30,6 +30,11 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目
 - [Curl Builder](https://github.com/Tinkora/curl_builder) 在本地构建 HTTP 请求，
   生成经过转义的 cURL、Fetch、Python、Go、Rust 和 Node.js 代码片段，但不会执行请求。
   [打开工具](https://tinkora.github.io/curl_builder/)。
+- [CSV Sculptor](https://github.com/Tinkora/csv_sculptor) 在浏览器本地检查、筛选、
+  排序和转换 CSV/TSV 数据。[打开 Alpha](https://tinkora.github.io/csv_sculptor/)。
+- [Data Toolbox](https://github.com/Tinkora/data_toolbox) 检查 CSV/TSV 的结构、
+  分隔符歧义、行宽不一致和电子表格公式风险，并且不会静默修改输入。
+  [打开 Draft](https://tinkora.github.io/data_toolbox/)。
 - [Developer Primitives](https://github.com/Tinkora/developer_primitives) 通过
   浏览器本地工作台和跨平台 `tinkora-id`、`tinkora-time` CLI 生成并检查 UUID/ULID、
   转换显式时间戳，并明确显示 IANA 时区的 DST gap/fold。[打开工具](https://tinkora.github.io/developer_primitives/)或
@@ -54,8 +59,14 @@ Tinkora 为开发者和 AI Agent 构建聚焦、开源的实用工具。项目
 - [image_to_icns](https://github.com/Tinkora/image_to_icns) 是一个隐私优先的 macOS
   `.icns` 生成器，提供浏览器编辑器和 MCP server。
   [打开工具](https://tinkora.github.io/image_to_icns/)。
+- [JSON YAML Swiss](https://github.com/Tinkora/json_yaml_swiss) 校验、格式化并有意地
+  转换 JSON、YAML 和 TOML，同时明确报告有损边界。
+  [打开 Alpha](https://tinkora.github.io/json_yaml_swiss/)。
 - [MCP Doctor](https://github.com/Tinkora/mcp_doctor) 静态诊断本地 stdio MCP server
   的配置、路径、环境和传输契约。[查看版本](https://github.com/Tinkora/mcp_doctor/releases/latest)。
+- [PE Version Info](https://github.com/Tinkora/pe_version_info) 提供跨平台 `pevi` CLI，
+  用于检查并安全更新 Windows PE 的 `VERSIONINFO` 资源和图标。
+  [下载 Alpha](https://github.com/Tinkora/pe_version_info/releases/tag/v0.1.0-alpha.1)。
 - [QR Forge](https://github.com/Tinkora/qr_forge) 是一个在浏览器本地运行的 QR、
   Code 128 与 EAN-13 生成器，支持导出 SVG 和 PNG。
   [打开工具](https://tinkora.github.io/qr_forge/)。