From f6df0eb4bba90e248ae609289b2f44770fdb273c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 26 May 2026 13:25:09 +0100 Subject: [PATCH 1/8] docs: record tech-debt audit findings (2026-05-26) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds docs/tech-debt-2026-05-26.md with this repo's findings from the estate-wide tech-debt scan: proof debt, licence debt, documentation debt. This file records the findings only — it does not close the debt. Cross-references: - hyperpolymath/standards#195 (estate proof-debt audit) - hyperpolymath/standards#196 (estate licence-debt audit) - hyperpolymath/standards#197 (estate documentation-debt audit) Co-Authored-By: Claude Opus 4.7 (1M context) --- docs/tech-debt-2026-05-26.md | 62 ++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 docs/tech-debt-2026-05-26.md diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md new file mode 100644 index 0000000..39a0158 --- /dev/null +++ b/docs/tech-debt-2026-05-26.md @@ -0,0 +1,62 @@ + + +# Tech-Debt Audit — formatrix-docs — 2026-05-26 + +**Source:** estate-wide automated scan 2026-05-26. +**Companion:** [`hyperpolymath/standards` 2026-05-26-estate-*-debt audits](https://github.com/hyperpolymath/standards/tree/main/docs/audits). +**Combined severity:** `2026-05-22`. + +This file records the *raw findings* — it does not by itself fix the debt. Each section ends with a 'Recommended next move' line; closing the debt is follow-up work. + +## 1. Proof debt + +Scanner counted the following markers in proof-bearing files of this repo: + +``` +files= 10 | Coq-Axm/Adm= 0 | Lean-srry/ax= 0 | Agda-pst= 0 | Idr-blv= 0 | Idr-prtl= 0 | Fstr-asm= 0 | TODO= 0 | Unsafe= 0 +``` + +**Total markers:** 0. **Severity:** `>00`. + +**Recommended next move:** none — no proof-debt markers detected. + +## 2. Licence debt + +| Field | Value | +|---|---| +| LICENSE file | `LICENSE` | +| SPDX header | `MPL-2.0` | +| Manifest licence | `MPL-2.0` | +| Body classifier | `Palimp-MPL-2.0` | +| Severity | `ok` | + +**Recommended next move:** none for licence. + +## 3. Documentation debt + +| Field | Value | +|---|---| +| README lines | 146 | +| `docs/` files | 5 | +| `docs/` LoC | 1569 | +| CHANGELOG.md | N | +| CONTRIBUTING.md | Y | +| CODE_OF_CONDUCT.md | Y | +| SECURITY.md | Y | +| Severity | `readme=146 docs=5/1569` | + + +Additionally: **CHANGELOG.md is missing.** 65% of estate repos lack one — adopting a CHANGELOG (or auto-generating via `git-cliff`) is a recommended estate-wide follow-up. + +## Cross-references + +- Estate proof-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md` +- Estate licence-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md` +- Estate documentation-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md` + +--- + +🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). This file is informational — closing the debt is follow-up work owned by the maintainer. From 8334177d5f9ef1651c68e0b1fb399f5b31760d21 Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 26 May 2026 18:45:04 +0100 Subject: [PATCH 2/8] docs: seed CHANGELOG.md (Keep-a-Changelog format) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes Row-2 Phase 3 of the 2026-05-26 estate tech-debt audit chain for this repo. The 2026-05-26 documentation-debt audit (hyperpolymath/standards#197) flagged that 180 of 279 estate repos lacked a CHANGELOG.md (65% gap) — this seed closes that finding here. The seed: - Uses Keep-a-Changelog format with an [Unreleased] section. - Buckets the most recent 100 commits by conventional-commit prefix (feat/fix/refactor/docs/ci/build) into Added/Fixed/Changed/ Documentation/CI sections. - References standards#206's changelog-reusable.yml + the canonical templates/cliff.toml for full-regeneration via git-cliff. The file is initial — the maintainer can adopt changelog-reusable.yml in this repo's CI to keep it auto-regenerated, or regenerate manually. Co-Authored-By: Claude Opus 4.7 (1M context) --- CHANGELOG.md | 78 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 CHANGELOG.md diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..8834ab3 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,78 @@ + + +# Changelog + +All notable changes to `formatrix-docs` will be documented in this file. + +This file is generated from conventional commits by the +[`changelog-reusable.yml`](https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml) +workflow (`hyperpolymath/standards#206`). Adopt the workflow in this repo's CI to keep this file in sync automatically — see +[`templates/cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) +for the canonical config. + +The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); +this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [Unreleased] + +### Added + +- feat(crg): add crg-grade and crg-badge justfile recipes +- feat: add Stapeln container configuration +- feat: add UX Justfile with doctor, tour, help-me, assail recipes +- feat: deploy UX Manifesto infrastructure +- feat: replace Tauri with Gossamer — gossamer-rs backend (mirror of docmatrix) +- feat: Gossamer migration — RuntimeBridge, gossamer.conf.json, Tauri→Gossamer conversion +- feat: add formatrix-bridges crate and missing AST module +- feat: add CLADE.a2ml — clade taxonomy declaration +- feat: add mirror.yml workflow for GitLab/Bitbucket mirroring +- feat: customize fuzz target with repo-specific logic + +### Fixed + +- fix(ci): bump a2ml/k9-validate-action pins to canonical (standards#85) (#10) +- fix(ci): sync hypatia-scan.yml to canonical (kill cd-scanner build drift) (#9) +- fix(ci): adopt canonical hypatia-scan.yml (env.HOME/scanner-layout + Comment-step gate) (#8) +- fix(ci): bump erlef/setup-beam SHA for ubuntu24 runner support (#5) +- fix(ci): move secret-scanner Cargo.toml gate from job-level if: to step-level (#6) +- fix(ci): Resolve workflow-linter self-matching and metadata issues +- fix: correct email jonathan.jewell → j.d.a.jewell +- fix: global AGPL-3.0-or-later → PMPL-1.0-or-later replacement +- fix(license): SPDX AGPL-3.0 → PMPL-1.0-or-later in dotfiles +- fix: remove duplicate SCM files from root + +### Changed + +- refactor: migrate 6SCM → 6A2 (.scm → .a2ml format) + +### Documentation + +- docs: add post-audit status report for M5 sweep +- docs: add TEST-NEEDS.md (CRG C) +- docs: add EXPLAINME.adoc — prove-it file backing README claims +- docs: add SECURITY.md for vulnerability reporting +- docs: add checkpoint files for state tracking +- docs: rename to DocMatrix +- docs: mark FD-M07 complete +- docs: add v1 ecosystem publish roadmap +- docs: mark FD-C07 Gist library as done +- docs: update seam check status after SHOULDs + +### CI + +- ci(rust): convert rust-ci.yml to thin wrapper (standards#174) (#14) +- ci: redistribute concurrency-cancel guard to read-only check workflows (#12) +- ci: bump actions/upload-artifact SHA to current v4 (#4) +- ci: SHA-pin hyperpolymath validate-actions in dogfood-gate +- ci: deploy dogfood-gate, fix hypatia-scan, add pre-commit hooks + +## Pre-history + +Prior commits to this file's introduction are recorded in git history but not formally classified into Keep-a-Changelog sections. To backfill, run `git cliff -o CHANGELOG.md` locally using the canonical [`cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) — this is one-shot mechanical work. + +--- + + From 7de797911f6b627ed6567069dc674f89287261fd Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:44:23 +0100 Subject: [PATCH 3/8] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/cflite_batch.yml | 1 + .github/workflows/cflite_pr.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/pages.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 15 files changed, 15 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 1ae6f46..700175a 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index 16baebd..86541f6 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -5,6 +5,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index ee6d108..cf8d841 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -4,6 +4,7 @@ on: schedule: - cron: '0 0 * * 0' permissions: + actions: read contents: read jobs: BatchFuzzing: diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 8bc279d..f0c47a1 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -5,6 +5,7 @@ on: paths: - '**/*.rs' permissions: + actions: read contents: read jobs: PR: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 64a6a75..5833201 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -15,6 +15,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: analyze: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index e6b2501..ac3ce14 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -11,6 +11,7 @@ on: push: branches: [main, master] permissions: + actions: read contents: read jobs: # --------------------------------------------------------------------------- diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b8aa88b..b0d1e55 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -24,6 +24,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: governance: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index e1e3879..61e4715 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -16,6 +16,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read # security-events: write serves two purposes (write implies read): # 1. read — lets the built-in GITHUB_TOKEN query this repo's own diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index e9df9c7..626839e 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -7,6 +7,7 @@ on: release: types: [published] permissions: + actions: read contents: read jobs: dispatch: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 52ff57d..9a881b4 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -6,6 +6,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror-gitlab: diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml index c78489a..0273437 100755 --- a/.github/workflows/pages.yml +++ b/.github/workflows/pages.yml @@ -5,6 +5,7 @@ on: branches: [main, master] workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..112afd1 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index bd1387d..b495c7d 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -8,6 +8,7 @@ on: branches: [main, master] pull_request: permissions: + actions: read contents: read jobs: rust-ci: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 64ac2ac..f0c8699 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: read-all + actions: read jobs: analysis: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index dcd1ab6..adb699c 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -13,6 +13,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: trufflehog: From 2642d681cd580b504dc54257269b0b1228be28a1 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:08:57 +0100 Subject: [PATCH 4/8] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 162 ------------------------------------------------ 1 file changed, 162 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index e41020d..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -= Governance Model -:toc: preamble - -This document describes the governance model for this repository. - -== Overview - -This repository follows a **Sole Maintainer Governance Model**: - -* Single maintainer (@hyperpolymath) has full authority over the project -* All contributions are welcome and reviewed by the maintainer -* Decisions are made transparently through GitHub issues and discussions -* The project adheres to the hyperpolymath estate policies where applicable - -== Core Principles - -[cols="1,2"] -|=== -| Principle | Description - -| **Benevolent Dictatorship** | Maintainer has final decision authority but seeks community input - -| **Meritocracy** | Contributions are judged on technical merit, not contributor identity - -| **Transparency** | All significant decisions are documented publicly - -| **Consensus-Seeking** | Maintainer prefers consensus but will decide when necessary - -| **Open Contribution** | Anyone can contribute via fork and pull request - -|=== - -== Roles and Permissions - -[cols="1,2,2"] -|=== -| Role | Permissions | Assignment - -| **Maintainer** | Write access, merge rights, admin | @hyperpolymath -| **Contributors** | Read access, fork, submit PRs | All GitHub users -| **Users** | Use the software, report issues | All GitHub users - -|=== - -== Decision Making Framework - -=== Routine Decisions - -* Bug fixes -* Documentation improvements -* Minor feature additions -* Dependency updates - -**Process**: Maintainer reviews and merges PRs that meet quality standards. - -=== Significant Changes - -* New major features -* API changes -* Architecture modifications -* Breaking changes - -**Process**: -. Open issue describing the change -. Discuss with community (minimum 72 hours) -. Maintainer makes final decision -. Document rationale in issue/PR - -=== Structural Decisions - -* Repository purpose/renaming -* License changes -* Ownership transfer -* Deprecation/archival - -**Process**: -. Extended discussion (minimum 1 week) -. Maintainer makes final decision -. Document in CHANGELOG and governance docs - -== Contribution Lifecycle - -[cols="1,2"] -|=== -| Stage | Process - -| **Ideation** | Open issue, discuss feasibility - -| **Development** | Fork, implement, test thoroughly - -| **Review** | Submit PR, maintainer reviews within 7 days - -| **Merge** | Maintainer merges or requests changes - -| **Release** | Maintainer publishes according to project conventions - -|=== - -== Conflict Resolution - -In case of disagreements: - -. Discuss in the relevant GitHub issue or PR -. Provide technical justification for positions -. Maintainer mediates and makes final decision -. Decision is documented and can be revisited later - -== Project Policies - -This repository adheres to hyperpolymath estate-wide policies: - -* **License**: MPL-2.0 for code, CC-BY-SA-4.0 for prose (per standards/LICENCE-POLICY.adoc) -* **Code of Conduct**: Follows hyperpolymath CODE_OF_CONDUCT.md -* **Security**: Follows hyperpolymath SECURITY.md -* **Contributing**: Follows hyperpolymath CONTRIBUTING.adoc conventions - -== Repository-Specific Conventions - -[cols="1,2"] -|=== -| Convention | Description - -| **Signing** | All commits must be signed (SSH or GPG) - -| **SPDX Headers** | All source files must have SPDX license identifiers - -| **Contractiles** | Mustfile, Trustfile, Intendfile, Adjustfile in root - -| **Machine Readable** | META.a2ml in .machine_readable/6a2/ - -| **CI/CD** | GitHub Actions workflows in .github/workflows/ - -|=== - -== Governance Evolution - -As the project grows, this governance model may evolve: - -* **Adding Co-Maintainers**: When contribution volume warrants it -* **Forming a Team**: For complex multi-maintainer projects -* **Adopting TPCF**: For large, multi-repository projects (see rhodium-standard-repositories) - -Changes to this document require the same process as Significant Changes above. - -== See Also - -* link:MAINTAINERS.adoc[Maintainers] -* link:CODE_OF_CONDUCT.md[Code of Conduct] -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:https://github.com/hyperpolymath/standards/blob/main/LICENCE-POLICY.adoc[Estate License Policy] -* link:https://github.com/hyperpolymath/standards[rhodium-standard-repositories (TPCF)] - -== Changelog - -[cols="1,1,1"] -|=== -| Date | Change | By - -| 2026-06-07 | Initial governance model established | @hyperpolymath -|=== From 3ea486c63cb45398685b89bb96761795b3574f36 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:42:09 +0100 Subject: [PATCH 5/8] fix(ci): remove erroneous squisher-corpus guix.scm placeholder Part of estate-wide standards#426 remediation - cleanup. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- guix.scm | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 guix.scm diff --git a/guix.scm b/guix.scm deleted file mode 100644 index ead469b..0000000 --- a/guix.scm +++ /dev/null @@ -1,18 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for formatrix-docs -;; Usage: guix shell -f guix.scm - -(use-modules (guix packages) - (guix build-system gnu) - (guix licenses)) - -(package - (name "formatrix-docs") - (version "0.1.0") - (source #f) - (build-system gnu-build-system) - (synopsis "formatrix-docs") - (description "formatrix-docs — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/formatrix-docs") - (license ((@@ (guix licenses) license) "MPL-2.0" - "https://github.com/hyperpolymath/palimpsest-license"))) From ee2cfeab02e42def8ad00ec65ebb331b7ee4a43e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 05:01:24 +0100 Subject: [PATCH 6/8] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 13 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/governance.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index b0d1e55..2aa18aa 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -28,4 +28,4 @@ permissions: contents: read jobs: governance: - uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index f0c8699..05765f5 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -13,7 +13,7 @@ permissions: read-all jobs: analysis: - uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9 + uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 permissions: contents: read security-events: write From b29b24546c309b4a9ce2847ca07a50e02a1da01d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 19:18:24 +0100 Subject: [PATCH 7/8] fix(ci): add required permissions for reusable workflows (Bug B) Add security-events: write and id-token: write to workflow-level permissions in scorecard.yml for scorecard-reusable.yml calls. Ensure contents: read at workflow-level for secret-scanner.yml. Part of hyperpolymath/standards#426 remediation - Batch 2. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/scorecard.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 05765f5..b75f82f 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -8,7 +8,10 @@ on: push: branches: [main] -permissions: read-all +permissions: + contents: read + security-events: write + id-token: write actions: read jobs: From 5024da5dae855dcba7009c908074208eb3a7ab92 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 28 Aug 2026 06:05:39 +0100 Subject: [PATCH 8/8] chore(toolchain): keep .tool-versions -> .mise.toml pin conversion (R-16) Owner ruling 2026-08-28 (R-16/R-20/R-21): keep the pin conversion from the template-sync sweep, revert the rest. Pin content verified against HEAD:.tool-versions before commit. Co-Authored-By: Claude Fable 5 --- .mise.toml | 2 ++ .tool-versions | 1 - 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .mise.toml delete mode 100644 .tool-versions diff --git a/.mise.toml b/.mise.toml new file mode 100644 index 0000000..3156a04 --- /dev/null +++ b/.mise.toml @@ -0,0 +1,2 @@ +[tools] +rust = "stable" diff --git a/.tool-versions b/.tool-versions deleted file mode 100644 index 3cd07d4..0000000 --- a/.tool-versions +++ /dev/null @@ -1 +0,0 @@ -rust stable