diff --git a/.claude/PROJECT.adoc b/.claude/PROJECT.adoc new file mode 100644 index 0000000..d0ecc8c --- /dev/null +++ b/.claude/PROJECT.adoc @@ -0,0 +1,33 @@ +== Infrastructure-Automation - Claude Code Instructions + +This repository contains the Infrastructure-Automation project. + +=== Project Structure + +.... +infrastructure-automation/ +├── .claude/ # AI assistant instructions +├── .git/ # Version control +├── .gitignore # Git ignore rules +├── .editorconfig # Editor configuration +└── ... # Project files +.... + +=== Build Commands + +Refer to project-specific documentation. + +=== Coding Conventions + +* Follow hyperpolymath standards +* All code must have SPDX license headers +* Use approved languages only (see CLAUDE.md) +* Document all non-obvious decisions + +=== Security + +* No hardcoded secrets +* All secrets through environment variables or secret management +* SHA-pinned dependencies where applicable +* HTTPS only, no HTTP URLs +* No MD5/SHA1 for security purposes diff --git a/.claude/PROJECT.md b/.claude/PROJECT.md deleted file mode 100644 index 9c37274..0000000 --- a/.claude/PROJECT.md +++ /dev/null @@ -1,33 +0,0 @@ -# Infrastructure-Automation - Claude Code Instructions - -This repository contains the Infrastructure-Automation project. - -## Project Structure - -``` -infrastructure-automation/ -├── .claude/ # AI assistant instructions -├── .git/ # Version control -├── .gitignore # Git ignore rules -├── .editorconfig # Editor configuration -└── ... # Project files -``` - -## Build Commands - -Refer to project-specific documentation. - -## Coding Conventions - -- Follow hyperpolymath standards -- All code must have SPDX license headers -- Use approved languages only (see CLAUDE.md) -- Document all non-obvious decisions - -## Security - -- No hardcoded secrets -- All secrets through environment variables or secret management -- SHA-pinned dependencies where applicable -- HTTPS only, no HTTP URLs -- No MD5/SHA1 for security purposes diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc new file mode 100644 index 0000000..d36a7a0 --- /dev/null +++ b/CHANGELOG.adoc @@ -0,0 +1,64 @@ +== Changelog + +All notable changes to `+infrastructure-automation+` will be documented +in this file. + +This file is generated from conventional commits by the +https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`] +workflow (`+hyperpolymath/standards#206+`). Adopt the workflow in this +repo’s CI to keep this file in sync automatically — see +https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`] +for the canonical config. + +The format follows https://keepachangelog.com/en/1.1.0/[Keep a +Changelog]; this project aims to follow +https://semver.org/spec/v2.0.0.html[Semantic Versioning]. + +=== [Unreleased] + +==== Added + +* feat(crg): add crg-grade and crg-badge justfile recipes +* feat: add stapeln.toml container definition +* feat: deploy UX Manifesto infrastructure +* feat: add CLADE.a2ml — clade taxonomy declaration +* feat: add mirror.yml workflow for GitLab/Bitbucket mirroring +* feat: complete SaltStack to Ansible + Terraform migration + +==== Fixed + +* fix(scorecard): enforce granular permissions and add fuzzing +placeholder +* fix(ci): Resolve workflow-linter self-matching and metadata issues +* fix: correct email jonathan.jewell → j.d.a.jewell +* fix: SPDX headers (AGPL→PMPL), email, author name +* fix: suppress deprecation warnings for ansible-core 2.24 +* fix: resolve Silverblue compatibility issues across all roles +* fix: use $((x + 1)) instead of ((x++)) in self-check + +==== Changed + +* refactor: migrate 6SCM → 6A2 (.scm → .a2ml format) + +==== Documentation + +* docs: substantive CRG C annotation (EXPLAINME.adoc) +* docs: add EXPLAINME.adoc — prove-it file backing README claims +* docs: add design change rationale for Salt to Ansible migration + +==== CI + +* ci: deploy dogfood-gate, add Groove manifest and CRG tests +* ci: migrate CodeQL Action v3 → v4 +* ci: update SHA pins for codeql-action and trufflehog +* ci: deploy missing standard workflows (10 added) + +=== Pre-history + +Prior commits to this file’s introduction are recorded in git history +but not formally classified into Keep-a-Changelog sections. To backfill, +run `+git cliff -o CHANGELOG.md+` locally using the canonical +https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+cliff.toml+`] +— this is one-shot mechanical work. + +''''' diff --git a/CHANGELOG.md b/CHANGELOG.md deleted file mode 100644 index 9acb67c..0000000 --- a/CHANGELOG.md +++ /dev/null @@ -1,63 +0,0 @@ - - -# Changelog - -All notable changes to `infrastructure-automation` will be documented in this file. - -This file is generated from conventional commits by the -[`changelog-reusable.yml`](https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml) -workflow (`hyperpolymath/standards#206`). Adopt the workflow in this repo's CI to keep this file in sync automatically — see -[`templates/cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) -for the canonical config. - -The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); -this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). - -## [Unreleased] - -### Added - -- feat(crg): add crg-grade and crg-badge justfile recipes -- feat: add stapeln.toml container definition -- feat: deploy UX Manifesto infrastructure -- feat: add CLADE.a2ml — clade taxonomy declaration -- feat: add mirror.yml workflow for GitLab/Bitbucket mirroring -- feat: complete SaltStack to Ansible + Terraform migration - -### Fixed - -- fix(scorecard): enforce granular permissions and add fuzzing placeholder -- fix(ci): Resolve workflow-linter self-matching and metadata issues -- fix: correct email jonathan.jewell → j.d.a.jewell -- fix: SPDX headers (AGPL→PMPL), email, author name -- fix: suppress deprecation warnings for ansible-core 2.24 -- fix: resolve Silverblue compatibility issues across all roles -- fix: use $((x + 1)) instead of ((x++)) in self-check - -### Changed - -- refactor: migrate 6SCM → 6A2 (.scm → .a2ml format) - -### Documentation - -- docs: substantive CRG C annotation (EXPLAINME.adoc) -- docs: add EXPLAINME.adoc — prove-it file backing README claims -- docs: add design change rationale for Salt to Ansible migration - -### CI - -- ci: deploy dogfood-gate, add Groove manifest and CRG tests -- ci: migrate CodeQL Action v3 → v4 -- ci: update SHA pins for codeql-action and trufflehog -- ci: deploy missing standard workflows (10 added) - -## Pre-history - -Prior commits to this file's introduction are recorded in git history but not formally classified into Keep-a-Changelog sections. To backfill, run `git cliff -o CHANGELOG.md` locally using the canonical [`cliff.toml`](https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml) — this is one-shot mechanical work. - ---- - - diff --git a/CODE_OF_CONDUCT.adoc b/CODE_OF_CONDUCT.adoc new file mode 100644 index 0000000..1d0fa33 --- /dev/null +++ b/CODE_OF_CONDUCT.adoc @@ -0,0 +1,14 @@ +== Code of Conduct + +This project follows the +https://www.contributor-covenant.org/[Contributor Covenant] v2.1. + +=== Summary + +* Be respectful and inclusive +* Accept constructive criticism gracefully +* Focus on what is best for the community + +=== Contact + +j.d.a.jewell@open.ac.uk diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md deleted file mode 100644 index 2135f49..0000000 --- a/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,14 +0,0 @@ - -# Code of Conduct - -This project follows the [Contributor Covenant](https://www.contributor-covenant.org/) v2.1. - -## Summary - -- Be respectful and inclusive -- Accept constructive criticism gracefully -- Focus on what is best for the community - -## Contact - -j.d.a.jewell@open.ac.uk diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc new file mode 100644 index 0000000..4f81d7b --- /dev/null +++ b/CONTRIBUTING.adoc @@ -0,0 +1,30 @@ +== Contributing + +=== Development Workflow + +[arabic] +. Read `+0-AI-MANIFEST.a2ml+` for project conventions +. Read `+.machine_readable/STATE.scm+` for current status +. Make changes following existing patterns +. Test with `+just check+` (dry run) +. Validate with `+just lint+` +. Run `+just self-check+` to verify + +=== Role Development + +When adding a new Ansible role: + +[arabic] +. Create directory structure: `+tasks/+`, `+defaults/+`, `+meta/+` +. Add `+meta/main.yml+` with role metadata (homoiconic self-description) +. Add `+defaults/main.yml+` with documented default variables +. Ensure all tasks are idempotent +. Add the role to the appropriate playbook +. Update `+TOPOLOGY.md+` + +=== Code Standards + +* All files must have `+# SPDX-License-Identifier: CC-BY-SA-4.0+` +* Ansible tasks must have descriptive `+name+` fields +* Variables must be documented with comments in `+defaults/main.yml+` +* Use `+ansible.builtin.*+` fully qualified collection names diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md deleted file mode 100644 index fb03777..0000000 --- a/CONTRIBUTING.md +++ /dev/null @@ -1,29 +0,0 @@ - -# Contributing - -## Development Workflow - -1. Read `0-AI-MANIFEST.a2ml` for project conventions -2. Read `.machine_readable/STATE.scm` for current status -3. Make changes following existing patterns -4. Test with `just check` (dry run) -5. Validate with `just lint` -6. Run `just self-check` to verify - -## Role Development - -When adding a new Ansible role: - -1. Create directory structure: `tasks/`, `defaults/`, `meta/` -2. Add `meta/main.yml` with role metadata (homoiconic self-description) -3. Add `defaults/main.yml` with documented default variables -4. Ensure all tasks are idempotent -5. Add the role to the appropriate playbook -6. Update `TOPOLOGY.md` - -## Code Standards - -- All files must have `# SPDX-License-Identifier: CC-BY-SA-4.0` -- Ansible tasks must have descriptive `name` fields -- Variables must be documented with comments in `defaults/main.yml` -- Use `ansible.builtin.*` fully qualified collection names diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc new file mode 100644 index 0000000..9b836fb --- /dev/null +++ b/GOVERNANCE.adoc @@ -0,0 +1,60 @@ +== Governance + +=== Overview + +This project is governed by the following principles and structures to +ensure transparent, inclusive, and effective decision-making. + +=== Roles and Responsibilities + +==== Maintainers + +Maintainers are responsible for: - Reviewing and merging pull requests - +Managing releases and versioning - Ensuring code quality and standards - +Triaging issues and bug reports - Community engagement and support + +==== Contributors + +Contributors are expected to: - Follow the code of conduct - Submit +well-documented pull requests - Write tests for new functionality - +Maintain existing tests - Update documentation as needed + +=== Decision Making + +==== Minor Changes + +* Can be made by any maintainer +* Include bug fixes, documentation updates, dependency updates + +==== Major Changes + +* Require discussion in issues or pull requests +* Include new features, architectural changes, API changes +* Need approval from at least 2 maintainers + +==== Breaking Changes + +* Require RFC (Request for Comments) process +* Need approval from majority of maintainers +* Must include migration guide + +=== Code of Conduct + +All participants are expected to follow our Code of Conduct. Violations +can be reported to the maintainers. + +=== Communication + +* *Issues*: For bug reports and feature requests +* *Discussions*: For questions and general discussion +* *Pull Requests*: For code contributions + +=== Licensing + +All contributions are made under the terms of the repository’s LICENSE +file. By submitting a pull request, you agree to license your +contributions accordingly. + +''''' + +_Last updated: 2026-07-18_ diff --git a/GOVERNANCE.md b/GOVERNANCE.md deleted file mode 100644 index e27364c..0000000 --- a/GOVERNANCE.md +++ /dev/null @@ -1,60 +0,0 @@ -# Governance - -## Overview - -This project is governed by the following principles and structures to ensure transparent, inclusive, and effective decision-making. - -## Roles and Responsibilities - -### Maintainers - -Maintainers are responsible for: -- Reviewing and merging pull requests -- Managing releases and versioning -- Ensuring code quality and standards -- Triaging issues and bug reports -- Community engagement and support - -### Contributors - -Contributors are expected to: -- Follow the code of conduct -- Submit well-documented pull requests -- Write tests for new functionality -- Maintain existing tests -- Update documentation as needed - -## Decision Making - -### Minor Changes -- Can be made by any maintainer -- Include bug fixes, documentation updates, dependency updates - -### Major Changes -- Require discussion in issues or pull requests -- Include new features, architectural changes, API changes -- Need approval from at least 2 maintainers - -### Breaking Changes -- Require RFC (Request for Comments) process -- Need approval from majority of maintainers -- Must include migration guide - -## Code of Conduct - -All participants are expected to follow our Code of Conduct. Violations can be reported to the maintainers. - -## Communication - -- **Issues**: For bug reports and feature requests -- **Discussions**: For questions and general discussion -- **Pull Requests**: For code contributions - -## Licensing - -All contributions are made under the terms of the repository's LICENSE file. -By submitting a pull request, you agree to license your contributions accordingly. - ---- - -*Last updated: 2026-07-18* diff --git a/README.adoc b/README.adoc new file mode 100644 index 0000000..61091eb --- /dev/null +++ b/README.adoc @@ -0,0 +1,112 @@ +== What This Is + +Complete infrastructure-as-code for local system management, replacing +SaltStack with modern Ansible + Terraform. + +* *Ansible* manages configuration: packages, users, files, services, +firewall, monitoring, networking — everything that runs _on_ your host. +* *Terraform* manages container provisioning: declarative lifecycle +management of Podman containers with state tracking. + +Designed for Fedora Silverblue (immutable OS) but works on any Fedora. + +== Quick Start + +[source,bash] +---- +./scripts/bootstrap.sh # Install dependencies +vim ansible/inventory/group_vars/all.yml # Customise +just check # Dry run +just apply # Apply +---- + +== Design Principles + +Homoiconic + +Configuration describes itself. `+group_vars/all.yml+` IS the system +specification. + +Reflexive + +The system inspects its own state. Run `+just+` `+self-check+` or +`+just+` `+report+`. + +Dependable + +All operations are idempotent. Run `+just+` `+check+` for safe dry runs. + +Secure + +Firewall-first, least-privilege, Ansible Vault for secrets, rootless +Podman. + +Interoperable + +Compatible with link:../ambientops/hybrid-automation-router/[HAR] for +IaC translation. + +== Repository Structure + +[source,text] +---- +ansible/ + inventory/group_vars/all.yml ← EDIT THIS: your desired system state + playbooks/site.yml ← Master playbook + roles/ ← 11 modular roles +terraform/ + main.tf ← Container provisioning + terraform.tfvars.example ← Container definitions template +scripts/ + bootstrap.sh ← First-time setup + self-check.sh ← State validation +docs/ ← Architecture, migration, quickstart +justfile ← Task runner recipes +---- + +== Ansible Roles + +[width="100%",cols="34%,33%,33%",options="header",] +|=== +|Role |Purpose |Salt Equivalent +|`+base_packages+` |Essential system packages |`+packages.sls+` + +|`+users+` |User accounts and SSH keys |`+users.sls+` + +|`+files_managed+` |Configuration files (MOTD, profile) |`+files.sls+` + +|`+services+` |Systemd service management |`+services.sls+` + +|`+firewall+` |Firewalld rules |`+firewall.sls+` + +|`+sudo_config+` |Sudo rules via drop-in files |`+sudo.sls+` + +|`+monitoring+` |Monitoring tools and self-monitoring +|`+monitoring/init.sls+` + +|`+networking+` |/etc/hosts, hostname, DNS |`+networking/init.sls+` + +|`+podman_containers+` |Podman container management +|`+containers/init.sls+` + +|`+silverblue+` |Immutable OS adaptations |_(new)_ + +|`+development+` |Developer tools (asdf, runtimes) |_(new)_ +|=== + +== Common Commands + +[source,bash] +---- +just apply # Apply all configuration +just check # Dry run (show changes without applying) +just apply-tags security # Apply only firewall + sudo +just self-check # Validate current system state +just report # View last change report +just tf-plan # Preview container changes +just tf-apply # Provision containers +just bootstrap # First-time setup +just migrate # Salt migration helper +---- + +== License + +MPL-2.0 + +Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) + diff --git a/README.md b/README.md deleted file mode 100644 index 2614c94..0000000 --- a/README.md +++ /dev/null @@ -1,102 +0,0 @@ - - -# What This Is - -Complete infrastructure-as-code for local system management, replacing -SaltStack with modern Ansible + Terraform. - -- **Ansible** manages configuration: packages, users, files, services, - firewall, monitoring, networking — everything that runs *on* your - host. - -- **Terraform** manages container provisioning: declarative lifecycle - management of Podman containers with state tracking. - -Designed for Fedora Silverblue (immutable OS) but works on any Fedora. - -# Quick Start - -```bash -./scripts/bootstrap.sh # Install dependencies -vim ansible/inventory/group_vars/all.yml # Customise -just check # Dry run -just apply # Apply -``` - -# Design Principles - -Homoiconic -Configuration describes itself. `group_vars/all.yml` IS the system -specification. - -Reflexive -The system inspects its own state. Run `just` `self-check` or `just` -`report`. - -Dependable -All operations are idempotent. Run `just` `check` for safe dry runs. - -Secure -Firewall-first, least-privilege, Ansible Vault for secrets, rootless -Podman. - -Interoperable -Compatible with [HAR](../ambientops/hybrid-automation-router/) for IaC -translation. - -# Repository Structure - -```text -ansible/ - inventory/group_vars/all.yml ← EDIT THIS: your desired system state - playbooks/site.yml ← Master playbook - roles/ ← 11 modular roles -terraform/ - main.tf ← Container provisioning - terraform.tfvars.example ← Container definitions template -scripts/ - bootstrap.sh ← First-time setup - self-check.sh ← State validation -docs/ ← Architecture, migration, quickstart -justfile ← Task runner recipes -``` - -# Ansible Roles - -| Role | Purpose | Salt Equivalent | -|----|----|----| -| `base_packages` | Essential system packages | `packages.sls` | -| `users` | User accounts and SSH keys | `users.sls` | -| `files_managed` | Configuration files (MOTD, profile) | `files.sls` | -| `services` | Systemd service management | `services.sls` | -| `firewall` | Firewalld rules | `firewall.sls` | -| `sudo_config` | Sudo rules via drop-in files | `sudo.sls` | -| `monitoring` | Monitoring tools and self-monitoring | `monitoring/init.sls` | -| `networking` | /etc/hosts, hostname, DNS | `networking/init.sls` | -| `podman_containers` | Podman container management | `containers/init.sls` | -| `silverblue` | Immutable OS adaptations | *(new)* | -| `development` | Developer tools (asdf, runtimes) | *(new)* | - -# Common Commands - -```bash -just apply # Apply all configuration -just check # Dry run (show changes without applying) -just apply-tags security # Apply only firewall + sudo -just self-check # Validate current system state -just report # View last change report -just tf-plan # Preview container changes -just tf-apply # Provision containers -just bootstrap # First-time setup -just migrate # Salt migration helper -``` - -# License - -MPL-2.0 - -Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -\<[j.d.a.jewell@open.ac](j.d.a.jewell@open.ac).uk\> diff --git a/REQUIRES_INITIALISATION.adoc b/REQUIRES_INITIALISATION.adoc new file mode 100644 index 0000000..3b21408 --- /dev/null +++ b/REQUIRES_INITIALISATION.adoc @@ -0,0 +1,161 @@ +== REQUIRES INITIALISATION + +*This repository is not finished being set up.* 14 substitution token(s) +across 4 file(s) still have no value. + +=== Why this is not already done + +This repo was created from `+hyperpolymath/rsr-template-repo+`. The mint +(`+just repo-init+`) fills every token that has a single mechanical +answer — owner, repo, author, dates, licence, branch — and it has done +so here. + +The tokens below are the ones it _deliberately cannot_ answer. They need +a decision or a fact that exists only in your head: what this project is +for, what command builds it, which port the service listens on, whether +a PGP key is held at all. The template’s own token vocabulary says as +much — you cannot sensibly answer "`required invariants`" in a +thirty-second bootstrap. + +They were left *visibly unfilled on purpose*. The alternatives were both +worse: inventing plausible values would put confident falsehoods into a +security policy and an architecture document, and silently deleting the +sections would hide the fact that a decision is owed. A visible gap is +honest; a fabricated answer is not. + +=== Do not delete this file until every item below is resolved + +This file is the only marker that the work is outstanding. Deleting it +early does not finish the setup, it just conceals it — and the next +person or agent to arrive will reasonably assume the repo is complete. + +* *If you are a person:* delete this file yourself once the last item is +done. +* *If you are an agent:* resolve what you legitimately can, leave the +rest, and delete this file only when no token below remains anywhere in +the tree. Do not delete it to make a gate go green. + +Re-running the estate top-up tool will remove this file automatically +once nothing is outstanding, so the safest way to finish is to fix the +tokens and let the check confirm it. + +=== What is needed, and where it goes + +==== `+{{BUILD_CMD}}+` + +The exact command that builds this project. + +Appears in: + +* `+QUICKSTART-DEV.adoc+` + +==== `+{{BUILD_OUTPUT_PATH}}+` + +Where the build artefact lands. + +Appears in: + +* `+QUICKSTART-MAINTAINER.adoc+` + +==== `+{{CONSUMER1}}+` + +A downstream repo that consumes this one. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{CONSUMER2}}+` + +A second downstream consumer. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{DEP1}}+` + +First named dependency, in .machine_readable/INTENT.contractile. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{DEP2}}+` + +Second named dependency, in .machine_readable/INTENT.contractile. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{DEPS}}+` + +Prose summary of runtime/build dependencies. + +Appears in: + +* `+QUICKSTART-MAINTAINER.adoc+` + +==== `+{{LANG_STACK}}+` + +The language stack, in prose. + +Appears in: + +* `+QUICKSTART-DEV.adoc+` + +==== `+{{MONOREPO_OR_STANDALONE}}+` + +Literally '`monorepo`' or '`standalone`'. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{MUST_INVARIANTS}}+` + +The invariants this project guarantees. Not answerable in a bootstrap; +it is the point of the repo. + +Appears in: + +* `+QUICKSTART-DEV.adoc+` + +==== `+{{ONE_PARAGRAPH_ANTI_PURPOSE}}+` + +A paragraph on what this deliberately is NOT for. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{ONE_PARAGRAPH_PURPOSE}}+` + +A paragraph on what this is for. + +Appears in: + +* `+.machine_readable/INTENT.contractile+` + +==== `+{{PROJECT_UNIQUE_STRENGTH}}+` + +What this does that its alternatives do not. + +Appears in: + +* `+.machine_readable/agent_instructions/methodology.a2ml+` + +==== `+{{TEST_CMD}}+` + +The exact command that runs its tests. + +Appears in: + +* `+QUICKSTART-DEV.adoc+` + +''''' + +Generated by the estate top-up pass. Rationale and the governing rulings +are in `+hyperpolymath/standards+`; the token vocabulary is +`+.machine_readable/ai/PLACEHOLDERS.adoc+` in `+rsr-template-repo+`. diff --git a/REQUIRES_INITIALISATION.md b/REQUIRES_INITIALISATION.md deleted file mode 100644 index 5d8e77d..0000000 --- a/REQUIRES_INITIALISATION.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# REQUIRES INITIALISATION - -**This repository is not finished being set up.** 14 substitution token(s) across 4 file(s) still have no value. - -## Why this is not already done - -This repo was created from `hyperpolymath/rsr-template-repo`. The mint -(`just repo-init`) fills every token that has a single mechanical answer — -owner, repo, author, dates, licence, branch — and it has done so here. - -The tokens below are the ones it *deliberately cannot* answer. They need a -decision or a fact that exists only in your head: what this project is for, -what command builds it, which port the service listens on, whether a PGP key -is held at all. The template's own token vocabulary says as much — you cannot -sensibly answer "required invariants" in a thirty-second bootstrap. - -They were left **visibly unfilled on purpose**. The alternatives were both -worse: inventing plausible values would put confident falsehoods into a -security policy and an architecture document, and silently deleting the -sections would hide the fact that a decision is owed. A visible gap is -honest; a fabricated answer is not. - -## Do not delete this file until every item below is resolved - -This file is the only marker that the work is outstanding. Deleting it early -does not finish the setup, it just conceals it — and the next person or agent -to arrive will reasonably assume the repo is complete. - -- **If you are a person:** delete this file yourself once the last item is done. -- **If you are an agent:** resolve what you legitimately can, leave the rest, - and delete this file only when no token below remains anywhere in the tree. - Do not delete it to make a gate go green. - -Re-running the estate top-up tool will remove this file automatically once -nothing is outstanding, so the safest way to finish is to fix the tokens and -let the check confirm it. - -## What is needed, and where it goes - -### `{{BUILD_CMD}}` - -The exact command that builds this project. - -Appears in: - -- `QUICKSTART-DEV.adoc` - -### `{{BUILD_OUTPUT_PATH}}` - -Where the build artefact lands. - -Appears in: - -- `QUICKSTART-MAINTAINER.adoc` - -### `{{CONSUMER1}}` - -A downstream repo that consumes this one. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{CONSUMER2}}` - -A second downstream consumer. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{DEP1}}` - -First named dependency, in .machine_readable/INTENT.contractile. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{DEP2}}` - -Second named dependency, in .machine_readable/INTENT.contractile. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{DEPS}}` - -Prose summary of runtime/build dependencies. - -Appears in: - -- `QUICKSTART-MAINTAINER.adoc` - -### `{{LANG_STACK}}` - -The language stack, in prose. - -Appears in: - -- `QUICKSTART-DEV.adoc` - -### `{{MONOREPO_OR_STANDALONE}}` - -Literally 'monorepo' or 'standalone'. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{MUST_INVARIANTS}}` - -The invariants this project guarantees. Not answerable in a bootstrap; it is the point of the repo. - -Appears in: - -- `QUICKSTART-DEV.adoc` - -### `{{ONE_PARAGRAPH_ANTI_PURPOSE}}` - -A paragraph on what this deliberately is NOT for. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{ONE_PARAGRAPH_PURPOSE}}` - -A paragraph on what this is for. - -Appears in: - -- `.machine_readable/INTENT.contractile` - -### `{{PROJECT_UNIQUE_STRENGTH}}` - -What this does that its alternatives do not. - -Appears in: - -- `.machine_readable/agent_instructions/methodology.a2ml` - -### `{{TEST_CMD}}` - -The exact command that runs its tests. - -Appears in: - -- `QUICKSTART-DEV.adoc` - ---- - -Generated by the estate top-up pass. Rationale and the governing rulings are -in `hyperpolymath/standards`; the token vocabulary is -`.machine_readable/ai/PLACEHOLDERS.adoc` in `rsr-template-repo`. diff --git a/SECURITY.adoc b/SECURITY.adoc new file mode 100644 index 0000000..8326a6e --- /dev/null +++ b/SECURITY.adoc @@ -0,0 +1,32 @@ +== Security Policy + +=== Reporting Vulnerabilities + +Report security issues to: j.d.a.jewell@open.ac.uk + +Do NOT open public issues for security vulnerabilities. + +=== Security Model + +This repository manages infrastructure configuration. Security +considerations: + +[arabic] +. *Secrets*: Use Ansible Vault for all sensitive data. Never commit +plaintext secrets. +. *Access*: Ansible connects via SSH or local connection. Protect SSH +keys. +. *Privilege*: Tasks escalate to root only when necessary. Sudo rules +use drop-in files. +. *Containers*: Podman runs rootless (user namespace isolation). +. *Firewall*: Default deny policy. Only explicitly allowed services are +accessible. +. *Audit*: The reflexive_reporter callback logs all state changes. + +=== Supported Versions + +[cols=",",options="header",] +|=== +|Version |Supported +|1.0.x |Yes +|=== diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 4b044e1..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,25 +0,0 @@ - -# Security Policy - -## Reporting Vulnerabilities - -Report security issues to: j.d.a.jewell@open.ac.uk - -Do NOT open public issues for security vulnerabilities. - -## Security Model - -This repository manages infrastructure configuration. Security considerations: - -1. **Secrets**: Use Ansible Vault for all sensitive data. Never commit plaintext secrets. -2. **Access**: Ansible connects via SSH or local connection. Protect SSH keys. -3. **Privilege**: Tasks escalate to root only when necessary. Sudo rules use drop-in files. -4. **Containers**: Podman runs rootless (user namespace isolation). -5. **Firewall**: Default deny policy. Only explicitly allowed services are accessible. -6. **Audit**: The reflexive_reporter callback logs all state changes. - -## Supported Versions - -| Version | Supported | -|---------|-----------| -| 1.0.x | Yes | diff --git a/TEST-NEEDS.adoc b/TEST-NEEDS.adoc new file mode 100644 index 0000000..fc87f81 --- /dev/null +++ b/TEST-NEEDS.adoc @@ -0,0 +1,143 @@ +== Test-Needs Summary — CRG C Achieved + +=== CRG Grade: C — ACHIEVED 2026-04-04 + +=== Grade: C (Code Review Grade C) + +*Status*: PASSING (44 tests, 0 failures) + +==== Test Coverage Checklist + +* [x] *Unit Tests* (8/8 PASS) +** Ansible playbook file existence +** Role directory structure validation +** Role tasks/main.yml presence +** Inventory file structure +** YAML non-empty validation +** Role meta/main.yml presence +** ansible.cfg existence +* [x] *Smoke Tests* (7/7 PASS) +** Shell script existence and bash shebang validation +** Critical roles exist (base_packages, users, firewall, services, +monitoring, sudo_config) +** Terraform structure validation +** Hardcoded password detection in playbooks +** Terraform modules directory +** Inventory completeness +** ansible.cfg readability +* [x] *Property-Based Tests* (6/6 PASS) +** YAML file readability (100 iterations per file) +** Role directory naming convention (lowercase-underscore) +** Role tasks/main.yml non-empty validation +** Group vars structure pattern validation +** Playbook YAML validity +** Handler existence in roles +* [x] *E2E Contract Tests* (7/7 PASS) +** site.yml imports all critical playbooks +** Playbook role references exist in filesystem +** Inventory group references match group_vars +** Security playbook references firewall and sudo roles +** Base playbook references base_packages and users roles +** Containers playbook references podman role +** All playbooks have valid YAML structure +* [x] *Contract/Invariant Tests* (8/8 PASS) +** INVARIANT: No plaintext passwords in YAML files +** INVARIANT: Firewall role exists (security requirement) +** INVARIANT: Sudo config role exists (privilege management) +** INVARIANT: All roles have meta/main.yml +** INVARIANT: Terraform state files not committed +** INVARIANT: Security playbook has hardening context +** INVARIANT: Privilege escalation is used in critical roles +** INVARIANT: Base configuration includes package management +* [x] *Security Aspect Tests* (8/8 PASS) +** No hardcoded SSH private keys +** No AWS/GCP access keys in Terraform files +** No plaintext HTTP URLs in critical configs +** Firewall defaults to deny policy +** No ignore_errors in security playbooks +** Security playbook uses privilege escalation +** No debug mode in ansible.cfg +** Sudo configuration enforces restrictions +* [x] *Benchmarks* (8/8 PASS) +** Read all ansible playbooks: 546.2 µs avg +** Enumerate all role directories: 176.6 µs avg +** Read inventory hosts.yml: 260.2 µs avg +** Enumerate group_vars: 203.5 µs avg +** Read all terraform main files: 546.2 µs avg +** Enumerate terraform modules: 252.9 µs avg +** Read ansible.cfg: 322.1 µs avg +** Enumerate all scripts: 161.9 µs avg + +==== Test Execution + +[source,bash] +---- +# Run all tests +deno test --allow-read --allow-env tests/ + +# Run benchmarks +deno bench --allow-read tests/bench/ +---- + +==== Repository Structure Validated + +[width="100%",cols="44%,30%,26%",options="header",] +|=== +|Component |Status |Notes +|Playbooks |✓ PASS |6 playbooks (site, base, security, monitoring, +containers, development) + +|Roles |✓ PASS |11 roles with complete structure (tasks/main.yml, +meta/main.yml, defaults/main.yml) + +|Scripts |✓ PASS |3 shell scripts with bash shebang + +|Terraform |✓ PASS |Providers, variables, outputs, versions files +present + +|Inventory |✓ PASS |hosts.yml with group_vars directory + +|ansible.cfg |✓ PASS |Configuration present and valid +|=== + +==== Security Validations + +* ✓ No plaintext passwords detected +* ✓ No hardcoded SSH private keys +* ✓ No AWS/GCP access keys +* ✓ No HTTP (insecure) URLs +* ✓ Firewall role implements deny-by-default +* ✓ Sudo configuration restricts commands +* ✓ Privilege escalation properly documented +* ✓ Terraform state files excluded from version control + +==== Reflexive Test Dimension + +The test suite validates: + +[arabic] +. *Structural Reflexivity*: Tests validate that the test infrastructure +itself is correctly structured +. *Configuration Reflexivity*: Ansible configurations reference each +other consistently +. *Security Reflexivity*: Each playbook respects security boundaries +. *Temporal Reflexivity*: Benchmarks establish baseline performance +metrics + +==== CRG C Milestone + +This repository has achieved *Code Review Grade C* by passing +comprehensive: - Structural unit tests - Rapid smoke tests - +Property-based validation (100 iterations) - End-to-end contract tests - +Security-specific aspect tests - Performance baselines + +All tests are reproducible and maintainable using Deno’s standard test +runner. + +''''' + +*Generated*: 2026-04-04 + +*Test Framework*: Deno (2.7.7) + +*Total Tests*: 44 + +*Failures*: 0 + +*Pass Rate*: 100% diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md deleted file mode 100644 index df770ae..0000000 --- a/TEST-NEEDS.md +++ /dev/null @@ -1,135 +0,0 @@ -# Test-Needs Summary — CRG C Achieved - -## CRG Grade: C — ACHIEVED 2026-04-04 - -## Grade: C (Code Review Grade C) - -**Status**: PASSING (44 tests, 0 failures) - -### Test Coverage Checklist - -- [x] **Unit Tests** (8/8 PASS) - - Ansible playbook file existence - - Role directory structure validation - - Role tasks/main.yml presence - - Inventory file structure - - YAML non-empty validation - - Role meta/main.yml presence - - ansible.cfg existence - -- [x] **Smoke Tests** (7/7 PASS) - - Shell script existence and bash shebang validation - - Critical roles exist (base_packages, users, firewall, services, monitoring, sudo_config) - - Terraform structure validation - - Hardcoded password detection in playbooks - - Terraform modules directory - - Inventory completeness - - ansible.cfg readability - -- [x] **Property-Based Tests** (6/6 PASS) - - YAML file readability (100 iterations per file) - - Role directory naming convention (lowercase-underscore) - - Role tasks/main.yml non-empty validation - - Group vars structure pattern validation - - Playbook YAML validity - - Handler existence in roles - -- [x] **E2E Contract Tests** (7/7 PASS) - - site.yml imports all critical playbooks - - Playbook role references exist in filesystem - - Inventory group references match group_vars - - Security playbook references firewall and sudo roles - - Base playbook references base_packages and users roles - - Containers playbook references podman role - - All playbooks have valid YAML structure - -- [x] **Contract/Invariant Tests** (8/8 PASS) - - INVARIANT: No plaintext passwords in YAML files - - INVARIANT: Firewall role exists (security requirement) - - INVARIANT: Sudo config role exists (privilege management) - - INVARIANT: All roles have meta/main.yml - - INVARIANT: Terraform state files not committed - - INVARIANT: Security playbook has hardening context - - INVARIANT: Privilege escalation is used in critical roles - - INVARIANT: Base configuration includes package management - -- [x] **Security Aspect Tests** (8/8 PASS) - - No hardcoded SSH private keys - - No AWS/GCP access keys in Terraform files - - No plaintext HTTP URLs in critical configs - - Firewall defaults to deny policy - - No ignore_errors in security playbooks - - Security playbook uses privilege escalation - - No debug mode in ansible.cfg - - Sudo configuration enforces restrictions - -- [x] **Benchmarks** (8/8 PASS) - - Read all ansible playbooks: 546.2 µs avg - - Enumerate all role directories: 176.6 µs avg - - Read inventory hosts.yml: 260.2 µs avg - - Enumerate group_vars: 203.5 µs avg - - Read all terraform main files: 546.2 µs avg - - Enumerate terraform modules: 252.9 µs avg - - Read ansible.cfg: 322.1 µs avg - - Enumerate all scripts: 161.9 µs avg - -### Test Execution - -```bash -# Run all tests -deno test --allow-read --allow-env tests/ - -# Run benchmarks -deno bench --allow-read tests/bench/ -``` - -### Repository Structure Validated - -| Component | Status | Notes | -|-----------|--------|-------| -| Playbooks | ✓ PASS | 6 playbooks (site, base, security, monitoring, containers, development) | -| Roles | ✓ PASS | 11 roles with complete structure (tasks/main.yml, meta/main.yml, defaults/main.yml) | -| Scripts | ✓ PASS | 3 shell scripts with bash shebang | -| Terraform | ✓ PASS | Providers, variables, outputs, versions files present | -| Inventory | ✓ PASS | hosts.yml with group_vars directory | -| ansible.cfg | ✓ PASS | Configuration present and valid | - -### Security Validations - -- ✓ No plaintext passwords detected -- ✓ No hardcoded SSH private keys -- ✓ No AWS/GCP access keys -- ✓ No HTTP (insecure) URLs -- ✓ Firewall role implements deny-by-default -- ✓ Sudo configuration restricts commands -- ✓ Privilege escalation properly documented -- ✓ Terraform state files excluded from version control - -### Reflexive Test Dimension - -The test suite validates: - -1. **Structural Reflexivity**: Tests validate that the test infrastructure itself is correctly structured -2. **Configuration Reflexivity**: Ansible configurations reference each other consistently -3. **Security Reflexivity**: Each playbook respects security boundaries -4. **Temporal Reflexivity**: Benchmarks establish baseline performance metrics - -### CRG C Milestone - -This repository has achieved **Code Review Grade C** by passing comprehensive: -- Structural unit tests -- Rapid smoke tests -- Property-based validation (100 iterations) -- End-to-end contract tests -- Security-specific aspect tests -- Performance baselines - -All tests are reproducible and maintainable using Deno's standard test runner. - ---- - -**Generated**: 2026-04-04 -**Test Framework**: Deno (2.7.7) -**Total Tests**: 44 -**Failures**: 0 -**Pass Rate**: 100% diff --git a/TOPOLOGY.md b/TOPOLOGY.adoc similarity index 98% rename from TOPOLOGY.md rename to TOPOLOGY.adoc index a3c78e2..fbf9636 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.adoc @@ -1,8 +1,8 @@ -# TOPOLOGY — infrastructure-automation +== TOPOLOGY — infrastructure-automation -## System Architecture +=== System Architecture -``` +.... ┌─────────────────────────────────────────────────────────────────────┐ │ infrastructure-automation │ │ │ @@ -55,11 +55,11 @@ │ firewalld │ │ Managed via │ │ users/groups │ │ Docker-compat API │ └──────────────────┘ └──────────────────┘ -``` +.... -## Completion Dashboard +=== Completion Dashboard -``` +.... Component Progress ──────────────────────────────────────────────── Ansible Roles [██████████] 100% 11/11 roles @@ -74,11 +74,11 @@ Justfile [██████████] 100% all recipes RSR Compliance [██████████] 100% SCM + manifest + template ──────────────────────────────────────────────── Overall [██████████] 100% -``` +.... -## Key Dependencies +=== Key Dependencies -``` +.... Salt → Ansible Role Mapping ──────────────────────────────────── Salt State Ansible Role @@ -104,4 +104,4 @@ Ansible configures container hosts ↓ handlers restart containers Terraform tracks lifecycle state ──────────────────────────────────── -``` +.... diff --git a/docs/tech-debt-2026-05-26.adoc b/docs/tech-debt-2026-05-26.adoc new file mode 100644 index 0000000..825b1fc --- /dev/null +++ b/docs/tech-debt-2026-05-26.adoc @@ -0,0 +1,71 @@ +== Tech-Debt Audit — infrastructure-automation — 2026-05-26 + +*Source:* estate-wide automated scan 2026-05-26. *Companion:* +https://github.com/hyperpolymath/standards/tree/main/docs/audits[`+hyperpolymath/standards+` +2026-05-26-estate-*-debt audits]. *Combined severity:* `+MEDIUM+`. + +This file records the _raw findings_ — it does not by itself fix the +debt. Each section ends with a '`Recommended next move`' line; closing +the debt is follow-up work. + +=== 1. Proof debt + +No proof-bearing files (`+*.v+`, `+*.lean+`, `+*.agda+`, `+*.idr+`, +`+*.idr2+`, `+*.fst+`, `+*.dfy+`, `+*.tla+`, `+*.ads+`, `+*.adb+`) found +in this repo. + +*Recommended next move:* none. + +=== 2. Licence debt + +[cols=",",options="header",] +|=== +|Field |Value +|LICENSE file |`+LICENSE+` +|SPDX header |`+MPL-2.0+` +|Manifest licence |`+NONE+` +|Body classifier |`+Palimp-MPL-2.0+` +|Severity |`+ok+` +|=== + +*Recommended next move:* none for licence. + +=== 3. Documentation debt + +[cols=",",options="header",] +|=== +|Field |Value +|README lines |96 +|`+docs/+` files |5 +|`+docs/+` LoC |1080 +|CHANGELOG.md |N +|CONTRIBUTING.md |Y +|CODE_OF_CONDUCT.md |Y +|SECURITY.md |Y +|Severity |`+MEDIUM+` +|=== + +*Recommended next move:* introduce a `+docs/+` directory. The README at +96 lines has likely grown to do the work of `+docs/+` — split it into a +thin README + `+docs/architecture.md+`, `+docs/usage.md+`, etc. +Heavy-wiki exemplars to copy from: `+affinescript+`, `+boj-server+`, +`+echidna+`, `+hypatia+`. + +Additionally: *CHANGELOG.md is missing.* 65% of estate repos lack one — +adopting a CHANGELOG (or auto-generating via `+git-cliff+`) is a +recommended estate-wide follow-up. + +=== Cross-references + +* Estate proof-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md+` +* Estate licence-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md+` +* Estate documentation-debt audit: +`+hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md+` + +''''' + +🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). +This file is informational — closing the debt is follow-up work owned by +the maintainer. diff --git a/docs/tech-debt-2026-05-26.md b/docs/tech-debt-2026-05-26.md deleted file mode 100644 index e944461..0000000 --- a/docs/tech-debt-2026-05-26.md +++ /dev/null @@ -1,57 +0,0 @@ - - -# Tech-Debt Audit — infrastructure-automation — 2026-05-26 - -**Source:** estate-wide automated scan 2026-05-26. -**Companion:** [`hyperpolymath/standards` 2026-05-26-estate-*-debt audits](https://github.com/hyperpolymath/standards/tree/main/docs/audits). -**Combined severity:** `MEDIUM`. - -This file records the *raw findings* — it does not by itself fix the debt. Each section ends with a 'Recommended next move' line; closing the debt is follow-up work. - -## 1. Proof debt - -No proof-bearing files (`*.v`, `*.lean`, `*.agda`, `*.idr`, `*.idr2`, `*.fst`, `*.dfy`, `*.tla`, `*.ads`, `*.adb`) found in this repo. - -**Recommended next move:** none. - -## 2. Licence debt - -| Field | Value | -|---|---| -| LICENSE file | `LICENSE` | -| SPDX header | `MPL-2.0` | -| Manifest licence | `NONE` | -| Body classifier | `Palimp-MPL-2.0` | -| Severity | `ok` | - -**Recommended next move:** none for licence. - -## 3. Documentation debt - -| Field | Value | -|---|---| -| README lines | 96 | -| `docs/` files | 5 | -| `docs/` LoC | 1080 | -| CHANGELOG.md | N | -| CONTRIBUTING.md | Y | -| CODE_OF_CONDUCT.md | Y | -| SECURITY.md | Y | -| Severity | `MEDIUM` | - -**Recommended next move:** introduce a `docs/` directory. The README at 96 lines has likely grown to do the work of `docs/` — split it into a thin README + `docs/architecture.md`, `docs/usage.md`, etc. Heavy-wiki exemplars to copy from: `affinescript`, `boj-server`, `echidna`, `hypatia`. - -Additionally: **CHANGELOG.md is missing.** 65% of estate repos lack one — adopting a CHANGELOG (or auto-generating via `git-cliff`) is a recommended estate-wide follow-up. - -## Cross-references - -- Estate proof-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-proof-debt.md` -- Estate licence-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-licence-debt.md` -- Estate documentation-debt audit: `hyperpolymath/standards/docs/audits/2026-05-26-estate-documentation-debt.md` - ---- - -🤖 Generated by Claude Code estate-wide tech-debt scan (2026-05-26). This file is informational — closing the debt is follow-up work owned by the maintainer. diff --git a/llm-warmup-dev.adoc b/llm-warmup-dev.adoc new file mode 100644 index 0000000..494cb26 --- /dev/null +++ b/llm-warmup-dev.adoc @@ -0,0 +1,19 @@ +== LLM Warmup — infrastructure-automation (Developer) + +=== What is infrastructure-automation? + +See README.adoc for overview. + +=== Key Commands + +* `+just setup+` — set up development environment +* `+just build+` — build the project +* `+just test+` — run tests +* `+just doctor+` — diagnose issues +* `+just heal+` — attempt auto-repair + +=== Quick Context + +* License: MPL-2.0 +* Part of hyperpolymath ecosystem +* See EXPLAINME.adoc for architecture diff --git a/llm-warmup-dev.md b/llm-warmup-dev.md deleted file mode 100644 index a232870..0000000 --- a/llm-warmup-dev.md +++ /dev/null @@ -1,16 +0,0 @@ -# LLM Warmup — infrastructure-automation (Developer) - -## What is infrastructure-automation? -See README.adoc for overview. - -## Key Commands -- `just setup` — set up development environment -- `just build` — build the project -- `just test` — run tests -- `just doctor` — diagnose issues -- `just heal` — attempt auto-repair - -## Quick Context -- License: MPL-2.0 -- Part of hyperpolymath ecosystem -- See EXPLAINME.adoc for architecture diff --git a/llm-warmup-user.adoc b/llm-warmup-user.adoc new file mode 100644 index 0000000..0c47aca --- /dev/null +++ b/llm-warmup-user.adoc @@ -0,0 +1,19 @@ +== LLM Warmup — infrastructure-automation (User) + +=== What is infrastructure-automation? + +See README.adoc for overview. + +=== Key Commands + +* `+just setup+` — set up development environment +* `+just build+` — build the project +* `+just test+` — run tests +* `+just doctor+` — diagnose issues +* `+just heal+` — attempt auto-repair + +=== Quick Context + +* License: MPL-2.0 +* Part of hyperpolymath ecosystem +* See EXPLAINME.adoc for architecture diff --git a/llm-warmup-user.md b/llm-warmup-user.md deleted file mode 100644 index 6bc990c..0000000 --- a/llm-warmup-user.md +++ /dev/null @@ -1,16 +0,0 @@ -# LLM Warmup — infrastructure-automation (User) - -## What is infrastructure-automation? -See README.adoc for overview. - -## Key Commands -- `just setup` — set up development environment -- `just build` — build the project -- `just test` — run tests -- `just doctor` — diagnose issues -- `just heal` — attempt auto-repair - -## Quick Context -- License: MPL-2.0 -- Part of hyperpolymath ecosystem -- See EXPLAINME.adoc for architecture