From f2240c318198072155ab2ab5c00279f5b3c3f710 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 14:48:22 +0100
Subject: [PATCH 1/3] chore: estate-wide security compliance
---
.github/workflows/boj-build.yml | 1 +
.github/workflows/codeql.yml | 1 +
.github/workflows/dependabot-automerge.yml | 1 +
.github/workflows/dogfood-gate.yml | 1 +
.github/workflows/e2e.yml | 1 +
.github/workflows/governance.yml | 1 +
.github/workflows/hypatia-scan.yml | 1 +
.github/workflows/instant-sync.yml | 1 +
.github/workflows/mirror.yml | 1 +
.github/workflows/openssf-compliance.yml | 1 +
.github/workflows/push-email-notify.yml | 1 +
.github/workflows/release.yml | 1 +
.github/workflows/rhodibot.yml | 1 +
.github/workflows/rust-ci.yml | 1 +
.github/workflows/scorecard.yml | 1 +
.github/workflows/secret-scanner.yml | 1 +
.github/workflows/static-analysis-gate.yml | 1 +
17 files changed, 17 insertions(+)
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index f933154..d5947f7 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -13,6 +13,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c475caf..7282f84 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,7 @@ concurrency:
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 92b5254..df25cd2 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -41,6 +41,7 @@ on:
types: [opened, reopened, synchronize]
permissions:
+ actions: read
contents: write # needed to enable auto-merge
pull-requests: write # needed to approve
# NB: keep narrow — do NOT add secrets: read or id-token: write here.
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index a9b8da5..d779ba4 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -13,6 +13,7 @@ on:
branches: [main, master]
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index f4ee3ec..aae9e9c 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -31,6 +31,7 @@ on:
workflow_dispatch:
permissions: read-all
+ actions: read
concurrency:
group: e2e-${{ github.ref }}
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 62bbc98..906741d 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -27,6 +27,7 @@ concurrency:
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 2e7e939..013c95a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -19,6 +19,7 @@ concurrency:
cancel-in-progress: true
permissions:
+ actions: read
contents: read
security-events: write
pull-requests: write
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index d022c3e..4549ef2 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -9,6 +9,7 @@ on:
types: [published]
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 81e9903..c25d3bc 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -7,6 +7,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/openssf-compliance.yml b/.github/workflows/openssf-compliance.yml
index c2262ed..c64346f 100644
--- a/.github/workflows/openssf-compliance.yml
+++ b/.github/workflows/openssf-compliance.yml
@@ -11,6 +11,7 @@ on:
workflow_dispatch:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 4b4e754..112afd1 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -7,6 +7,7 @@ name: Push email notification
on:
push: {}
permissions:
+ actions: read
contents: read
jobs:
notify:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e49a7b5..3e640db 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,7 @@ on:
- 'v*'
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index a82f178..3ed59b5 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -21,6 +21,7 @@ on:
types: [completed]
permissions:
+ actions: read
contents: write
pull-requests: write
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 5225c12..b4bfb3d 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -10,6 +10,7 @@ on:
pull_request:
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 64ac2ac..f0c8699 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -9,6 +9,7 @@ on:
branches: [main]
permissions: read-all
+ actions: read
jobs:
analysis:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index b3486fc..4839d60 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -11,6 +11,7 @@ concurrency:
cancel-in-progress: true
permissions:
+ actions: read
contents: read
jobs:
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index e48efaf..95c32e5 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -10,6 +10,7 @@ on:
branches: [main, master]
permissions:
+ actions: read
contents: read
jobs:
From bb0dbcebdeda91fa04c97a5ef51a5255497423f0 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sun, 26 Jul 2026 15:10:17 +0100
Subject: [PATCH 2/3] chore: remove duplicate GOVERNANCE files, keep
GOVERNANCE.md
---
.github/GOVERNANCE.md | 158 ------------------------------------------
1 file changed, 158 deletions(-)
delete mode 100644 .github/GOVERNANCE.md
diff --git a/.github/GOVERNANCE.md b/.github/GOVERNANCE.md
deleted file mode 100644
index 8ade3cc..0000000
--- a/.github/GOVERNANCE.md
+++ /dev/null
@@ -1,158 +0,0 @@
-
-
-# Project Governance
-
-This document describes the governance model for **Nesy Solver**.
-
----
-
-## Project Governance Model
-
-Nesy Solver follows a **Benevolent Dictator For Life (BDFL)** governance model.
-This model is well-suited for solo maintainers and small project teams where rapid,
-consistent decision-making is more valuable than formal consensus processes.
-
-The BDFL has final authority on all project decisions, including technical direction,
-release schedules, contributor access, and community standards.
-
-> **Transition clause:** When the core team exceeds three active maintainers, this
-> project should transition to a **consensus-based governance model** with documented
-> voting procedures. That transition should itself be recorded as an Architecture
-> Decision Record (ADR) in `docs/decisions/`.
-
----
-
-## Decision Making
-
-### Day-to-day decisions
-
-- The BDFL makes final decisions on all matters.
-- Routine decisions (bug fixes, dependency updates, minor improvements) may be made
- by any maintainer with commit access.
-- Maintainers are expected to use good judgement and seek input on non-trivial changes.
-
-### Proposing changes
-
-- Contributors can propose changes by opening issues or pull requests.
-- Significant changes (new features, breaking changes, architectural shifts) should
- be discussed in an issue before implementation begins.
-- The BDFL will provide a clear accept/reject decision with reasoning.
-
-### Architecture Decision Records (ADRs)
-
-- Significant technical decisions are documented as ADRs in `docs/decisions/`.
-- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`.
-- ADRs provide a historical record of why decisions were made and what alternatives
- were considered.
-- See `.machine_readable/META.a2ml` for the machine-readable ADR index.
-
----
-
-## Roles
-
-### BDFL (Benevolent Dictator For Life)
-
-- The project creator and ultimate decision-maker.
-- Sets the project's technical direction and long-term vision.
-- Has final say on all matters, including maintainer appointments and removals.
-- Responsible for ensuring the project adheres to RSR standards.
-
-### Maintainer
-
-- Has commit access to the repository.
-- Reviews and merges pull requests.
-- Triages issues and manages releases.
-- Upholds code quality, security standards, and the Code of Conduct.
-- Listed in [MAINTAINERS.md](MAINTAINERS.md).
-
-### Contributor
-
-- Anyone who submits pull requests, opens issues, or participates in discussions.
-- Does not have direct commit access.
-- Contributions are reviewed by maintainers before merging.
-- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md).
-
-### Bot
-
-- Automated agents managed via your bot orchestration system.
-- Perform automated code review, security scanning, dependency updates, and
- standards enforcement.
-- Bot actions are subject to the same quality and review standards as human
- contributions.
-- Configure your bots in `.machine_readable/bot_directives/`.
-
----
-
-## Becoming a Maintainer
-
-A contributor may be nominated to become a maintainer when they demonstrate:
-
-1. **Sustained quality contributions** -- a track record of well-crafted pull requests
- that follow project conventions and require minimal revision.
-2. **Understanding of RSR standards** -- familiarity with the Repository Structure
- Requirements, security policies, and CI/CD workflows used across the project.
-3. **Constructive participation** -- helpful issue triage, thoughtful code review
- comments, and mentoring of other contributors.
-4. **Reliability** -- consistent engagement over a meaningful period (typically 3+
- months of active contribution).
-
-### Process
-
-1. An existing maintainer nominates the candidate by opening a private discussion
- with the BDFL.
-2. The BDFL reviews the candidate's contribution history and community interactions.
-3. The BDFL approves or declines the nomination, with reasoning provided to the
- nominator.
-4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and
- granted appropriate repository access.
-
----
-
-## Removing a Maintainer
-
-A maintainer may be removed under the following circumstances:
-
-- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive
- months. The maintainer will be contacted before removal and offered the option to
- move to emeritus status voluntarily.
-- **Code of Conduct violation**: Behaviour that violates the
- [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement
- process described therein.
-- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g.,
- repeated disregard for project standards, loss of trust). Reasoning will be
- documented privately.
-
-Removed maintainers are moved to the Emeritus section of
-[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct
-violation.
-
----
-
-## Code of Conduct
-
-All participants in this project are expected to follow the
-[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project
-spaces, including issues, pull requests, discussions, and any forum where the project
-is represented.
-
-Enforcement of the Code of Conduct is described in that document. The BDFL serves as
-the final arbiter in conduct disputes.
-
----
-
-## Amendments
-
-This governance document may be amended by the BDFL at any time. All amendments will
-be:
-
-1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change.
-2. Committed to the repository with a clear commit message.
-3. Communicated to existing maintainers and contributors via the project's usual
- channels.
-
-Substantive changes (e.g., changing the governance model itself) should be discussed
-with the community before adoption, even though the BDFL retains final authority.
-
----
-
-Copyright (c) 2026 hyperpolymath. Licensed under MPL-2.0.
From 32730a02ca7337f8c714ae2cec03262589a44532 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Tue, 28 Jul 2026 06:23:13 +0100
Subject: [PATCH 3/3] chore: fill or remove RSR template placeholders
openssf-compliance.yml fails when any of the thirteen files it checks
still contains a {{PLACEHOLDER}} token. This clears them.
Three kinds of change, no invention:
The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment
is deleted. The template says to delete it, and it is where every legend
line lives -- so a large share of the reported tokens were the file
documenting its own placeholders, not real unfilled fields.
Tokens derivable from the repository are filled: owner and repo from the
git remote, project name, year, forge, main branch, contact email.
PGP and website lines are removed rather than filled, because nothing
true could go in them. https://github.com/.gpg returns HTTP 200 for
every account; with no key uploaded the body is a stub reading "This user
hasnt uploaded any GPG keys". No key is published for either account
here, and commit signing in this estate is SSH, which is unrelated. Only
one repository in the estate has a domain, so {{WEBSITE}} likewise has no
correct value. The template sanctions this: "Optional: Remove sections
that dont apply (e.g. PGP if you dont use it)." A security policy telling
a researcher to encrypt to a key that does not exist is worse than one
that does not mention encryption.
Co-Authored-By: Claude Opus 5
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
.github/SECURITY.md | 18 ------------------
1 file changed, 18 deletions(-)
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
index b25c43d..dc7f56b 100644
--- a/.github/SECURITY.md
+++ b/.github/SECURITY.md
@@ -1,23 +1,5 @@
# Security Policy
-
-
We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions.
## Table of Contents