From 0f964ff63d4c061bee25821cab693760342dd3e9 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:50:00 +0100 Subject: [PATCH 1/4] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + 11 files changed, 11 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index dba7fc8..786b8fb 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -16,4 +16,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index e6af13d..11741ac 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index c475caf..7282f84 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index a9f5c7c..bcbfd8b 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 228dc43..0f86f6c 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..c25d3bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..112afd1 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3ba3bac..599c64a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,6 +16,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: From 57c570732d80cac54d4a6b16e134e69fb277160d Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:00:29 +0100 Subject: [PATCH 2/4] chore: update guix.scm from squisher-corpus --- guix.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guix.scm b/guix.scm index d42a768..c6dd7be 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for polyglot-formalisms-elixir +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "polyglot-formalisms-elixir") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "polyglot-formalisms-elixir") - (description "polyglot-formalisms-elixir — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/polyglot-formalisms-elixir") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license"))) From 62b8068d2089f90d07f2ff12119215602da7da6e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Fri, 31 Jul 2026 09:26:17 +0100 Subject: [PATCH 3/4] test: add pilot Idris2 and Elixir zigzag tests --- test/zigzag/zigzag_test.exs | 42 ++++++++++++++++++++++++++++++++++++ tests/zigzag/ZigzagModel.idr | 30 ++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100755 test/zigzag/zigzag_test.exs create mode 100755 tests/zigzag/ZigzagModel.idr diff --git a/test/zigzag/zigzag_test.exs b/test/zigzag/zigzag_test.exs new file mode 100755 index 0000000..4f3632d --- /dev/null +++ b/test/zigzag/zigzag_test.exs @@ -0,0 +1,42 @@ +defmodule ZigzagTest do + use ExUnit.Case, async: true + use ExUnitProperties + + @moduledoc """ + Zigzag test implementation: Meandering routes through the system aspects. + """ + + # Define aspects + @aspects [:auth, :db, :network, :telemetry] + + property "meandering route maintains cross-cutting invariants" do + check all steps <- list_of(member_of(@aspects), min_length: 5, max_length: 50) do + # Initial system state + state = %{auth: false, db_connected: true, metrics: 0} + + final_state = + Enum.reduce(steps, state, fn aspect, acc -> + # Execute the aspect transition (simulated) + case aspect do + :auth -> + %{acc | auth: not acc.auth, metrics: acc.metrics + 1} + :db -> + # DB might disconnect and reconnect + %{acc | db_connected: not acc.db_connected, metrics: acc.metrics + 1} + :network -> + acc + :telemetry -> + %{acc | metrics: acc.metrics + 1} + end + end) + + # Cross-cutting invariants that MUST hold after a chaotic meandering route: + # Invariant 1: Metrics should never be negative + assert final_state.metrics >= 0 + + # Invariant 2: (Simulated) if we finish the route, the DB should ultimately be able to reconnect + # or if it's disconnected, it shouldn't crash the next read. + assert is_boolean(final_state.db_connected) + end + end +end diff --git a/tests/zigzag/ZigzagModel.idr b/tests/zigzag/ZigzagModel.idr new file mode 100755 index 0000000..8ed3275 --- /dev/null +++ b/tests/zigzag/ZigzagModel.idr @@ -0,0 +1,30 @@ +module ZigzagModel + +-- Idris2 state machine for aspect-oriented zigzag testing + +data Aspect = Auth | DB | Network | Telemetry + +record SystemState where + constructor MkSystemState + isAuthenticated : Bool + dbConnected : Bool + metricsCount : Nat + +-- Define the transitions +transition : Aspect -> SystemState -> SystemState +transition Auth state = record { isAuthenticated = not state.isAuthenticated, metricsCount = S state.metricsCount } state +transition DB state = record { dbConnected = not state.dbConnected, metricsCount = S state.metricsCount } state +transition Network state = state +transition Telemetry state = record { metricsCount = S state.metricsCount } state + +-- Proof that metrics never decrease during a transition +metricsNeverDecrease : (a : Aspect) -> (s : SystemState) -> (transition a s).metricsCount >= s.metricsCount +metricsNeverDecrease Auth s = LTEZero -- (simplified proof stub) +metricsNeverDecrease DB s = LTEZero +metricsNeverDecrease Network s = LTEZero +metricsNeverDecrease Telemetry s = LTEZero + +-- A meandering route is just a list of aspects applied sequentially +meander : List Aspect -> SystemState -> SystemState +meander [] s = s +meander (x :: xs) s = meander xs (transition x s) From b6d9d85226c624ff047c2ead817f7d7ef4ea6e44 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:44:24 +0100 Subject: [PATCH 4/4] fix(ci): remove erroneous squisher-corpus guix.scm placeholder Part of estate-wide standards#426 remediation - cleanup. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- guix.scm | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 guix.scm diff --git a/guix.scm b/guix.scm deleted file mode 100644 index c6dd7be..0000000 --- a/guix.scm +++ /dev/null @@ -1,18 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for squisher-corpus -;; Usage: guix shell -f guix.scm - -(use-modules (guix packages) - (guix build-system gnu) - (guix licenses)) - -(package - (name "squisher-corpus") - (version "0.1.0") - (source #f) - (build-system gnu-build-system) - (synopsis "squisher-corpus") - (description "squisher-corpus — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/squisher-corpus") - (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" - "https://github.com/hyperpolymath/palimpsest-license")))