From 51ef4edda2110f7adf1ccafc36c4df6e61a5f30e Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Wed, 26 Aug 2026 18:57:08 +0100 Subject: [PATCH 1/2] fix(k9-svc): evict the implementation, keep the specification (#491) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The removal half of the carve-out. The additive half landed as k9-ecosystem#33 (1,005 files, +57,632/-2,923); this deletes what it received, leaving k9-svc/ as what it was always meant to be — the K9 specification, security analysis and adoption guidance. 1,891 -> 41 files. Every one of the 1,857 deletions was checked against the live k9-ecosystem tree (2,328 blobs, untruncated) before removal: 1,856 have a verified counterpart there. The single exception, scripts/deploy-site.sh, is carried across in k9-ecosystem#34 — this PR must not merge before that one. Load-bearing changes made in the SAME commit, because each would break main on its own: * .machine_readable/scorecards/k9-svc.scorecard.a2ml — all 8 executable `check =` commands pointed at moved paths. They are now status = "manual-only" with the checks removed and provenance kept in `system =`. This scorecard is executed by build-scorecards.sh --check --strict --verify, which IS the required status check "Registry + topology in sync"; leaving the checks in place would have failed every subsequent PR to main, repo-wide. Verified: 0 executable checks reference a moved path; the gate now exits 0 with 74 grounded pass, 0 broken, 0 unrunnable, 0 self-asserted. * Justfile — 6 hardcoded `cd k9-svc/bindings/rust && cargo ...` refs in build/test/fmt/lint/clean removed. 0 residual. * scripts/build-registry.sh + regenerated REGISTRY.a2ml / TOPOLOGY.adoc / COMPLIANCE-DASHBOARD.adoc — the k9-svc row's description now says what the module is rather than what it used to contain. * .hypatia-baseline.json — 18 entries whose target paths no longer exist pruned (122 -> 104). The three register.ncl repeats were kept: they are the same path under three different rule modules, not duplicates. * GUIDE.adoc / TESTING.adoc / README.adoc — 28 relative links into examples/ rewritten to absolute k9-ecosystem URLs. The three image:: embeds were deliberately NOT touched: `:imagesdir: assets` is set at GUIDE.adoc:8 and assets/ stays, so rewriting them to assets/foo.svg would have produced assets/assets/foo.svg. Deliberately NOT done: the "K9-SVC contractile validation" job is not renamed. Despite the name it is repo-wide (Mustfile structural checks, zero k9-svc paths) and is a required status check; renaming it without an atomic ruleset update would block every PR to the repository. Co-Authored-By: Claude Opus 5 --- .hypatia-baseline.json | 128 -- .machine_readable/REGISTRY.a2ml | 34 +- .../scorecards/k9-svc.scorecard.a2ml | 48 +- COMPLIANCE-DASHBOARD.adoc | 6 +- Justfile | 8 +- TOPOLOGY.adoc | 2 +- k9-svc/.github/workflows/6scm-sync.yml | 18 - k9-svc/.github/workflows/ci.yml | 95 -- k9-svc/.github/workflows/codeql.yml | 23 - k9-svc/.github/workflows/governance.yml | 27 - k9-svc/.github/workflows/hypatia-scan.yml | 21 - k9-svc/.github/workflows/k9-sign-ci.yml | 264 --- k9-svc/.github/workflows/scorecard.yml | 24 - k9-svc/Containerfile | 104 -- k9-svc/GUIDE.adoc | 32 +- k9-svc/Justfile | 364 ---- k9-svc/README.adoc | 6 +- k9-svc/TESTING.adoc | 8 +- .../validate/.devcontainer/Containerfile | 32 - .../validate/.devcontainer/README.adoc | 27 - .../validate/.devcontainer/devcontainer.json | 69 - k9-svc/actions/validate/.editorconfig | 65 - k9-svc/actions/validate/.envrc | 27 - k9-svc/actions/validate/.gitattributes | 55 - k9-svc/actions/validate/.github/.mailmap | 1 - k9-svc/actions/validate/.github/.nojekyll | 0 .../validate/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/actions/validate/.github/CODEOWNERS | 14 - .../validate/.github/CODE_OF_CONDUCT.md | 327 ---- .../actions/validate/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/actions/validate/.github/FUNDING.yml | 7 - k9-svc/actions/validate/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../.github/ISSUE_TEMPLATE/config.yml | 10 - .../.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/actions/validate/.github/MAINTAINERS | 10 - k9-svc/actions/validate/.github/README.adoc | 1 - k9-svc/actions/validate/.github/SECURITY.md | 406 ----- k9-svc/actions/validate/.github/SUPPORT | 7 - .../validate/.github/copilot-instructions.md | 57 - .../actions/validate/.github/dependabot.yml | 48 - .../validate/.github/pull_request_template.md | 44 - .../validate/.github/workflows/codeql.yml | 23 - .../validate/.github/workflows/governance.yml | 27 - .../.github/workflows/hypatia-scan.yml | 21 - .../validate/.github/workflows/jekyll.yml | 68 - .../validate/.github/workflows/mirror.yml | 15 - .../validate/.github/workflows/release.yml | 131 -- .../validate/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - .../validate/.github/workflows/scorecard.yml | 24 - .../.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/actions/validate/.gitignore | 105 -- k9-svc/actions/validate/.gitlab-ci.yml | 175 -- k9-svc/actions/validate/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - .../validate/.machine_readable/CLADE.a2ml | 26 - .../.machine_readable/ENSAID_CONFIG.a2ml | 96 -- .../validate/.machine_readable/README.adoc | 1 - .../validate/.machine_readable/ai/.clinerules | 43 - .../.machine_readable/ai/.cursorrules | 47 - .../.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - .../validate/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../validate/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/actions/validate/.tool-versions | 9 - k9-svc/actions/validate/.well-known/ai.txt | 18 - .../actions/validate/.well-known/humans.txt | 14 - .../actions/validate/.well-known/security.txt | 11 - k9-svc/actions/validate/0-AI-MANIFEST.a2ml | 121 -- k9-svc/actions/validate/CHANGELOG.adoc | 9 - k9-svc/actions/validate/CONTRIBUTING.adoc | 26 - k9-svc/actions/validate/Containerfile | 41 - k9-svc/actions/validate/Justfile | 910 ---------- k9-svc/actions/validate/LICENSE | 153 -- k9-svc/actions/validate/README.adoc | 168 -- k9-svc/actions/validate/ROADMAP.adoc | 22 - k9-svc/actions/validate/SECURITY.adoc | 16 - k9-svc/actions/validate/action.yml | 55 - .../validate/container/.gatekeeper.yaml | 122 -- .../validate/container/0.1-AI-MANIFEST.a2ml | 143 -- .../actions/validate/container/Containerfile | 136 -- k9-svc/actions/validate/container/README.adoc | 179 -- .../validate/container/compose.example.toml | 135 -- .../actions/validate/container/compose.toml | 70 - k9-svc/actions/validate/container/ct-build.sh | 162 -- .../actions/validate/container/deploy.k9.ncl | 166 -- .../actions/validate/container/entrypoint.sh | 63 - .../actions/validate/container/manifest.toml | 62 - k9-svc/actions/validate/container/vordr.toml | 100 -- k9-svc/actions/validate/contractile.just | 75 - .../validate/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/actions/validate/docs/QUICKSTART.adoc | 24 - k9-svc/actions/validate/docs/README.adoc | 14 - k9-svc/actions/validate/docs/RSR_OUTLINE.adoc | 290 ---- .../validate/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - .../validate/docs/attribution/CITATION.cff | 17 - .../validate/docs/attribution/CITATIONS.adoc | 35 - .../validate/docs/attribution/CODEOWNERS.adoc | 19 - .../docs/attribution/MAINTAINERS.adoc | 47 - .../validate/docs/attribution/README.adoc | 1 - .../docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - .../validate/docs/decisions/README.adoc | 1 - .../docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../docs/developer/ABI-FFI-README.adoc | 384 ----- .../validate/docs/developer/README.adoc | 1 - .../docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../docs/governance/CRG-CRITERIA.a2ml | 108 -- .../docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- .../validate/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - .../validate/docs/governance/TSDM.a2ml | 22 - .../validate/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - .../validate/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- .../actions/validate/docs/practice/.gitkeep | 0 .../docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../docs/practice/AI-CONVENTIONS.adoc | 85 - .../validate/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../docs/reports/0.2-AI-MANIFEST.a2ml | 19 - .../actions/validate/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../validate/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/security/README.adoc | 1 - .../docs/standards/0.2-AI-MANIFEST.a2ml | 11 - .../validate/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/actions/validate/docs/theory/.gitkeep | 0 .../validate/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - .../actions/validate/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - .../validate/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - .../validate/docs/whitepapers/README.adoc | 1 - .../docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - .../validate/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - .../actions/validate/docs/wikis/README.adoc | 15 - .../validate/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/actions/validate/examples/README.adoc | 1 - .../validate/examples/web-project-deno.json | 20 - .../validate/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/actions/validate/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - .../validate/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../features/panic-attacker/README.adoc | 25 - .../features/ssg/0.2-AI-MANIFEST.a2ml | 11 - .../actions/validate/features/ssg/README.adoc | 1 - .../validate/features/ssg/ssg-bootstrap.sh | 48 - .../actions/validate/src/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/actions/validate/src/README.adoc | 1 - .../validate/src/aspects/0.2-AI-MANIFEST.a2ml | 17 - .../actions/validate/src/aspects/README.adoc | 1 - .../aspects/integrity/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/integrity/README.adoc | 1 - .../observability/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/observability/README.adoc | 1 - .../src/aspects/security/0.3-AI-MANIFEST.a2ml | 11 - .../validate/src/aspects/security/README.adoc | 1 - .../validate/src/bridges/0.2-AI-MANIFEST.a2ml | 11 - .../src/contracts/0.2-AI-MANIFEST.a2ml | 11 - .../validate/src/contracts/README.adoc | 1 - .../validate/src/core/0.2-AI-MANIFEST.a2ml | 11 - .../src/definitions/0.2-AI-MANIFEST.a2ml | 11 - .../validate/src/definitions/README.adoc | 1 - .../validate/src/errors/0.2-AI-MANIFEST.a2ml | 11 - .../actions/validate/src/errors/README.adoc | 1 - .../src/interface/0.2-AI-MANIFEST.a2ml | 24 - .../validate/src/interface/README.adoc | 1 - .../src/interface/abi/0.3-AI-MANIFEST.a2ml | 11 - .../validate/src/interface/abi/README.adoc | 1 - .../src/interface/ffi/0.3-AI-MANIFEST.a2ml | 11 - .../validate/src/interface/ffi/README.adoc | 1 - .../validate/src/interface/ffi/build.zig | 94 -- .../interface/ffi/src/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/ffi/src/README.adoc | 1 - .../validate/src/interface/ffi/src/main.zig | 274 --- .../interface/ffi/test/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/ffi/test/README.adoc | 1 - .../interface/ffi/test/integration_test.zig | 182 -- .../interface/generated/0.3-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/README.adoc | 1 - .../src/interface/generated/abi/.gitkeep | 0 .../generated/abi/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/abi/README.adoc | 1 - k9-svc/actions/validate/validate-k9.sh | 346 ---- .../verification/0.1-AI-MANIFEST.a2ml | 27 - .../actions/validate/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../validate/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - .../validate/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - .../validate/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - k9-svc/benchmarks/k9-bench.sh | 382 ----- k9-svc/benchmarks/quick-bench.sh | 80 - k9-svc/bindings/README.adoc | 192 --- .../bindings/deno/.devcontainer/Containerfile | 32 - .../bindings/deno/.devcontainer/README.adoc | 27 - .../deno/.devcontainer/devcontainer.json | 69 - k9-svc/bindings/deno/.editorconfig | 65 - k9-svc/bindings/deno/.envrc | 27 - k9-svc/bindings/deno/.gitattributes | 55 - k9-svc/bindings/deno/.github/.mailmap | 1 - k9-svc/bindings/deno/.github/.nojekyll | 0 .../deno/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/deno/.github/CODEOWNERS | 14 - .../bindings/deno/.github/CODE_OF_CONDUCT.md | 327 ---- k9-svc/bindings/deno/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/bindings/deno/.github/FUNDING.yml | 7 - k9-svc/bindings/deno/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../deno/.github/ISSUE_TEMPLATE/config.yml | 10 - .../deno/.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../deno/.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/bindings/deno/.github/MAINTAINERS | 10 - k9-svc/bindings/deno/.github/README.adoc | 1 - k9-svc/bindings/deno/.github/SECURITY.md | 406 ----- k9-svc/bindings/deno/.github/SUPPORT | 7 - .../deno/.github/copilot-instructions.md | 57 - k9-svc/bindings/deno/.github/dependabot.yml | 48 - .../deno/.github/pull_request_template.md | 44 - .../deno/.github/workflows/codeql.yml | 23 - .../deno/.github/workflows/governance.yml | 27 - .../deno/.github/workflows/hypatia-scan.yml | 21 - .../deno/.github/workflows/jekyll.yml | 68 - .../deno/.github/workflows/mirror.yml | 15 - .../deno/.github/workflows/release.yml | 131 -- .../deno/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - .../deno/.github/workflows/scorecard.yml | 24 - .../deno/.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/bindings/deno/.gitignore | 109 -- k9-svc/bindings/deno/.gitlab-ci.yml | 175 -- k9-svc/bindings/deno/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - .../deno/.machine_readable/CLADE.a2ml | 26 - .../deno/.machine_readable/ENSAID_CONFIG.a2ml | 96 -- .../deno/.machine_readable/README.adoc | 1 - .../deno/.machine_readable/ai/.clinerules | 43 - .../deno/.machine_readable/ai/.cursorrules | 47 - .../deno/.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - .../deno/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../deno/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/bindings/deno/.tool-versions | 9 - k9-svc/bindings/deno/.well-known/ai.txt | 18 - k9-svc/bindings/deno/.well-known/humans.txt | 14 - k9-svc/bindings/deno/.well-known/security.txt | 11 - k9-svc/bindings/deno/0-AI-MANIFEST.a2ml | 121 -- k9-svc/bindings/deno/CHANGELOG.adoc | 9 - k9-svc/bindings/deno/CONTRIBUTING.adoc | 26 - k9-svc/bindings/deno/Containerfile | 41 - k9-svc/bindings/deno/Justfile | 910 ---------- k9-svc/bindings/deno/LICENSE | 153 -- k9-svc/bindings/deno/README.adoc | 159 -- k9-svc/bindings/deno/ROADMAP.adoc | 22 - k9-svc/bindings/deno/SECURITY.adoc | 16 - .../bindings/deno/container/.gatekeeper.yaml | 1 - .../deno/container/0.1-AI-MANIFEST.a2ml | 143 -- k9-svc/bindings/deno/container/Containerfile | 136 -- k9-svc/bindings/deno/container/README.adoc | 179 -- .../deno/container/compose.example.toml | 135 -- k9-svc/bindings/deno/container/compose.toml | 70 - k9-svc/bindings/deno/container/ct-build.sh | 162 -- k9-svc/bindings/deno/container/deploy.k9.ncl | 166 -- k9-svc/bindings/deno/container/entrypoint.sh | 63 - k9-svc/bindings/deno/container/manifest.toml | 62 - k9-svc/bindings/deno/container/vordr.toml | 100 -- k9-svc/bindings/deno/contractile.just | 75 - .../bindings/deno/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/bindings/deno/docs/QUICKSTART.adoc | 24 - k9-svc/bindings/deno/docs/README.adoc | 14 - k9-svc/bindings/deno/docs/RSR_OUTLINE.adoc | 290 ---- .../bindings/deno/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../deno/docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/attribution/CITATION.cff | 17 - .../deno/docs/attribution/CITATIONS.adoc | 35 - .../deno/docs/attribution/CODEOWNERS.adoc | 19 - .../deno/docs/attribution/MAINTAINERS.adoc | 47 - .../deno/docs/attribution/README.adoc | 1 - .../deno/docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - .../bindings/deno/docs/decisions/README.adoc | 1 - .../deno/docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/developer/ABI-FFI-README.adoc | 384 ----- .../bindings/deno/docs/developer/README.adoc | 1 - .../deno/docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../deno/docs/governance/CRG-CRITERIA.a2ml | 108 -- .../deno/docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- .../bindings/deno/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - .../bindings/deno/docs/governance/TSDM.a2ml | 22 - .../bindings/deno/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - .../deno/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../deno/docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- k9-svc/bindings/deno/docs/practice/.gitkeep | 0 .../deno/docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../deno/docs/practice/AI-CONVENTIONS.adoc | 85 - .../bindings/deno/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../deno/docs/reports/0.2-AI-MANIFEST.a2ml | 19 - k9-svc/bindings/deno/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/reports/security/README.adoc | 1 - .../deno/docs/standards/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/deno/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/bindings/deno/docs/theory/.gitkeep | 0 .../deno/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - k9-svc/bindings/deno/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - .../deno/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - .../deno/docs/whitepapers/README.adoc | 1 - .../deno/docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../deno/docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - .../deno/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - k9-svc/bindings/deno/docs/wikis/README.adoc | 15 - .../deno/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/deno/examples/README.adoc | 1 - .../deno/examples/web-project-deno.json | 20 - .../deno/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/bindings/deno/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - .../deno/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../deno/features/panic-attacker/README.adoc | 25 - .../deno/features/ssg/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/bindings/deno/features/ssg/README.adoc | 1 - .../deno/features/ssg/ssg-bootstrap.sh | 48 - k9-svc/bindings/deno/jsr.json | 18 - k9-svc/bindings/deno/mod.affine | 53 - k9-svc/bindings/deno/src/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/bindings/deno/src/K9.affine | 74 - k9-svc/bindings/deno/src/K9_Parser.affine | 411 ----- k9-svc/bindings/deno/src/K9_Renderer.affine | 171 -- k9-svc/bindings/deno/src/K9_Types.affine | 224 --- k9-svc/bindings/deno/src/README.adoc | 1 - .../deno/src/aspects/0.2-AI-MANIFEST.a2ml | 17 - k9-svc/bindings/deno/src/aspects/README.adoc | 1 - .../aspects/integrity/0.3-AI-MANIFEST.a2ml | 11 - .../deno/src/aspects/integrity/README.adoc | 1 - .../observability/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/observability/README.adoc | 1 - .../src/aspects/security/0.3-AI-MANIFEST.a2ml | 11 - .../deno/src/aspects/security/README.adoc | 1 - .../deno/src/bridges/0.2-AI-MANIFEST.a2ml | 11 - .../deno/src/contracts/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/deno/src/contracts/README.adoc | 1 - .../deno/src/core/0.2-AI-MANIFEST.a2ml | 11 - .../deno/src/definitions/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/deno/src/definitions/README.adoc | 1 - .../deno/src/errors/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/bindings/deno/src/errors/README.adoc | 1 - .../deno/src/interface/0.2-AI-MANIFEST.a2ml | 24 - .../bindings/deno/src/interface/README.adoc | 1 - .../src/interface/abi/0.3-AI-MANIFEST.a2ml | 11 - .../deno/src/interface/abi/README.adoc | 1 - .../src/interface/ffi/0.3-AI-MANIFEST.a2ml | 11 - .../deno/src/interface/ffi/README.adoc | 1 - .../bindings/deno/src/interface/ffi/build.zig | 94 -- .../interface/ffi/src/0.4-AI-MANIFEST.a2ml | 11 - .../deno/src/interface/ffi/src/README.adoc | 1 - .../deno/src/interface/ffi/src/main.zig | 274 --- .../interface/ffi/test/0.4-AI-MANIFEST.a2ml | 11 - .../deno/src/interface/ffi/test/README.adoc | 1 - .../interface/ffi/test/integration_test.zig | 182 -- .../interface/generated/0.3-AI-MANIFEST.a2ml | 11 - .../deno/src/interface/generated/README.adoc | 1 - .../deno/src/interface/generated/abi/.gitkeep | 0 .../generated/abi/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/abi/README.adoc | 1 - .../deno/verification/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/bindings/deno/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../deno/verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../deno/verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../deno/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - .../deno/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../deno/verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../deno/verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - .../deno/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - k9-svc/bindings/elixir/.formatter.exs | 4 - k9-svc/bindings/elixir/.gitignore | 24 - k9-svc/bindings/elixir/LICENSE | 372 ----- k9-svc/bindings/elixir/README.adoc | 148 -- k9-svc/bindings/elixir/lib/k9.ex | 43 - k9-svc/bindings/elixir/lib/k9/parser.ex | 223 --- k9-svc/bindings/elixir/lib/k9/renderer.ex | 120 -- k9-svc/bindings/elixir/lib/k9/types.ex | 218 --- k9-svc/bindings/elixir/mix.exs | 49 - k9-svc/bindings/elixir/test/k9_test.exs | 135 -- k9-svc/bindings/elixir/test/test_helper.exs | 1 - .../bindings/gleam/.github/workflows/test.yml | 24 - k9-svc/bindings/gleam/.gitignore | 4 - k9-svc/bindings/gleam/LICENSE | 372 ----- k9-svc/bindings/gleam/README.adoc | 127 -- k9-svc/bindings/gleam/gleam.toml | 12 - k9-svc/bindings/gleam/manifest.toml | 11 - k9-svc/bindings/gleam/src/k9_gleam.gleam | 39 - .../bindings/gleam/src/k9_gleam/parser.gleam | 368 ----- .../gleam/src/k9_gleam/renderer.gleam | 178 -- .../bindings/gleam/src/k9_gleam/types.gleam | 147 -- .../bindings/gleam/test/k9_gleam_test.gleam | 147 -- .../haskell/.devcontainer/Containerfile | 32 - .../haskell/.devcontainer/README.adoc | 27 - .../haskell/.devcontainer/devcontainer.json | 69 - k9-svc/bindings/haskell/.editorconfig | 65 - k9-svc/bindings/haskell/.envrc | 27 - k9-svc/bindings/haskell/.gitattributes | 55 - k9-svc/bindings/haskell/.github/.mailmap | 1 - k9-svc/bindings/haskell/.github/.nojekyll | 0 .../haskell/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/haskell/.github/CODEOWNERS | 14 - .../haskell/.github/CODE_OF_CONDUCT.md | 327 ---- .../bindings/haskell/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/bindings/haskell/.github/FUNDING.yml | 7 - k9-svc/bindings/haskell/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../haskell/.github/ISSUE_TEMPLATE/config.yml | 10 - .../haskell/.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/bindings/haskell/.github/MAINTAINERS | 10 - k9-svc/bindings/haskell/.github/README.adoc | 1 - k9-svc/bindings/haskell/.github/SECURITY.md | 406 ----- k9-svc/bindings/haskell/.github/SUPPORT | 7 - .../haskell/.github/copilot-instructions.md | 57 - .../bindings/haskell/.github/dependabot.yml | 48 - .../haskell/.github/pull_request_template.md | 44 - .../haskell/.github/workflows/codeql.yml | 23 - .../haskell/.github/workflows/governance.yml | 27 - .../.github/workflows/hypatia-scan.yml | 21 - .../haskell/.github/workflows/jekyll.yml | 68 - .../haskell/.github/workflows/mirror.yml | 15 - .../haskell/.github/workflows/release.yml | 131 -- .../haskell/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - .../haskell/.github/workflows/scorecard.yml | 24 - .../.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/bindings/haskell/.gitignore | 105 -- k9-svc/bindings/haskell/.gitlab-ci.yml | 175 -- k9-svc/bindings/haskell/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - .../haskell/.machine_readable/CLADE.a2ml | 26 - .../.machine_readable/ENSAID_CONFIG.a2ml | 96 -- .../haskell/.machine_readable/README.adoc | 1 - .../haskell/.machine_readable/ai/.clinerules | 43 - .../haskell/.machine_readable/ai/.cursorrules | 47 - .../.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../haskell/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/bindings/haskell/.tool-versions | 9 - k9-svc/bindings/haskell/.well-known/ai.txt | 18 - .../bindings/haskell/.well-known/humans.txt | 14 - .../bindings/haskell/.well-known/security.txt | 11 - k9-svc/bindings/haskell/0-AI-MANIFEST.a2ml | 121 -- k9-svc/bindings/haskell/CHANGELOG.adoc | 19 - k9-svc/bindings/haskell/CONTRIBUTING.adoc | 26 - k9-svc/bindings/haskell/Containerfile | 41 - k9-svc/bindings/haskell/Justfile | 910 ---------- k9-svc/bindings/haskell/LICENSE | 153 -- k9-svc/bindings/haskell/LICENSE-MPL-2.0 | 373 ----- k9-svc/bindings/haskell/README.adoc | 165 -- k9-svc/bindings/haskell/ROADMAP.adoc | 22 - k9-svc/bindings/haskell/SECURITY.adoc | 16 - k9-svc/bindings/haskell/Setup.hs | 3 - .../haskell/container/.gatekeeper.yaml | 1 - .../haskell/container/0.1-AI-MANIFEST.a2ml | 143 -- .../bindings/haskell/container/Containerfile | 136 -- k9-svc/bindings/haskell/container/README.adoc | 179 -- .../haskell/container/compose.example.toml | 135 -- .../bindings/haskell/container/compose.toml | 70 - k9-svc/bindings/haskell/container/ct-build.sh | 162 -- .../bindings/haskell/container/deploy.k9.ncl | 166 -- .../bindings/haskell/container/entrypoint.sh | 63 - .../bindings/haskell/container/manifest.toml | 62 - k9-svc/bindings/haskell/container/vordr.toml | 100 -- k9-svc/bindings/haskell/contractile.just | 75 - .../haskell/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/bindings/haskell/docs/QUICKSTART.adoc | 24 - k9-svc/bindings/haskell/docs/README.adoc | 14 - k9-svc/bindings/haskell/docs/RSR_OUTLINE.adoc | 290 ---- .../haskell/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/docs/attribution/CITATION.cff | 17 - .../haskell/docs/attribution/CITATIONS.adoc | 35 - .../haskell/docs/attribution/CODEOWNERS.adoc | 19 - .../haskell/docs/attribution/MAINTAINERS.adoc | 47 - .../haskell/docs/attribution/README.adoc | 1 - .../docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - .../haskell/docs/decisions/README.adoc | 1 - .../docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../docs/developer/ABI-FFI-README.adoc | 384 ----- .../haskell/docs/developer/README.adoc | 1 - .../docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../haskell/docs/governance/CRG-CRITERIA.a2ml | 108 -- .../haskell/docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- .../haskell/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - .../haskell/docs/governance/TSDM.a2ml | 22 - .../haskell/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - .../haskell/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- .../bindings/haskell/docs/practice/.gitkeep | 0 .../docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/docs/practice/AI-CONVENTIONS.adoc | 85 - .../haskell/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../haskell/docs/reports/0.2-AI-MANIFEST.a2ml | 19 - .../bindings/haskell/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/docs/reports/security/README.adoc | 1 - .../docs/standards/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/bindings/haskell/docs/theory/.gitkeep | 0 .../haskell/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - .../bindings/haskell/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - .../haskell/docs/whitepapers/README.adoc | 1 - .../docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - .../haskell/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - .../bindings/haskell/docs/wikis/README.adoc | 15 - .../haskell/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/haskell/examples/README.adoc | 1 - .../haskell/examples/web-project-deno.json | 20 - .../haskell/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/bindings/haskell/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../features/panic-attacker/README.adoc | 25 - .../haskell/features/ssg/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/haskell/features/ssg/README.adoc | 1 - .../haskell/features/ssg/ssg-bootstrap.sh | 48 - k9-svc/bindings/haskell/k9-haskell.cabal | 53 - .../bindings/haskell/src/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/bindings/haskell/src/Data/K9.hs | 32 - k9-svc/bindings/haskell/src/Data/K9/Parser.hs | 234 --- .../bindings/haskell/src/Data/K9/Renderer.hs | 113 -- k9-svc/bindings/haskell/src/Data/K9/Types.hs | 156 -- k9-svc/bindings/haskell/src/README.adoc | 1 - .../haskell/src/aspects/0.2-AI-MANIFEST.a2ml | 17 - .../bindings/haskell/src/aspects/README.adoc | 1 - .../aspects/integrity/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/src/aspects/integrity/README.adoc | 1 - .../observability/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/observability/README.adoc | 1 - .../src/aspects/security/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/src/aspects/security/README.adoc | 1 - .../haskell/src/bridges/0.2-AI-MANIFEST.a2ml | 11 - .../src/contracts/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/src/contracts/README.adoc | 1 - .../haskell/src/core/0.2-AI-MANIFEST.a2ml | 11 - .../src/definitions/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/src/definitions/README.adoc | 1 - .../haskell/src/errors/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/haskell/src/errors/README.adoc | 1 - .../src/interface/0.2-AI-MANIFEST.a2ml | 24 - .../haskell/src/interface/README.adoc | 1 - .../src/interface/abi/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/src/interface/abi/README.adoc | 1 - .../src/interface/ffi/0.3-AI-MANIFEST.a2ml | 11 - .../haskell/src/interface/ffi/README.adoc | 1 - .../haskell/src/interface/ffi/build.zig | 94 -- .../interface/ffi/src/0.4-AI-MANIFEST.a2ml | 11 - .../haskell/src/interface/ffi/src/README.adoc | 1 - .../haskell/src/interface/ffi/src/main.zig | 274 --- .../interface/ffi/test/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/ffi/test/README.adoc | 1 - .../interface/ffi/test/integration_test.zig | 182 -- .../interface/generated/0.3-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/README.adoc | 1 - .../src/interface/generated/abi/.gitkeep | 0 .../generated/abi/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/abi/README.adoc | 1 - .../haskell/verification/0.1-AI-MANIFEST.a2ml | 27 - .../bindings/haskell/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../haskell/verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - .../haskell/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - .../haskell/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - .../bindings/rust/.devcontainer/Containerfile | 32 - .../bindings/rust/.devcontainer/README.adoc | 27 - .../rust/.devcontainer/devcontainer.json | 69 - k9-svc/bindings/rust/.editorconfig | 65 - k9-svc/bindings/rust/.envrc | 27 - k9-svc/bindings/rust/.gitattributes | 55 - k9-svc/bindings/rust/.github/.mailmap | 1 - k9-svc/bindings/rust/.github/.nojekyll | 0 .../rust/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/rust/.github/CODEOWNERS | 14 - .../bindings/rust/.github/CODE_OF_CONDUCT.md | 327 ---- k9-svc/bindings/rust/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/bindings/rust/.github/FUNDING.yml | 7 - k9-svc/bindings/rust/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../rust/.github/ISSUE_TEMPLATE/config.yml | 10 - .../rust/.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../rust/.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/bindings/rust/.github/MAINTAINERS | 10 - k9-svc/bindings/rust/.github/README.adoc | 1 - k9-svc/bindings/rust/.github/SECURITY.md | 406 ----- k9-svc/bindings/rust/.github/SUPPORT | 7 - .../rust/.github/copilot-instructions.md | 57 - k9-svc/bindings/rust/.github/dependabot.yml | 48 - .../rust/.github/pull_request_template.md | 44 - .../rust/.github/workflows/codeql.yml | 23 - .../rust/.github/workflows/governance.yml | 27 - .../rust/.github/workflows/hypatia-scan.yml | 21 - .../rust/.github/workflows/jekyll.yml | 68 - .../rust/.github/workflows/mirror.yml | 15 - .../rust/.github/workflows/release.yml | 131 -- .../rust/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - .../rust/.github/workflows/scorecard.yml | 24 - .../rust/.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/bindings/rust/.gitignore | 105 -- k9-svc/bindings/rust/.gitlab-ci.yml | 175 -- k9-svc/bindings/rust/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - .../rust/.machine_readable/CLADE.a2ml | 26 - .../rust/.machine_readable/ENSAID_CONFIG.a2ml | 96 -- .../rust/.machine_readable/README.adoc | 1 - .../rust/.machine_readable/ai/.clinerules | 43 - .../rust/.machine_readable/ai/.cursorrules | 47 - .../rust/.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - .../rust/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../rust/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/bindings/rust/.tool-versions | 9 - k9-svc/bindings/rust/.well-known/ai.txt | 18 - k9-svc/bindings/rust/.well-known/humans.txt | 14 - k9-svc/bindings/rust/.well-known/security.txt | 11 - k9-svc/bindings/rust/0-AI-MANIFEST.a2ml | 121 -- k9-svc/bindings/rust/CHANGELOG.adoc | 9 - k9-svc/bindings/rust/CONTRIBUTING.adoc | 26 - k9-svc/bindings/rust/Cargo.lock | 1027 ------------ k9-svc/bindings/rust/Cargo.toml | 33 - k9-svc/bindings/rust/Containerfile | 41 - k9-svc/bindings/rust/Justfile | 910 ---------- k9-svc/bindings/rust/LICENSE | 153 -- k9-svc/bindings/rust/README.adoc | 165 -- k9-svc/bindings/rust/ROADMAP.adoc | 22 - k9-svc/bindings/rust/SECURITY.adoc | 16 - k9-svc/bindings/rust/benches/k9_bench.rs | 204 --- .../bindings/rust/container/.gatekeeper.yaml | 1 - .../rust/container/0.1-AI-MANIFEST.a2ml | 143 -- k9-svc/bindings/rust/container/Containerfile | 136 -- k9-svc/bindings/rust/container/README.adoc | 179 -- .../rust/container/compose.example.toml | 135 -- k9-svc/bindings/rust/container/compose.toml | 70 - k9-svc/bindings/rust/container/ct-build.sh | 162 -- k9-svc/bindings/rust/container/deploy.k9.ncl | 166 -- k9-svc/bindings/rust/container/entrypoint.sh | 63 - k9-svc/bindings/rust/container/manifest.toml | 62 - k9-svc/bindings/rust/container/vordr.toml | 100 -- k9-svc/bindings/rust/contractile.just | 75 - .../bindings/rust/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/bindings/rust/docs/QUICKSTART.adoc | 24 - k9-svc/bindings/rust/docs/README.adoc | 14 - k9-svc/bindings/rust/docs/RSR_OUTLINE.adoc | 290 ---- .../bindings/rust/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../rust/docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/attribution/CITATION.cff | 17 - .../rust/docs/attribution/CITATIONS.adoc | 35 - .../rust/docs/attribution/CODEOWNERS.adoc | 19 - .../rust/docs/attribution/MAINTAINERS.adoc | 47 - .../rust/docs/attribution/README.adoc | 1 - .../rust/docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - .../bindings/rust/docs/decisions/README.adoc | 1 - .../rust/docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/developer/ABI-FFI-README.adoc | 384 ----- .../bindings/rust/docs/developer/README.adoc | 1 - .../rust/docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../rust/docs/governance/CRG-CRITERIA.a2ml | 108 -- .../rust/docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- .../bindings/rust/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - .../bindings/rust/docs/governance/TSDM.a2ml | 22 - .../bindings/rust/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - .../rust/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../rust/docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- k9-svc/bindings/rust/docs/practice/.gitkeep | 0 .../rust/docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../rust/docs/practice/AI-CONVENTIONS.adoc | 85 - .../bindings/rust/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../rust/docs/reports/0.2-AI-MANIFEST.a2ml | 19 - k9-svc/bindings/rust/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/reports/security/README.adoc | 1 - .../rust/docs/standards/0.2-AI-MANIFEST.a2ml | 11 - .../bindings/rust/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/bindings/rust/docs/theory/.gitkeep | 0 .../rust/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - k9-svc/bindings/rust/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - .../rust/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - .../rust/docs/whitepapers/README.adoc | 1 - .../rust/docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../rust/docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - .../rust/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - k9-svc/bindings/rust/docs/wikis/README.adoc | 15 - .../rust/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/bindings/rust/examples/README.adoc | 1 - .../rust/examples/web-project-deno.json | 20 - .../rust/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/bindings/rust/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - .../rust/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../rust/features/panic-attacker/README.adoc | 25 - .../rust/features/ssg/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/bindings/rust/features/ssg/README.adoc | 1 - .../rust/features/ssg/ssg-bootstrap.sh | 48 - k9-svc/bindings/rust/src/error.rs | 75 - k9-svc/bindings/rust/src/lib.rs | 46 - k9-svc/bindings/rust/src/parser.rs | 496 ------ k9-svc/bindings/rust/src/renderer.rs | 172 -- k9-svc/bindings/rust/src/types.rs | 229 --- k9-svc/bindings/rust/tests/crg_c_tests.rs | 580 ------- .../rust/verification/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/bindings/rust/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../rust/verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../rust/verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../rust/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - .../rust/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../rust/verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../rust/verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - .../rust/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - k9-svc/compose.yaml | 54 - k9-svc/eclexiaiser.toml | 26 - k9-svc/editors/k9-notepadpp.xml | 83 - k9-svc/editors/k9.tmLanguage.json | 129 -- .../vscode/.devcontainer/Containerfile | 32 - .../editors/vscode/.devcontainer/README.adoc | 27 - .../vscode/.devcontainer/devcontainer.json | 69 - k9-svc/editors/vscode/.editorconfig | 65 - k9-svc/editors/vscode/.envrc | 27 - k9-svc/editors/vscode/.gitattributes | 55 - k9-svc/editors/vscode/.github/.mailmap | 1 - k9-svc/editors/vscode/.github/.nojekyll | 0 .../vscode/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/editors/vscode/.github/CODEOWNERS | 14 - .../editors/vscode/.github/CODE_OF_CONDUCT.md | 327 ---- k9-svc/editors/vscode/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/editors/vscode/.github/FUNDING.yml | 7 - k9-svc/editors/vscode/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../vscode/.github/ISSUE_TEMPLATE/config.yml | 10 - .../vscode/.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/editors/vscode/.github/MAINTAINERS | 10 - k9-svc/editors/vscode/.github/README.adoc | 1 - k9-svc/editors/vscode/.github/SECURITY.md | 406 ----- k9-svc/editors/vscode/.github/SUPPORT | 7 - .../vscode/.github/copilot-instructions.md | 57 - k9-svc/editors/vscode/.github/dependabot.yml | 48 - .../vscode/.github/pull_request_template.md | 44 - .../vscode/.github/workflows/codeql.yml | 23 - .../vscode/.github/workflows/governance.yml | 27 - .../vscode/.github/workflows/hypatia-scan.yml | 21 - .../vscode/.github/workflows/jekyll.yml | 68 - .../vscode/.github/workflows/mirror.yml | 15 - .../vscode/.github/workflows/release.yml | 131 -- .../vscode/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - .../vscode/.github/workflows/scorecard.yml | 24 - .../.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/editors/vscode/.gitignore | 105 -- k9-svc/editors/vscode/.gitlab-ci.yml | 175 -- k9-svc/editors/vscode/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - .../vscode/.machine_readable/CLADE.a2ml | 26 - .../.machine_readable/ENSAID_CONFIG.a2ml | 96 -- .../vscode/.machine_readable/README.adoc | 1 - .../vscode/.machine_readable/ai/.clinerules | 43 - .../vscode/.machine_readable/ai/.cursorrules | 47 - .../.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../vscode/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/editors/vscode/.tool-versions | 9 - k9-svc/editors/vscode/.well-known/ai.txt | 18 - k9-svc/editors/vscode/.well-known/humans.txt | 14 - .../editors/vscode/.well-known/security.txt | 11 - k9-svc/editors/vscode/0-AI-MANIFEST.a2ml | 121 -- k9-svc/editors/vscode/CHANGELOG.adoc | 9 - k9-svc/editors/vscode/CONTRIBUTING.adoc | 26 - k9-svc/editors/vscode/Containerfile | 41 - k9-svc/editors/vscode/Justfile | 910 ---------- k9-svc/editors/vscode/LICENSE | 153 -- k9-svc/editors/vscode/LICENSE-PMPL | 153 -- k9-svc/editors/vscode/README.adoc | 45 - k9-svc/editors/vscode/ROADMAP.adoc | 22 - k9-svc/editors/vscode/SECURITY.adoc | 16 - .../editors/vscode/container/.gatekeeper.yaml | 1 - .../vscode/container/0.1-AI-MANIFEST.a2ml | 143 -- k9-svc/editors/vscode/container/Containerfile | 136 -- k9-svc/editors/vscode/container/README.adoc | 179 -- .../vscode/container/compose.example.toml | 135 -- k9-svc/editors/vscode/container/compose.toml | 70 - k9-svc/editors/vscode/container/ct-build.sh | 162 -- k9-svc/editors/vscode/container/deploy.k9.ncl | 166 -- k9-svc/editors/vscode/container/entrypoint.sh | 63 - k9-svc/editors/vscode/container/manifest.toml | 62 - k9-svc/editors/vscode/container/vordr.toml | 100 -- k9-svc/editors/vscode/contractile.just | 75 - .../editors/vscode/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/editors/vscode/docs/QUICKSTART.adoc | 24 - k9-svc/editors/vscode/docs/README.adoc | 14 - k9-svc/editors/vscode/docs/RSR_OUTLINE.adoc | 290 ---- .../editors/vscode/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/docs/attribution/CITATION.cff | 17 - .../vscode/docs/attribution/CITATIONS.adoc | 35 - .../vscode/docs/attribution/CODEOWNERS.adoc | 19 - .../vscode/docs/attribution/MAINTAINERS.adoc | 47 - .../vscode/docs/attribution/README.adoc | 1 - .../docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - .../editors/vscode/docs/decisions/README.adoc | 1 - .../docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/docs/developer/ABI-FFI-README.adoc | 384 ----- .../editors/vscode/docs/developer/README.adoc | 1 - .../docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../vscode/docs/governance/CRG-CRITERIA.a2ml | 108 -- .../vscode/docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- .../vscode/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - .../editors/vscode/docs/governance/TSDM.a2ml | 22 - .../editors/vscode/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - .../vscode/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- k9-svc/editors/vscode/docs/practice/.gitkeep | 0 .../vscode/docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/docs/practice/AI-CONVENTIONS.adoc | 85 - .../editors/vscode/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../vscode/docs/reports/0.2-AI-MANIFEST.a2ml | 19 - .../editors/vscode/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/reports/security/README.adoc | 1 - .../docs/standards/0.2-AI-MANIFEST.a2ml | 11 - .../editors/vscode/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/editors/vscode/docs/theory/.gitkeep | 0 .../vscode/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - k9-svc/editors/vscode/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - .../vscode/docs/whitepapers/README.adoc | 1 - .../vscode/docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../vscode/docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - .../vscode/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - k9-svc/editors/vscode/docs/wikis/README.adoc | 15 - .../vscode/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/editors/vscode/examples/README.adoc | 1 - .../vscode/examples/web-project-deno.json | 20 - .../vscode/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/editors/vscode/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../features/panic-attacker/README.adoc | 25 - .../vscode/features/ssg/0.2-AI-MANIFEST.a2ml | 11 - .../editors/vscode/features/ssg/README.adoc | 1 - .../vscode/features/ssg/ssg-bootstrap.sh | 48 - k9-svc/editors/vscode/icons/k9-icon.svg | 14 - .../vscode/language-configuration-nickel.json | 33 - .../vscode/language-configuration.json | 25 - k9-svc/editors/vscode/package.json | 46 - k9-svc/editors/vscode/snippets/k9-nickel.json | 68 - k9-svc/editors/vscode/snippets/k9.json | 79 - .../editors/vscode/src/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/editors/vscode/src/README.adoc | 1 - .../vscode/src/aspects/0.2-AI-MANIFEST.a2ml | 17 - k9-svc/editors/vscode/src/aspects/README.adoc | 1 - .../aspects/integrity/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/src/aspects/integrity/README.adoc | 1 - .../observability/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/observability/README.adoc | 1 - .../src/aspects/security/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/src/aspects/security/README.adoc | 1 - .../vscode/src/bridges/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/src/contracts/0.2-AI-MANIFEST.a2ml | 11 - .../editors/vscode/src/contracts/README.adoc | 1 - .../vscode/src/core/0.2-AI-MANIFEST.a2ml | 11 - .../src/definitions/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/src/definitions/README.adoc | 1 - .../vscode/src/errors/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/editors/vscode/src/errors/README.adoc | 1 - .../vscode/src/interface/0.2-AI-MANIFEST.a2ml | 24 - .../editors/vscode/src/interface/README.adoc | 1 - .../src/interface/abi/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/src/interface/abi/README.adoc | 1 - .../src/interface/ffi/0.3-AI-MANIFEST.a2ml | 11 - .../vscode/src/interface/ffi/README.adoc | 1 - .../vscode/src/interface/ffi/build.zig | 94 -- .../interface/ffi/src/0.4-AI-MANIFEST.a2ml | 11 - .../vscode/src/interface/ffi/src/README.adoc | 1 - .../vscode/src/interface/ffi/src/main.zig | 274 --- .../interface/ffi/test/0.4-AI-MANIFEST.a2ml | 11 - .../vscode/src/interface/ffi/test/README.adoc | 1 - .../interface/ffi/test/integration_test.zig | 182 -- .../interface/generated/0.3-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/README.adoc | 1 - .../src/interface/generated/abi/.gitkeep | 0 .../generated/abi/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/abi/README.adoc | 1 - .../vscode/syntaxes/k9-nickel.tmLanguage.json | 182 -- .../vscode/syntaxes/k9.tmLanguage.json | 104 -- .../vscode/verification/0.1-AI-MANIFEST.a2ml | 27 - .../editors/vscode/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../vscode/verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - .../vscode/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - .../vscode/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - k9-svc/examples/NOT-a-good-fit.adoc | 340 ---- k9-svc/examples/complex.k9 | 28 - k9-svc/examples/config.k9.ncl | 99 -- k9-svc/examples/container-deploy.k9.ncl | 662 -------- k9-svc/examples/conversation-walkthrough.txt | 35 - k9-svc/examples/deploy.k9.ncl | 152 -- k9-svc/examples/hello.k9 | 40 - k9-svc/examples/hello.k9.ncl | 41 - k9-svc/examples/simple.k9 | 40 - k9-svc/k9-scan | 258 --- k9-svc/k9-sign/.gitignore | 14 - k9-svc/k9-sign/Cargo.toml | 40 - k9-svc/k9-sign/MIGRATION.adoc | 493 ------ k9-svc/k9-sign/README.adoc | 212 --- k9-svc/k9-sign/install.sh | 290 ---- k9-svc/k9-sign/src/main.rs | 507 ------ k9-svc/k9-sign/src/tests.rs | 358 ---- k9-svc/lsp/Cargo.lock | 882 ---------- k9-svc/lsp/Cargo.toml | 30 - k9-svc/lsp/README.adoc | 147 -- k9-svc/lsp/src/completions.rs | 292 ---- k9-svc/lsp/src/diagnostics.rs | 558 ------- k9-svc/lsp/src/hover.rs | 361 ---- k9-svc/lsp/src/main.rs | 197 --- k9-svc/manifest.scm | 24 - k9-svc/mime/k9.magic | 11 - k9-svc/mime/k9.uti.plist | 35 - k9-svc/mime/k9.xml | 21 - k9-svc/mime/mime.types | 5 - k9-svc/must | 331 ---- k9-svc/packaging/aur/.SRCINFO | 17 - k9-svc/packaging/aur/PKGBUILD | 74 - k9-svc/packaging/aur/SUBMIT.adoc | 81 - k9-svc/packaging/homebrew/k9-svc.rb | 72 - k9-svc/pandoc/.devcontainer/Containerfile | 32 - k9-svc/pandoc/.devcontainer/README.adoc | 27 - k9-svc/pandoc/.devcontainer/devcontainer.json | 69 - k9-svc/pandoc/.editorconfig | 65 - k9-svc/pandoc/.envrc | 27 - k9-svc/pandoc/.gitattributes | 55 - k9-svc/pandoc/.github/.mailmap | 1 - k9-svc/pandoc/.github/.nojekyll | 0 k9-svc/pandoc/.github/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/pandoc/.github/CODEOWNERS | 14 - k9-svc/pandoc/.github/CODE_OF_CONDUCT.md | 327 ---- k9-svc/pandoc/.github/CONTRIBUTING.md | 121 -- .../.github/DISCUSSION_TEMPLATE/ideas.yml | 13 - .../.github/DISCUSSION_TEMPLATE/q-and-a.yml | 13 - k9-svc/pandoc/.github/FUNDING.yml | 7 - k9-svc/pandoc/.github/GOVERNANCE.md | 158 -- .../.github/ISSUE_TEMPLATE/bug_report.yml | 127 -- .../pandoc/.github/ISSUE_TEMPLATE/config.yml | 10 - .../pandoc/.github/ISSUE_TEMPLATE/custom.yml | 76 - .../.github/ISSUE_TEMPLATE/documentation.yml | 64 - .../ISSUE_TEMPLATE/feature_request.yml | 87 - .../.github/ISSUE_TEMPLATE/question.yml | 60 - k9-svc/pandoc/.github/MAINTAINERS | 10 - k9-svc/pandoc/.github/README.adoc | 1 - k9-svc/pandoc/.github/SECURITY.md | 406 ----- k9-svc/pandoc/.github/SUPPORT | 7 - k9-svc/pandoc/.github/copilot-instructions.md | 57 - k9-svc/pandoc/.github/dependabot.yml | 48 - .../pandoc/.github/pull_request_template.md | 44 - k9-svc/pandoc/.github/workflows/codeql.yml | 23 - .../pandoc/.github/workflows/governance.yml | 27 - .../pandoc/.github/workflows/hypatia-scan.yml | 21 - k9-svc/pandoc/.github/workflows/jekyll.yml | 68 - k9-svc/pandoc/.github/workflows/mirror.yml | 15 - k9-svc/pandoc/.github/workflows/release.yml | 131 -- k9-svc/pandoc/.github/workflows/rhodibot.yml | 235 --- .../.github/workflows/scorecard-enforcer.yml | 17 - k9-svc/pandoc/.github/workflows/scorecard.yml | 24 - .../.github/workflows/secret-scanner.yml | 21 - .../workflows/static-analysis-gate.yml | 331 ---- k9-svc/pandoc/.gitignore | 105 -- k9-svc/pandoc/.gitlab-ci.yml | 175 -- k9-svc/pandoc/.guix-channel | 22 - .../.machine_readable/0.1-AI-MANIFEST.a2ml | 29 - k9-svc/pandoc/.machine_readable/CLADE.a2ml | 26 - .../.machine_readable/ENSAID_CONFIG.a2ml | 96 -- k9-svc/pandoc/.machine_readable/README.adoc | 1 - .../pandoc/.machine_readable/ai/.clinerules | 43 - .../pandoc/.machine_readable/ai/.cursorrules | 47 - .../.machine_readable/ai/.windsurfrules | 43 - .../.machine_readable/ai/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/.machine_readable/ai/AI.a2ml | 16 - .../.machine_readable/ai/PLACEHOLDERS.adoc | 142 -- .../pandoc/.machine_readable/ai/README.adoc | 22 - .../anchors/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/anchors/ANCHOR.a2ml | 62 - .../.machine_readable/anchors/README.adoc | 1 - .../.machine_readable/compliance/reuse/dep5 | 54 - .../compliance/rust/deny.toml | 65 - .../configs/0.2-AI-MANIFEST.a2ml | 11 - .../.machine_readable/configs/README.adoc | 1 - .../configs/git-cliff/cliff.toml | 119 -- .../contractiles/README.adoc | 19 - .../contractiles/dust/Dustfile.a2ml | 44 - .../contractiles/must/Mustfile.a2ml | 69 - .../contractiles/trust/Trustfile.a2ml | 50 - .../descriptiles/AGENTIC.a2ml | 36 - .../descriptiles/ECOSYSTEM.a2ml | 26 - .../.machine_readable/descriptiles/META.a2ml | 53 - .../descriptiles/NEUROSYM.a2ml | 23 - .../descriptiles/PLAYBOOK.a2ml | 35 - .../.machine_readable/descriptiles/STATE.a2ml | 64 - .../policies/.maintenance-perms-ignore | 5 - .../policies/0.2-AI-MANIFEST.a2ml | 11 - .../policies/MAINTENANCE-AXES.a2ml | 54 - .../policies/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../.machine_readable/policies/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../scripts/0.2-AI-MANIFEST.a2ml | 18 - .../scripts/forge/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/forge/README.adoc | 1 - .../scripts/forge/forge-sync.sh | 25 - .../scripts/forge/git-cleanup.sh | 8 - .../scripts/lifecycle/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/lifecycle/README.adoc | 1 - .../scripts/lifecycle/install-tools.sh | 27 - .../scripts/maintenance/maint-assault.sh | 44 - .../scripts/verification/0.3-AI-MANIFEST.a2ml | 11 - .../scripts/verification/README.adoc | 1 - k9-svc/pandoc/.tool-versions | 9 - k9-svc/pandoc/.well-known/ai.txt | 18 - k9-svc/pandoc/.well-known/humans.txt | 14 - k9-svc/pandoc/.well-known/security.txt | 11 - k9-svc/pandoc/0-AI-MANIFEST.a2ml | 121 -- k9-svc/pandoc/CHANGELOG.adoc | 9 - k9-svc/pandoc/CONTRIBUTING.adoc | 26 - k9-svc/pandoc/Containerfile | 41 - k9-svc/pandoc/Justfile | 916 ----------- k9-svc/pandoc/LICENSE | 153 -- k9-svc/pandoc/PANDOC-SUBMISSION.adoc | 80 - k9-svc/pandoc/README.adoc | 141 -- k9-svc/pandoc/ROADMAP.adoc | 22 - k9-svc/pandoc/SECURITY.adoc | 16 - k9-svc/pandoc/container/.gatekeeper.yaml | 1 - k9-svc/pandoc/container/0.1-AI-MANIFEST.a2ml | 143 -- k9-svc/pandoc/container/Containerfile | 136 -- k9-svc/pandoc/container/README.adoc | 179 -- k9-svc/pandoc/container/compose.example.toml | 135 -- k9-svc/pandoc/container/compose.toml | 70 - k9-svc/pandoc/container/ct-build.sh | 162 -- k9-svc/pandoc/container/deploy.k9.ncl | 166 -- k9-svc/pandoc/container/entrypoint.sh | 63 - k9-svc/pandoc/container/manifest.toml | 62 - k9-svc/pandoc/container/vordr.toml | 100 -- k9-svc/pandoc/contractile.just | 75 - k9-svc/pandoc/docs/0.1-AI-MANIFEST.a2ml | 33 - k9-svc/pandoc/docs/QUICKSTART.adoc | 24 - k9-svc/pandoc/docs/README.adoc | 14 - k9-svc/pandoc/docs/RSR_OUTLINE.adoc | 290 ---- k9-svc/pandoc/docs/STATE-VISUALIZER.adoc | 128 -- .../docs/architecture/0.2-AI-MANIFEST.a2ml | 17 - .../docs/architecture/THREAT-MODEL.adoc | 162 -- .../docs/attribution/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/docs/attribution/CITATION.cff | 17 - k9-svc/pandoc/docs/attribution/CITATIONS.adoc | 35 - .../pandoc/docs/attribution/CODEOWNERS.adoc | 19 - .../pandoc/docs/attribution/MAINTAINERS.adoc | 47 - k9-svc/pandoc/docs/attribution/README.adoc | 1 - .../docs/decisions/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/decisions/0000-template.adoc | 35 - .../decisions/0001-adopt-rsr-standard.adoc | 86 - k9-svc/pandoc/docs/decisions/README.adoc | 1 - .../docs/developer/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/developer/ABI-FFI-README.adoc | 384 ----- k9-svc/pandoc/docs/developer/README.adoc | 1 - .../docs/governance/0.1-AI-MANIFEST.a2ml | 21 - .../pandoc/docs/governance/CRG-CRITERIA.a2ml | 108 -- .../pandoc/docs/governance/CRG-CRITERIA.adoc | 39 - .../governance/MAINTENANCE-CHECKLIST.a2ml | 159 -- .../governance/MAINTENANCE-CHECKLIST.adoc | 569 ------- k9-svc/pandoc/docs/governance/README.adoc | 1 - .../SOFTWARE-DEVELOPMENT-APPROACH.a2ml | 53 - .../SOFTWARE-DEVELOPMENT-APPROACH.adoc | 63 - k9-svc/pandoc/docs/governance/TSDM.a2ml | 22 - k9-svc/pandoc/docs/governance/TSDM.adoc | 26 - .../governance/audit/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/governance/audit/README.adoc | 1 - .../audit/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../governance/audit/compliance/README.adoc | 1 - .../audit/effects/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/effects/README.adoc | 1 - .../audit/systems/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/audit/systems/README.adoc | 1 - .../maintenance/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/maintenance/README.adoc | 1 - .../maintenance/adaptive/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/adaptive/README.adoc | 1 - .../corrective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/corrective/README.adoc | 1 - .../perfective/0.3-AI-MANIFEST.a2ml | 11 - .../maintenance/perfective/README.adoc | 1 - .../governance/planning/0.2-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/README.adoc | 1 - .../planning/could/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/could/README.adoc | 1 - .../planning/must/0.3-AI-MANIFEST.a2ml | 11 - .../docs/governance/planning/must/README.adoc | 1 - .../planning/should/0.3-AI-MANIFEST.a2ml | 11 - .../governance/planning/should/README.adoc | 1 - k9-svc/pandoc/docs/legal/0.2-AI-MANIFEST.a2ml | 16 - .../docs/legal/EXHIBIT-A-ETHICAL-USE.txt | 68 - .../docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt | 102 -- k9-svc/pandoc/docs/practice/.gitkeep | 0 .../pandoc/docs/practice/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/practice/AI-CONVENTIONS.adoc | 85 - k9-svc/pandoc/docs/practice/README.adoc | 1 - .../docs/practice/STATE-VISUALIZER-GUIDE.adoc | 155 -- .../pandoc/docs/reports/0.2-AI-MANIFEST.a2ml | 19 - k9-svc/pandoc/docs/reports/README.adoc | 1 - .../reports/compliance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/compliance/README.adoc | 1 - .../reports/maintenance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/maintenance/README.adoc | 1 - .../reports/performance/0.3-AI-MANIFEST.a2ml | 11 - .../docs/reports/performance/README.adoc | 1 - .../docs/reports/quality/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/reports/quality/README.adoc | 1 - .../reports/security/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/reports/security/README.adoc | 1 - .../docs/standards/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/docs/standards/README.adoc | 1 - .../docs/templates/contractiles/README.adoc | 11 - .../templates/contractiles/dust/Dustfile.a2ml | 11 - .../contractiles/intend/Intentfile.a2ml | 11 - .../templates/contractiles/must/Mustfile.a2ml | 11 - .../contractiles/trust/Trustfile.a2ml | 11 - k9-svc/pandoc/docs/theory/.gitkeep | 0 .../pandoc/docs/theory/0.2-AI-MANIFEST.a2ml | 23 - k9-svc/pandoc/docs/theory/README.adoc | 1 - .../theory/computing/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/theory/computing/README.adoc | 1 - .../theory/formalisms/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/theory/formalisms/README.adoc | 1 - .../theory/mathematics/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/mathematics/README.adoc | 1 - .../theory/ontologies/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/docs/theory/ontologies/README.adoc | 1 - .../docs/theory/other/0.3-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/docs/theory/other/README.adoc | 1 - .../socio-technical/0.3-AI-MANIFEST.a2ml | 11 - .../docs/theory/socio-technical/README.adoc | 1 - .../docs/whitepapers/0.2-AI-MANIFEST.a2ml | 20 - k9-svc/pandoc/docs/whitepapers/README.adoc | 1 - .../pandoc/docs/whitepapers/academic/.gitkeep | 0 .../whitepapers/academic/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/academic/README.adoc | 1 - .../pandoc/docs/whitepapers/industry/.gitkeep | 0 .../whitepapers/industry/0.3-AI-MANIFEST.a2ml | 11 - .../docs/whitepapers/industry/README.adoc | 1 - .../whitepapers/outreach/0.3-AI-MANIFEST.a2ml | 16 - .../docs/whitepapers/outreach/README.adoc | 17 - k9-svc/pandoc/docs/wikis/0.2-AI-MANIFEST.a2ml | 15 - k9-svc/pandoc/docs/wikis/README.adoc | 15 - k9-svc/pandoc/examples/0.1-AI-MANIFEST.a2ml | 1 - k9-svc/pandoc/examples/README.adoc | 1 - k9-svc/pandoc/examples/web-project-deno.json | 20 - k9-svc/pandoc/features/0.1-AI-MANIFEST.a2ml | 17 - k9-svc/pandoc/features/README.adoc | 1 - .../features/boj-server/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/features/boj-server/README.adoc | 14 - .../panic-attacker/0.2-AI-MANIFEST.a2ml | 11 - .../features/panic-attacker/README.adoc | 25 - .../pandoc/features/ssg/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/features/ssg/README.adoc | 1 - k9-svc/pandoc/features/ssg/ssg-bootstrap.sh | 48 - k9-svc/pandoc/k9-filter.lua | 406 ----- k9-svc/pandoc/k9-reader.lua | 92 -- k9-svc/pandoc/k9-writer.lua | 255 --- k9-svc/pandoc/k9.html | 590 ------- k9-svc/pandoc/k9.lua | 596 ------- k9-svc/pandoc/pandoc-k9-scm-1.rockspec | 54 - k9-svc/pandoc/sample.k9 | 40 - k9-svc/pandoc/sample.k9.ncl | 41 - k9-svc/pandoc/src/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/pandoc/src/README.adoc | 1 - .../pandoc/src/aspects/0.2-AI-MANIFEST.a2ml | 17 - k9-svc/pandoc/src/aspects/README.adoc | 1 - .../aspects/integrity/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/src/aspects/integrity/README.adoc | 1 - .../observability/0.3-AI-MANIFEST.a2ml | 11 - .../src/aspects/observability/README.adoc | 1 - .../src/aspects/security/0.3-AI-MANIFEST.a2ml | 11 - .../pandoc/src/aspects/security/README.adoc | 1 - .../pandoc/src/bridges/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/src/contracts/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/src/contracts/README.adoc | 1 - k9-svc/pandoc/src/core/0.2-AI-MANIFEST.a2ml | 11 - .../src/definitions/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/src/definitions/README.adoc | 1 - k9-svc/pandoc/src/errors/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/src/errors/README.adoc | 1 - .../pandoc/src/interface/0.2-AI-MANIFEST.a2ml | 24 - k9-svc/pandoc/src/interface/README.adoc | 1 - .../src/interface/abi/0.3-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/src/interface/abi/README.adoc | 1 - .../src/interface/ffi/0.3-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/src/interface/ffi/README.adoc | 1 - k9-svc/pandoc/src/interface/ffi/build.zig | 94 -- .../interface/ffi/src/0.4-AI-MANIFEST.a2ml | 11 - .../pandoc/src/interface/ffi/src/README.adoc | 1 - k9-svc/pandoc/src/interface/ffi/src/main.zig | 274 --- .../interface/ffi/test/0.4-AI-MANIFEST.a2ml | 11 - .../pandoc/src/interface/ffi/test/README.adoc | 1 - .../interface/ffi/test/integration_test.zig | 182 -- .../interface/generated/0.3-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/README.adoc | 1 - .../src/interface/generated/abi/.gitkeep | 0 .../generated/abi/0.4-AI-MANIFEST.a2ml | 11 - .../src/interface/generated/abi/README.adoc | 1 - .../pandoc/verification/0.1-AI-MANIFEST.a2ml | 27 - k9-svc/pandoc/verification/README.adoc | 1 - .../benchmarks/0.2-AI-MANIFEST.a2ml | 11 - .../verification/benchmarks/README.adoc | 1 - .../coverage/0.2-AI-MANIFEST.a2ml | 12 - .../pandoc/verification/coverage/README.adoc | 1 - .../verification/fuzzing/0.2-AI-MANIFEST.a2ml | 11 - .../pandoc/verification/fuzzing/README.adoc | 1 - .../verification/proofs/0.2-AI-MANIFEST.a2ml | 11 - k9-svc/pandoc/verification/proofs/README.adoc | 1 - .../safety_case/0.2-AI-MANIFEST.a2ml | 12 - .../verification/safety_case/README.adoc | 1 - .../simulations/0.2-AI-MANIFEST.a2ml | 11 - .../verification/simulations/README.adoc | 1 - .../verification/tests/0.2-AI-MANIFEST.a2ml | 1 - k9-svc/pandoc/verification/tests/README.adoc | 1 - .../traceability/0.2-AI-MANIFEST.a2ml | 12 - .../verification/traceability/README.adoc | 1 - k9-svc/receipt/PROFILE.a2ml | 57 - k9-svc/receipt/README.adoc | 79 - k9-svc/receipt/example-receipt.a2ml | 54 - k9-svc/receipt/example-receipt.json | 55 - k9-svc/receipt/receipt.schema.json | 207 --- k9-svc/release-k9.k9.ncl | 356 ---- k9-svc/scripts/deploy-site.sh | 33 - k9-svc/showcase/content/examples.adoc | 282 ---- k9-svc/showcase/content/getting-started.adoc | 280 ---- k9-svc/showcase/content/index.adoc | 96 -- k9-svc/showcase/content/integrations.adoc | 142 -- k9-svc/showcase/content/security-levels.adoc | 172 -- k9-svc/showcase/output/examples.html | 1119 ------------- k9-svc/showcase/output/getting-started.html | 1109 ------------- k9-svc/showcase/output/index.html | 781 --------- k9-svc/showcase/output/integrations.html | 791 --------- k9-svc/showcase/output/security-levels.html | 837 ---------- k9-svc/showcase/template.html | 668 -------- k9-svc/sign.sh | 367 ----- k9-svc/site/assets/style.css | 1 - k9-svc/site/downloads.adoc | 45 - k9-svc/site/index.adoc | 78 - k9-svc/site/public/.well-known/security.txt | 29 - k9-svc/site/public/CNAME | 1 - k9-svc/site/public/downloads/README.adoc | 15 - .../public/downloads/k9-svc-templates.tar.gz | Bin 1007 -> 0 bytes .../site/public/downloads/level1-data.k9.ncl | 9 - .../public/downloads/level2-validated.k9.ncl | 10 - .../public/downloads/level3-signed.k9.ncl | 13 - k9-svc/site/public/favicon.svg | 10 - k9-svc/site/public/robots.txt | 4 - k9-svc/site/roadmap.adoc | 53 - k9-svc/site/spec.adoc | 41 - k9-svc/site/start.adoc | 57 - k9-svc/site/templates/default.html | 1 - k9-svc/test.sh | 347 ---- k9-svc/tools/Justfile | 46 - k9-svc/tools/README.adoc | 393 ----- k9-svc/tools/github-action/action.yml | 125 -- k9-svc/tools/manifest.scm | 24 - k9-svc/tools/src/k9-init/Cargo.lock | 1465 ----------------- k9-svc/tools/src/k9-init/Cargo.toml | 26 - k9-svc/tools/src/k9-init/src/main.rs | 594 ------- k9-svc/tools/src/k9-sign/Cargo.lock | 788 --------- k9-svc/tools/src/k9-sign/Cargo.toml | 23 - k9-svc/tools/src/k9-sign/src/main.rs | 192 --- k9-svc/tools/src/k9-validate/Cargo.lock | 324 ---- k9-svc/tools/src/k9-validate/Cargo.toml | 23 - k9-svc/tools/src/k9-validate/src/main.rs | 363 ---- .../tools/templates/minimal/template.k9.ncl | 69 - k9-svc/tools/vscode-extension/package.json | 87 - scripts/build-registry.sh | 2 +- 1867 files changed, 71 insertions(+), 103556 deletions(-) delete mode 100644 k9-svc/.github/workflows/6scm-sync.yml delete mode 100644 k9-svc/.github/workflows/ci.yml delete mode 100644 k9-svc/.github/workflows/codeql.yml delete mode 100644 k9-svc/.github/workflows/governance.yml delete mode 100644 k9-svc/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/.github/workflows/k9-sign-ci.yml delete mode 100644 k9-svc/.github/workflows/scorecard.yml delete mode 100644 k9-svc/Containerfile delete mode 100644 k9-svc/Justfile delete mode 100644 k9-svc/actions/validate/.devcontainer/Containerfile delete mode 100644 k9-svc/actions/validate/.devcontainer/README.adoc delete mode 100644 k9-svc/actions/validate/.devcontainer/devcontainer.json delete mode 100644 k9-svc/actions/validate/.editorconfig delete mode 100644 k9-svc/actions/validate/.envrc delete mode 100644 k9-svc/actions/validate/.gitattributes delete mode 100644 k9-svc/actions/validate/.github/.mailmap delete mode 100644 k9-svc/actions/validate/.github/.nojekyll delete mode 100644 k9-svc/actions/validate/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.github/CODEOWNERS delete mode 100644 k9-svc/actions/validate/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/actions/validate/.github/CONTRIBUTING.md delete mode 100644 k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/actions/validate/.github/FUNDING.yml delete mode 100644 k9-svc/actions/validate/.github/GOVERNANCE.md delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/actions/validate/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/actions/validate/.github/MAINTAINERS delete mode 100644 k9-svc/actions/validate/.github/README.adoc delete mode 100644 k9-svc/actions/validate/.github/SECURITY.md delete mode 100644 k9-svc/actions/validate/.github/SUPPORT delete mode 100644 k9-svc/actions/validate/.github/copilot-instructions.md delete mode 100644 k9-svc/actions/validate/.github/dependabot.yml delete mode 100644 k9-svc/actions/validate/.github/pull_request_template.md delete mode 100644 k9-svc/actions/validate/.github/workflows/codeql.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/governance.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/jekyll.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/mirror.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/release.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/scorecard.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/actions/validate/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/actions/validate/.gitignore delete mode 100644 k9-svc/actions/validate/.gitlab-ci.yml delete mode 100644 k9-svc/actions/validate/.guix-channel delete mode 100644 k9-svc/actions/validate/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/actions/validate/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/actions/validate/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/actions/validate/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/actions/validate/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/actions/validate/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/actions/validate/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/actions/validate/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/actions/validate/.tool-versions delete mode 100644 k9-svc/actions/validate/.well-known/ai.txt delete mode 100644 k9-svc/actions/validate/.well-known/humans.txt delete mode 100644 k9-svc/actions/validate/.well-known/security.txt delete mode 100644 k9-svc/actions/validate/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/CHANGELOG.adoc delete mode 100644 k9-svc/actions/validate/CONTRIBUTING.adoc delete mode 100644 k9-svc/actions/validate/Containerfile delete mode 100644 k9-svc/actions/validate/Justfile delete mode 100644 k9-svc/actions/validate/LICENSE delete mode 100644 k9-svc/actions/validate/README.adoc delete mode 100644 k9-svc/actions/validate/ROADMAP.adoc delete mode 100644 k9-svc/actions/validate/SECURITY.adoc delete mode 100644 k9-svc/actions/validate/action.yml delete mode 100644 k9-svc/actions/validate/container/.gatekeeper.yaml delete mode 100644 k9-svc/actions/validate/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/container/Containerfile delete mode 100644 k9-svc/actions/validate/container/README.adoc delete mode 100644 k9-svc/actions/validate/container/compose.example.toml delete mode 100644 k9-svc/actions/validate/container/compose.toml delete mode 100755 k9-svc/actions/validate/container/ct-build.sh delete mode 100644 k9-svc/actions/validate/container/deploy.k9.ncl delete mode 100755 k9-svc/actions/validate/container/entrypoint.sh delete mode 100644 k9-svc/actions/validate/container/manifest.toml delete mode 100644 k9-svc/actions/validate/container/vordr.toml delete mode 100644 k9-svc/actions/validate/contractile.just delete mode 100644 k9-svc/actions/validate/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/QUICKSTART.adoc delete mode 100644 k9-svc/actions/validate/docs/README.adoc delete mode 100644 k9-svc/actions/validate/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/actions/validate/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/actions/validate/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/actions/validate/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/attribution/CITATION.cff delete mode 100644 k9-svc/actions/validate/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/actions/validate/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/actions/validate/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/actions/validate/docs/attribution/README.adoc delete mode 100644 k9-svc/actions/validate/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/actions/validate/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/actions/validate/docs/decisions/README.adoc delete mode 100644 k9-svc/actions/validate/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/actions/validate/docs/developer/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/TSDM.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/audit/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/planning/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/actions/validate/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/actions/validate/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/actions/validate/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/actions/validate/docs/practice/.gitkeep delete mode 100644 k9-svc/actions/validate/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/actions/validate/docs/practice/README.adoc delete mode 100644 k9-svc/actions/validate/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/README.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/performance/README.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/quality/README.adoc delete mode 100644 k9-svc/actions/validate/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/reports/security/README.adoc delete mode 100644 k9-svc/actions/validate/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/standards/README.adoc delete mode 100644 k9-svc/actions/validate/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/actions/validate/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/actions/validate/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/actions/validate/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/actions/validate/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/.gitkeep delete mode 100644 k9-svc/actions/validate/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/computing/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/other/README.adoc delete mode 100644 k9-svc/actions/validate/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/actions/validate/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/whitepapers/README.adoc delete mode 100644 k9-svc/actions/validate/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/actions/validate/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/actions/validate/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/actions/validate/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/actions/validate/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/actions/validate/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/docs/wikis/README.adoc delete mode 100644 k9-svc/actions/validate/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/examples/README.adoc delete mode 100644 k9-svc/actions/validate/examples/web-project-deno.json delete mode 100644 k9-svc/actions/validate/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/features/README.adoc delete mode 100644 k9-svc/actions/validate/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/features/boj-server/README.adoc delete mode 100644 k9-svc/actions/validate/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/features/panic-attacker/README.adoc delete mode 100644 k9-svc/actions/validate/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/features/ssg/README.adoc delete mode 100755 k9-svc/actions/validate/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/actions/validate/src/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/README.adoc delete mode 100644 k9-svc/actions/validate/src/aspects/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/aspects/README.adoc delete mode 100644 k9-svc/actions/validate/src/aspects/integrity/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/aspects/integrity/README.adoc delete mode 100644 k9-svc/actions/validate/src/aspects/observability/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/aspects/observability/README.adoc delete mode 100644 k9-svc/actions/validate/src/aspects/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/aspects/security/README.adoc delete mode 100644 k9-svc/actions/validate/src/bridges/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/contracts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/contracts/README.adoc delete mode 100644 k9-svc/actions/validate/src/core/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/definitions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/definitions/README.adoc delete mode 100644 k9-svc/actions/validate/src/errors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/errors/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/abi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/abi/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/ffi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/ffi/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/ffi/build.zig delete mode 100644 k9-svc/actions/validate/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/ffi/src/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/ffi/src/main.zig delete mode 100644 k9-svc/actions/validate/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/ffi/test/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/ffi/test/integration_test.zig delete mode 100644 k9-svc/actions/validate/src/interface/generated/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/generated/README.adoc delete mode 100644 k9-svc/actions/validate/src/interface/generated/abi/.gitkeep delete mode 100644 k9-svc/actions/validate/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/src/interface/generated/abi/README.adoc delete mode 100755 k9-svc/actions/validate/validate-k9.sh delete mode 100644 k9-svc/actions/validate/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/README.adoc delete mode 100644 k9-svc/actions/validate/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/benchmarks/README.adoc delete mode 100644 k9-svc/actions/validate/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/coverage/README.adoc delete mode 100644 k9-svc/actions/validate/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/fuzzing/README.adoc delete mode 100644 k9-svc/actions/validate/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/proofs/README.adoc delete mode 100644 k9-svc/actions/validate/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/safety_case/README.adoc delete mode 100644 k9-svc/actions/validate/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/simulations/README.adoc delete mode 100644 k9-svc/actions/validate/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/tests/README.adoc delete mode 100644 k9-svc/actions/validate/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/actions/validate/verification/traceability/README.adoc delete mode 100755 k9-svc/benchmarks/k9-bench.sh delete mode 100755 k9-svc/benchmarks/quick-bench.sh delete mode 100644 k9-svc/bindings/README.adoc delete mode 100644 k9-svc/bindings/deno/.devcontainer/Containerfile delete mode 100644 k9-svc/bindings/deno/.devcontainer/README.adoc delete mode 100644 k9-svc/bindings/deno/.devcontainer/devcontainer.json delete mode 100644 k9-svc/bindings/deno/.editorconfig delete mode 100644 k9-svc/bindings/deno/.envrc delete mode 100644 k9-svc/bindings/deno/.gitattributes delete mode 100644 k9-svc/bindings/deno/.github/.mailmap delete mode 100644 k9-svc/bindings/deno/.github/.nojekyll delete mode 100644 k9-svc/bindings/deno/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.github/CODEOWNERS delete mode 100644 k9-svc/bindings/deno/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/bindings/deno/.github/CONTRIBUTING.md delete mode 100644 k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/bindings/deno/.github/FUNDING.yml delete mode 100644 k9-svc/bindings/deno/.github/GOVERNANCE.md delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/bindings/deno/.github/MAINTAINERS delete mode 100644 k9-svc/bindings/deno/.github/README.adoc delete mode 100644 k9-svc/bindings/deno/.github/SECURITY.md delete mode 100644 k9-svc/bindings/deno/.github/SUPPORT delete mode 100644 k9-svc/bindings/deno/.github/copilot-instructions.md delete mode 100644 k9-svc/bindings/deno/.github/dependabot.yml delete mode 100644 k9-svc/bindings/deno/.github/pull_request_template.md delete mode 100644 k9-svc/bindings/deno/.github/workflows/codeql.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/governance.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/jekyll.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/mirror.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/release.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/scorecard.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/bindings/deno/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/bindings/deno/.gitignore delete mode 100644 k9-svc/bindings/deno/.gitlab-ci.yml delete mode 100644 k9-svc/bindings/deno/.guix-channel delete mode 100644 k9-svc/bindings/deno/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/bindings/deno/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/bindings/deno/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/bindings/deno/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/bindings/deno/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/bindings/deno/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/bindings/deno/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/bindings/deno/.tool-versions delete mode 100644 k9-svc/bindings/deno/.well-known/ai.txt delete mode 100644 k9-svc/bindings/deno/.well-known/humans.txt delete mode 100644 k9-svc/bindings/deno/.well-known/security.txt delete mode 100644 k9-svc/bindings/deno/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/CHANGELOG.adoc delete mode 100644 k9-svc/bindings/deno/CONTRIBUTING.adoc delete mode 100644 k9-svc/bindings/deno/Containerfile delete mode 100644 k9-svc/bindings/deno/Justfile delete mode 100644 k9-svc/bindings/deno/LICENSE delete mode 100644 k9-svc/bindings/deno/README.adoc delete mode 100644 k9-svc/bindings/deno/ROADMAP.adoc delete mode 100644 k9-svc/bindings/deno/SECURITY.adoc delete mode 120000 k9-svc/bindings/deno/container/.gatekeeper.yaml delete mode 100644 k9-svc/bindings/deno/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/container/Containerfile delete mode 100644 k9-svc/bindings/deno/container/README.adoc delete mode 100644 k9-svc/bindings/deno/container/compose.example.toml delete mode 100644 k9-svc/bindings/deno/container/compose.toml delete mode 100755 k9-svc/bindings/deno/container/ct-build.sh delete mode 100644 k9-svc/bindings/deno/container/deploy.k9.ncl delete mode 100755 k9-svc/bindings/deno/container/entrypoint.sh delete mode 100644 k9-svc/bindings/deno/container/manifest.toml delete mode 100644 k9-svc/bindings/deno/container/vordr.toml delete mode 100644 k9-svc/bindings/deno/contractile.just delete mode 100644 k9-svc/bindings/deno/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/QUICKSTART.adoc delete mode 100644 k9-svc/bindings/deno/docs/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/bindings/deno/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/bindings/deno/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/bindings/deno/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/attribution/CITATION.cff delete mode 100644 k9-svc/bindings/deno/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/bindings/deno/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/bindings/deno/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/bindings/deno/docs/attribution/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/bindings/deno/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/bindings/deno/docs/decisions/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/bindings/deno/docs/developer/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/TSDM.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/bindings/deno/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/bindings/deno/docs/practice/.gitkeep delete mode 100644 k9-svc/bindings/deno/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/bindings/deno/docs/practice/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/performance/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/quality/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/reports/security/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/standards/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/deno/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/bindings/deno/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/deno/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/.gitkeep delete mode 100644 k9-svc/bindings/deno/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/computing/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/other/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/bindings/deno/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/docs/wikis/README.adoc delete mode 100644 k9-svc/bindings/deno/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/examples/README.adoc delete mode 100644 k9-svc/bindings/deno/examples/web-project-deno.json delete mode 100644 k9-svc/bindings/deno/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/features/README.adoc delete mode 100644 k9-svc/bindings/deno/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/features/boj-server/README.adoc delete mode 100644 k9-svc/bindings/deno/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/features/panic-attacker/README.adoc delete mode 100644 k9-svc/bindings/deno/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/features/ssg/README.adoc delete mode 100755 k9-svc/bindings/deno/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/bindings/deno/jsr.json delete mode 100644 k9-svc/bindings/deno/mod.affine delete mode 100644 k9-svc/bindings/deno/src/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/K9.affine delete mode 100644 k9-svc/bindings/deno/src/K9_Parser.affine delete mode 100644 k9-svc/bindings/deno/src/K9_Renderer.affine delete mode 100644 k9-svc/bindings/deno/src/K9_Types.affine delete mode 100644 k9-svc/bindings/deno/src/README.adoc delete mode 100644 k9-svc/bindings/deno/src/aspects/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/aspects/README.adoc delete mode 100644 k9-svc/bindings/deno/src/aspects/integrity/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/aspects/integrity/README.adoc delete mode 100644 k9-svc/bindings/deno/src/aspects/observability/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/aspects/observability/README.adoc delete mode 100644 k9-svc/bindings/deno/src/aspects/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/aspects/security/README.adoc delete mode 100644 k9-svc/bindings/deno/src/bridges/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/contracts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/contracts/README.adoc delete mode 100644 k9-svc/bindings/deno/src/core/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/definitions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/definitions/README.adoc delete mode 100644 k9-svc/bindings/deno/src/errors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/errors/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/abi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/abi/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/build.zig delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/src/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/src/main.zig delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/test/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/ffi/test/integration_test.zig delete mode 100644 k9-svc/bindings/deno/src/interface/generated/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/generated/README.adoc delete mode 100644 k9-svc/bindings/deno/src/interface/generated/abi/.gitkeep delete mode 100644 k9-svc/bindings/deno/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/src/interface/generated/abi/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/benchmarks/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/coverage/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/fuzzing/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/proofs/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/safety_case/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/simulations/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/tests/README.adoc delete mode 100644 k9-svc/bindings/deno/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/deno/verification/traceability/README.adoc delete mode 100644 k9-svc/bindings/elixir/.formatter.exs delete mode 100644 k9-svc/bindings/elixir/.gitignore delete mode 100644 k9-svc/bindings/elixir/LICENSE delete mode 100644 k9-svc/bindings/elixir/README.adoc delete mode 100644 k9-svc/bindings/elixir/lib/k9.ex delete mode 100644 k9-svc/bindings/elixir/lib/k9/parser.ex delete mode 100644 k9-svc/bindings/elixir/lib/k9/renderer.ex delete mode 100644 k9-svc/bindings/elixir/lib/k9/types.ex delete mode 100644 k9-svc/bindings/elixir/mix.exs delete mode 100644 k9-svc/bindings/elixir/test/k9_test.exs delete mode 100644 k9-svc/bindings/elixir/test/test_helper.exs delete mode 100644 k9-svc/bindings/gleam/.github/workflows/test.yml delete mode 100644 k9-svc/bindings/gleam/.gitignore delete mode 100644 k9-svc/bindings/gleam/LICENSE delete mode 100644 k9-svc/bindings/gleam/README.adoc delete mode 100644 k9-svc/bindings/gleam/gleam.toml delete mode 100644 k9-svc/bindings/gleam/manifest.toml delete mode 100644 k9-svc/bindings/gleam/src/k9_gleam.gleam delete mode 100644 k9-svc/bindings/gleam/src/k9_gleam/parser.gleam delete mode 100644 k9-svc/bindings/gleam/src/k9_gleam/renderer.gleam delete mode 100644 k9-svc/bindings/gleam/src/k9_gleam/types.gleam delete mode 100644 k9-svc/bindings/gleam/test/k9_gleam_test.gleam delete mode 100644 k9-svc/bindings/haskell/.devcontainer/Containerfile delete mode 100644 k9-svc/bindings/haskell/.devcontainer/README.adoc delete mode 100644 k9-svc/bindings/haskell/.devcontainer/devcontainer.json delete mode 100644 k9-svc/bindings/haskell/.editorconfig delete mode 100644 k9-svc/bindings/haskell/.envrc delete mode 100644 k9-svc/bindings/haskell/.gitattributes delete mode 100644 k9-svc/bindings/haskell/.github/.mailmap delete mode 100644 k9-svc/bindings/haskell/.github/.nojekyll delete mode 100644 k9-svc/bindings/haskell/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.github/CODEOWNERS delete mode 100644 k9-svc/bindings/haskell/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/bindings/haskell/.github/CONTRIBUTING.md delete mode 100644 k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/bindings/haskell/.github/FUNDING.yml delete mode 100644 k9-svc/bindings/haskell/.github/GOVERNANCE.md delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/bindings/haskell/.github/MAINTAINERS delete mode 100644 k9-svc/bindings/haskell/.github/README.adoc delete mode 100644 k9-svc/bindings/haskell/.github/SECURITY.md delete mode 100644 k9-svc/bindings/haskell/.github/SUPPORT delete mode 100644 k9-svc/bindings/haskell/.github/copilot-instructions.md delete mode 100644 k9-svc/bindings/haskell/.github/dependabot.yml delete mode 100644 k9-svc/bindings/haskell/.github/pull_request_template.md delete mode 100644 k9-svc/bindings/haskell/.github/workflows/codeql.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/governance.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/jekyll.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/mirror.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/release.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/scorecard.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/bindings/haskell/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/bindings/haskell/.gitignore delete mode 100644 k9-svc/bindings/haskell/.gitlab-ci.yml delete mode 100644 k9-svc/bindings/haskell/.guix-channel delete mode 100644 k9-svc/bindings/haskell/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/bindings/haskell/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/bindings/haskell/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/bindings/haskell/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/bindings/haskell/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/bindings/haskell/.tool-versions delete mode 100644 k9-svc/bindings/haskell/.well-known/ai.txt delete mode 100644 k9-svc/bindings/haskell/.well-known/humans.txt delete mode 100644 k9-svc/bindings/haskell/.well-known/security.txt delete mode 100644 k9-svc/bindings/haskell/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/CHANGELOG.adoc delete mode 100644 k9-svc/bindings/haskell/CONTRIBUTING.adoc delete mode 100644 k9-svc/bindings/haskell/Containerfile delete mode 100644 k9-svc/bindings/haskell/Justfile delete mode 100644 k9-svc/bindings/haskell/LICENSE delete mode 100644 k9-svc/bindings/haskell/LICENSE-MPL-2.0 delete mode 100644 k9-svc/bindings/haskell/README.adoc delete mode 100644 k9-svc/bindings/haskell/ROADMAP.adoc delete mode 100644 k9-svc/bindings/haskell/SECURITY.adoc delete mode 100644 k9-svc/bindings/haskell/Setup.hs delete mode 120000 k9-svc/bindings/haskell/container/.gatekeeper.yaml delete mode 100644 k9-svc/bindings/haskell/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/container/Containerfile delete mode 100644 k9-svc/bindings/haskell/container/README.adoc delete mode 100644 k9-svc/bindings/haskell/container/compose.example.toml delete mode 100644 k9-svc/bindings/haskell/container/compose.toml delete mode 100755 k9-svc/bindings/haskell/container/ct-build.sh delete mode 100644 k9-svc/bindings/haskell/container/deploy.k9.ncl delete mode 100755 k9-svc/bindings/haskell/container/entrypoint.sh delete mode 100644 k9-svc/bindings/haskell/container/manifest.toml delete mode 100644 k9-svc/bindings/haskell/container/vordr.toml delete mode 100644 k9-svc/bindings/haskell/contractile.just delete mode 100644 k9-svc/bindings/haskell/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/QUICKSTART.adoc delete mode 100644 k9-svc/bindings/haskell/docs/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/bindings/haskell/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/bindings/haskell/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/bindings/haskell/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/attribution/CITATION.cff delete mode 100644 k9-svc/bindings/haskell/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/bindings/haskell/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/bindings/haskell/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/bindings/haskell/docs/attribution/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/bindings/haskell/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/bindings/haskell/docs/decisions/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/developer/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/TSDM.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/bindings/haskell/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/bindings/haskell/docs/practice/.gitkeep delete mode 100644 k9-svc/bindings/haskell/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/bindings/haskell/docs/practice/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/performance/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/quality/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/reports/security/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/standards/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/.gitkeep delete mode 100644 k9-svc/bindings/haskell/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/computing/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/other/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/bindings/haskell/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/docs/wikis/README.adoc delete mode 100644 k9-svc/bindings/haskell/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/examples/README.adoc delete mode 100644 k9-svc/bindings/haskell/examples/web-project-deno.json delete mode 100644 k9-svc/bindings/haskell/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/features/README.adoc delete mode 100644 k9-svc/bindings/haskell/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/features/boj-server/README.adoc delete mode 100644 k9-svc/bindings/haskell/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/features/panic-attacker/README.adoc delete mode 100644 k9-svc/bindings/haskell/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/features/ssg/README.adoc delete mode 100755 k9-svc/bindings/haskell/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/bindings/haskell/k9-haskell.cabal delete mode 100644 k9-svc/bindings/haskell/src/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/Data/K9.hs delete mode 100644 k9-svc/bindings/haskell/src/Data/K9/Parser.hs delete mode 100644 k9-svc/bindings/haskell/src/Data/K9/Renderer.hs delete mode 100644 k9-svc/bindings/haskell/src/Data/K9/Types.hs delete mode 100644 k9-svc/bindings/haskell/src/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/aspects/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/aspects/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/aspects/integrity/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/aspects/integrity/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/aspects/observability/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/aspects/observability/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/aspects/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/aspects/security/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/bridges/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/contracts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/contracts/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/core/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/definitions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/definitions/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/errors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/errors/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/abi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/abi/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/build.zig delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/src/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/src/main.zig delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/test/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/ffi/test/integration_test.zig delete mode 100644 k9-svc/bindings/haskell/src/interface/generated/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/generated/README.adoc delete mode 100644 k9-svc/bindings/haskell/src/interface/generated/abi/.gitkeep delete mode 100644 k9-svc/bindings/haskell/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/src/interface/generated/abi/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/benchmarks/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/coverage/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/fuzzing/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/proofs/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/safety_case/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/simulations/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/tests/README.adoc delete mode 100644 k9-svc/bindings/haskell/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/haskell/verification/traceability/README.adoc delete mode 100644 k9-svc/bindings/rust/.devcontainer/Containerfile delete mode 100644 k9-svc/bindings/rust/.devcontainer/README.adoc delete mode 100644 k9-svc/bindings/rust/.devcontainer/devcontainer.json delete mode 100644 k9-svc/bindings/rust/.editorconfig delete mode 100644 k9-svc/bindings/rust/.envrc delete mode 100644 k9-svc/bindings/rust/.gitattributes delete mode 100644 k9-svc/bindings/rust/.github/.mailmap delete mode 100644 k9-svc/bindings/rust/.github/.nojekyll delete mode 100644 k9-svc/bindings/rust/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.github/CODEOWNERS delete mode 100644 k9-svc/bindings/rust/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/bindings/rust/.github/CONTRIBUTING.md delete mode 100644 k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/bindings/rust/.github/FUNDING.yml delete mode 100644 k9-svc/bindings/rust/.github/GOVERNANCE.md delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/bindings/rust/.github/MAINTAINERS delete mode 100644 k9-svc/bindings/rust/.github/README.adoc delete mode 100644 k9-svc/bindings/rust/.github/SECURITY.md delete mode 100644 k9-svc/bindings/rust/.github/SUPPORT delete mode 100644 k9-svc/bindings/rust/.github/copilot-instructions.md delete mode 100644 k9-svc/bindings/rust/.github/dependabot.yml delete mode 100644 k9-svc/bindings/rust/.github/pull_request_template.md delete mode 100644 k9-svc/bindings/rust/.github/workflows/codeql.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/governance.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/jekyll.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/mirror.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/release.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/scorecard.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/bindings/rust/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/bindings/rust/.gitignore delete mode 100644 k9-svc/bindings/rust/.gitlab-ci.yml delete mode 100644 k9-svc/bindings/rust/.guix-channel delete mode 100644 k9-svc/bindings/rust/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/bindings/rust/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/bindings/rust/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/bindings/rust/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/bindings/rust/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/bindings/rust/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/bindings/rust/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/bindings/rust/.tool-versions delete mode 100644 k9-svc/bindings/rust/.well-known/ai.txt delete mode 100644 k9-svc/bindings/rust/.well-known/humans.txt delete mode 100644 k9-svc/bindings/rust/.well-known/security.txt delete mode 100644 k9-svc/bindings/rust/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/CHANGELOG.adoc delete mode 100644 k9-svc/bindings/rust/CONTRIBUTING.adoc delete mode 100644 k9-svc/bindings/rust/Cargo.lock delete mode 100644 k9-svc/bindings/rust/Cargo.toml delete mode 100644 k9-svc/bindings/rust/Containerfile delete mode 100644 k9-svc/bindings/rust/Justfile delete mode 100644 k9-svc/bindings/rust/LICENSE delete mode 100644 k9-svc/bindings/rust/README.adoc delete mode 100644 k9-svc/bindings/rust/ROADMAP.adoc delete mode 100644 k9-svc/bindings/rust/SECURITY.adoc delete mode 100644 k9-svc/bindings/rust/benches/k9_bench.rs delete mode 120000 k9-svc/bindings/rust/container/.gatekeeper.yaml delete mode 100644 k9-svc/bindings/rust/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/container/Containerfile delete mode 100644 k9-svc/bindings/rust/container/README.adoc delete mode 100644 k9-svc/bindings/rust/container/compose.example.toml delete mode 100644 k9-svc/bindings/rust/container/compose.toml delete mode 100755 k9-svc/bindings/rust/container/ct-build.sh delete mode 100644 k9-svc/bindings/rust/container/deploy.k9.ncl delete mode 100755 k9-svc/bindings/rust/container/entrypoint.sh delete mode 100644 k9-svc/bindings/rust/container/manifest.toml delete mode 100644 k9-svc/bindings/rust/container/vordr.toml delete mode 100644 k9-svc/bindings/rust/contractile.just delete mode 100644 k9-svc/bindings/rust/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/QUICKSTART.adoc delete mode 100644 k9-svc/bindings/rust/docs/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/bindings/rust/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/bindings/rust/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/bindings/rust/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/attribution/CITATION.cff delete mode 100644 k9-svc/bindings/rust/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/bindings/rust/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/bindings/rust/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/bindings/rust/docs/attribution/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/bindings/rust/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/bindings/rust/docs/decisions/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/bindings/rust/docs/developer/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/TSDM.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/bindings/rust/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/bindings/rust/docs/practice/.gitkeep delete mode 100644 k9-svc/bindings/rust/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/bindings/rust/docs/practice/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/performance/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/quality/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/reports/security/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/standards/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/bindings/rust/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/bindings/rust/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/bindings/rust/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/.gitkeep delete mode 100644 k9-svc/bindings/rust/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/computing/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/other/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/bindings/rust/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/docs/wikis/README.adoc delete mode 100644 k9-svc/bindings/rust/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/examples/README.adoc delete mode 100644 k9-svc/bindings/rust/examples/web-project-deno.json delete mode 100644 k9-svc/bindings/rust/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/features/README.adoc delete mode 100644 k9-svc/bindings/rust/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/features/boj-server/README.adoc delete mode 100644 k9-svc/bindings/rust/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/features/panic-attacker/README.adoc delete mode 100644 k9-svc/bindings/rust/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/features/ssg/README.adoc delete mode 100755 k9-svc/bindings/rust/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/bindings/rust/src/error.rs delete mode 100644 k9-svc/bindings/rust/src/lib.rs delete mode 100644 k9-svc/bindings/rust/src/parser.rs delete mode 100644 k9-svc/bindings/rust/src/renderer.rs delete mode 100644 k9-svc/bindings/rust/src/types.rs delete mode 100644 k9-svc/bindings/rust/tests/crg_c_tests.rs delete mode 100644 k9-svc/bindings/rust/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/benchmarks/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/coverage/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/fuzzing/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/proofs/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/safety_case/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/simulations/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/tests/README.adoc delete mode 100644 k9-svc/bindings/rust/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/bindings/rust/verification/traceability/README.adoc delete mode 100644 k9-svc/compose.yaml delete mode 100644 k9-svc/eclexiaiser.toml delete mode 100644 k9-svc/editors/k9-notepadpp.xml delete mode 100644 k9-svc/editors/k9.tmLanguage.json delete mode 100644 k9-svc/editors/vscode/.devcontainer/Containerfile delete mode 100644 k9-svc/editors/vscode/.devcontainer/README.adoc delete mode 100644 k9-svc/editors/vscode/.devcontainer/devcontainer.json delete mode 100644 k9-svc/editors/vscode/.editorconfig delete mode 100644 k9-svc/editors/vscode/.envrc delete mode 100644 k9-svc/editors/vscode/.gitattributes delete mode 100644 k9-svc/editors/vscode/.github/.mailmap delete mode 100644 k9-svc/editors/vscode/.github/.nojekyll delete mode 100644 k9-svc/editors/vscode/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.github/CODEOWNERS delete mode 100644 k9-svc/editors/vscode/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/editors/vscode/.github/CONTRIBUTING.md delete mode 100644 k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/editors/vscode/.github/FUNDING.yml delete mode 100644 k9-svc/editors/vscode/.github/GOVERNANCE.md delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/editors/vscode/.github/MAINTAINERS delete mode 100644 k9-svc/editors/vscode/.github/README.adoc delete mode 100644 k9-svc/editors/vscode/.github/SECURITY.md delete mode 100644 k9-svc/editors/vscode/.github/SUPPORT delete mode 100644 k9-svc/editors/vscode/.github/copilot-instructions.md delete mode 100644 k9-svc/editors/vscode/.github/dependabot.yml delete mode 100644 k9-svc/editors/vscode/.github/pull_request_template.md delete mode 100644 k9-svc/editors/vscode/.github/workflows/codeql.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/governance.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/jekyll.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/mirror.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/release.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/scorecard.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/editors/vscode/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/editors/vscode/.gitignore delete mode 100644 k9-svc/editors/vscode/.gitlab-ci.yml delete mode 100644 k9-svc/editors/vscode/.guix-channel delete mode 100644 k9-svc/editors/vscode/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/editors/vscode/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/editors/vscode/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/editors/vscode/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/editors/vscode/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/editors/vscode/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/editors/vscode/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/editors/vscode/.tool-versions delete mode 100644 k9-svc/editors/vscode/.well-known/ai.txt delete mode 100644 k9-svc/editors/vscode/.well-known/humans.txt delete mode 100644 k9-svc/editors/vscode/.well-known/security.txt delete mode 100644 k9-svc/editors/vscode/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/CHANGELOG.adoc delete mode 100644 k9-svc/editors/vscode/CONTRIBUTING.adoc delete mode 100644 k9-svc/editors/vscode/Containerfile delete mode 100644 k9-svc/editors/vscode/Justfile delete mode 100644 k9-svc/editors/vscode/LICENSE delete mode 100644 k9-svc/editors/vscode/LICENSE-PMPL delete mode 100644 k9-svc/editors/vscode/README.adoc delete mode 100644 k9-svc/editors/vscode/ROADMAP.adoc delete mode 100644 k9-svc/editors/vscode/SECURITY.adoc delete mode 120000 k9-svc/editors/vscode/container/.gatekeeper.yaml delete mode 100644 k9-svc/editors/vscode/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/container/Containerfile delete mode 100644 k9-svc/editors/vscode/container/README.adoc delete mode 100644 k9-svc/editors/vscode/container/compose.example.toml delete mode 100644 k9-svc/editors/vscode/container/compose.toml delete mode 100755 k9-svc/editors/vscode/container/ct-build.sh delete mode 100644 k9-svc/editors/vscode/container/deploy.k9.ncl delete mode 100755 k9-svc/editors/vscode/container/entrypoint.sh delete mode 100644 k9-svc/editors/vscode/container/manifest.toml delete mode 100644 k9-svc/editors/vscode/container/vordr.toml delete mode 100644 k9-svc/editors/vscode/contractile.just delete mode 100644 k9-svc/editors/vscode/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/QUICKSTART.adoc delete mode 100644 k9-svc/editors/vscode/docs/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/editors/vscode/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/editors/vscode/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/editors/vscode/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/attribution/CITATION.cff delete mode 100644 k9-svc/editors/vscode/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/editors/vscode/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/editors/vscode/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/editors/vscode/docs/attribution/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/editors/vscode/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/editors/vscode/docs/decisions/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/editors/vscode/docs/developer/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/TSDM.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/editors/vscode/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/editors/vscode/docs/practice/.gitkeep delete mode 100644 k9-svc/editors/vscode/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/editors/vscode/docs/practice/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/performance/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/quality/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/reports/security/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/standards/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/editors/vscode/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/editors/vscode/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/editors/vscode/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/.gitkeep delete mode 100644 k9-svc/editors/vscode/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/computing/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/other/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/editors/vscode/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/docs/wikis/README.adoc delete mode 100644 k9-svc/editors/vscode/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/examples/README.adoc delete mode 100644 k9-svc/editors/vscode/examples/web-project-deno.json delete mode 100644 k9-svc/editors/vscode/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/features/README.adoc delete mode 100644 k9-svc/editors/vscode/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/features/boj-server/README.adoc delete mode 100644 k9-svc/editors/vscode/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/features/panic-attacker/README.adoc delete mode 100644 k9-svc/editors/vscode/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/features/ssg/README.adoc delete mode 100755 k9-svc/editors/vscode/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/editors/vscode/icons/k9-icon.svg delete mode 100644 k9-svc/editors/vscode/language-configuration-nickel.json delete mode 100644 k9-svc/editors/vscode/language-configuration.json delete mode 100644 k9-svc/editors/vscode/package.json delete mode 100644 k9-svc/editors/vscode/snippets/k9-nickel.json delete mode 100644 k9-svc/editors/vscode/snippets/k9.json delete mode 100644 k9-svc/editors/vscode/src/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/README.adoc delete mode 100644 k9-svc/editors/vscode/src/aspects/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/aspects/README.adoc delete mode 100644 k9-svc/editors/vscode/src/aspects/integrity/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/aspects/integrity/README.adoc delete mode 100644 k9-svc/editors/vscode/src/aspects/observability/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/aspects/observability/README.adoc delete mode 100644 k9-svc/editors/vscode/src/aspects/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/aspects/security/README.adoc delete mode 100644 k9-svc/editors/vscode/src/bridges/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/contracts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/contracts/README.adoc delete mode 100644 k9-svc/editors/vscode/src/core/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/definitions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/definitions/README.adoc delete mode 100644 k9-svc/editors/vscode/src/errors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/errors/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/abi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/abi/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/build.zig delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/src/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/src/main.zig delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/test/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/ffi/test/integration_test.zig delete mode 100644 k9-svc/editors/vscode/src/interface/generated/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/generated/README.adoc delete mode 100644 k9-svc/editors/vscode/src/interface/generated/abi/.gitkeep delete mode 100644 k9-svc/editors/vscode/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/src/interface/generated/abi/README.adoc delete mode 100644 k9-svc/editors/vscode/syntaxes/k9-nickel.tmLanguage.json delete mode 100644 k9-svc/editors/vscode/syntaxes/k9.tmLanguage.json delete mode 100644 k9-svc/editors/vscode/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/benchmarks/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/coverage/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/fuzzing/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/proofs/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/safety_case/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/simulations/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/tests/README.adoc delete mode 100644 k9-svc/editors/vscode/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/editors/vscode/verification/traceability/README.adoc delete mode 100644 k9-svc/examples/NOT-a-good-fit.adoc delete mode 100644 k9-svc/examples/complex.k9 delete mode 100644 k9-svc/examples/config.k9.ncl delete mode 100644 k9-svc/examples/container-deploy.k9.ncl delete mode 100644 k9-svc/examples/conversation-walkthrough.txt delete mode 100644 k9-svc/examples/deploy.k9.ncl delete mode 100644 k9-svc/examples/hello.k9 delete mode 100644 k9-svc/examples/hello.k9.ncl delete mode 100644 k9-svc/examples/simple.k9 delete mode 100755 k9-svc/k9-scan delete mode 100644 k9-svc/k9-sign/.gitignore delete mode 100644 k9-svc/k9-sign/Cargo.toml delete mode 100644 k9-svc/k9-sign/MIGRATION.adoc delete mode 100644 k9-svc/k9-sign/README.adoc delete mode 100755 k9-svc/k9-sign/install.sh delete mode 100644 k9-svc/k9-sign/src/main.rs delete mode 100644 k9-svc/k9-sign/src/tests.rs delete mode 100644 k9-svc/lsp/Cargo.lock delete mode 100644 k9-svc/lsp/Cargo.toml delete mode 100644 k9-svc/lsp/README.adoc delete mode 100644 k9-svc/lsp/src/completions.rs delete mode 100644 k9-svc/lsp/src/diagnostics.rs delete mode 100644 k9-svc/lsp/src/hover.rs delete mode 100644 k9-svc/lsp/src/main.rs delete mode 100644 k9-svc/manifest.scm delete mode 100644 k9-svc/mime/k9.magic delete mode 100644 k9-svc/mime/k9.uti.plist delete mode 100644 k9-svc/mime/k9.xml delete mode 100644 k9-svc/mime/mime.types delete mode 100755 k9-svc/must delete mode 100644 k9-svc/packaging/aur/.SRCINFO delete mode 100644 k9-svc/packaging/aur/PKGBUILD delete mode 100644 k9-svc/packaging/aur/SUBMIT.adoc delete mode 100644 k9-svc/packaging/homebrew/k9-svc.rb delete mode 100644 k9-svc/pandoc/.devcontainer/Containerfile delete mode 100644 k9-svc/pandoc/.devcontainer/README.adoc delete mode 100644 k9-svc/pandoc/.devcontainer/devcontainer.json delete mode 100644 k9-svc/pandoc/.editorconfig delete mode 100644 k9-svc/pandoc/.envrc delete mode 100644 k9-svc/pandoc/.gitattributes delete mode 100644 k9-svc/pandoc/.github/.mailmap delete mode 100644 k9-svc/pandoc/.github/.nojekyll delete mode 100644 k9-svc/pandoc/.github/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.github/CODEOWNERS delete mode 100644 k9-svc/pandoc/.github/CODE_OF_CONDUCT.md delete mode 100644 k9-svc/pandoc/.github/CONTRIBUTING.md delete mode 100644 k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/ideas.yml delete mode 100644 k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/q-and-a.yml delete mode 100644 k9-svc/pandoc/.github/FUNDING.yml delete mode 100644 k9-svc/pandoc/.github/GOVERNANCE.md delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/bug_report.yml delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/config.yml delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/custom.yml delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/documentation.yml delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/feature_request.yml delete mode 100644 k9-svc/pandoc/.github/ISSUE_TEMPLATE/question.yml delete mode 100644 k9-svc/pandoc/.github/MAINTAINERS delete mode 100644 k9-svc/pandoc/.github/README.adoc delete mode 100644 k9-svc/pandoc/.github/SECURITY.md delete mode 100644 k9-svc/pandoc/.github/SUPPORT delete mode 100644 k9-svc/pandoc/.github/copilot-instructions.md delete mode 100644 k9-svc/pandoc/.github/dependabot.yml delete mode 100644 k9-svc/pandoc/.github/pull_request_template.md delete mode 100644 k9-svc/pandoc/.github/workflows/codeql.yml delete mode 100644 k9-svc/pandoc/.github/workflows/governance.yml delete mode 100644 k9-svc/pandoc/.github/workflows/hypatia-scan.yml delete mode 100644 k9-svc/pandoc/.github/workflows/jekyll.yml delete mode 100644 k9-svc/pandoc/.github/workflows/mirror.yml delete mode 100644 k9-svc/pandoc/.github/workflows/release.yml delete mode 100644 k9-svc/pandoc/.github/workflows/rhodibot.yml delete mode 100644 k9-svc/pandoc/.github/workflows/scorecard-enforcer.yml delete mode 100644 k9-svc/pandoc/.github/workflows/scorecard.yml delete mode 100644 k9-svc/pandoc/.github/workflows/secret-scanner.yml delete mode 100644 k9-svc/pandoc/.github/workflows/static-analysis-gate.yml delete mode 100644 k9-svc/pandoc/.gitignore delete mode 100644 k9-svc/pandoc/.gitlab-ci.yml delete mode 100644 k9-svc/pandoc/.guix-channel delete mode 100644 k9-svc/pandoc/.machine_readable/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/CLADE.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/ENSAID_CONFIG.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/ai/.clinerules delete mode 100644 k9-svc/pandoc/.machine_readable/ai/.cursorrules delete mode 100644 k9-svc/pandoc/.machine_readable/ai/.windsurfrules delete mode 100644 k9-svc/pandoc/.machine_readable/ai/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/ai/AI.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/ai/PLACEHOLDERS.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/ai/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/anchors/ANCHOR.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/anchors/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/compliance/reuse/dep5 delete mode 100644 k9-svc/pandoc/.machine_readable/compliance/rust/deny.toml delete mode 100644 k9-svc/pandoc/.machine_readable/configs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/configs/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/configs/git-cliff/cliff.toml delete mode 100644 k9-svc/pandoc/.machine_readable/contractiles/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/AGENTIC.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/ECOSYSTEM.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/META.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/NEUROSYM.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/PLAYBOOK.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/descriptiles/STATE.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/policies/.maintenance-perms-ignore delete mode 100644 k9-svc/pandoc/.machine_readable/policies/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-AXES.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/policies/README.adoc delete mode 100644 k9-svc/pandoc/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/forge/README.adoc delete mode 100755 k9-svc/pandoc/.machine_readable/scripts/forge/forge-sync.sh delete mode 100755 k9-svc/pandoc/.machine_readable/scripts/forge/git-cleanup.sh delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/lifecycle/README.adoc delete mode 100755 k9-svc/pandoc/.machine_readable/scripts/lifecycle/install-tools.sh delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/maintenance/maint-assault.sh delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/.machine_readable/scripts/verification/README.adoc delete mode 100644 k9-svc/pandoc/.tool-versions delete mode 100644 k9-svc/pandoc/.well-known/ai.txt delete mode 100644 k9-svc/pandoc/.well-known/humans.txt delete mode 100644 k9-svc/pandoc/.well-known/security.txt delete mode 100644 k9-svc/pandoc/0-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/CHANGELOG.adoc delete mode 100644 k9-svc/pandoc/CONTRIBUTING.adoc delete mode 100644 k9-svc/pandoc/Containerfile delete mode 100644 k9-svc/pandoc/Justfile delete mode 100644 k9-svc/pandoc/LICENSE delete mode 100644 k9-svc/pandoc/PANDOC-SUBMISSION.adoc delete mode 100644 k9-svc/pandoc/README.adoc delete mode 100644 k9-svc/pandoc/ROADMAP.adoc delete mode 100644 k9-svc/pandoc/SECURITY.adoc delete mode 120000 k9-svc/pandoc/container/.gatekeeper.yaml delete mode 100644 k9-svc/pandoc/container/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/container/Containerfile delete mode 100644 k9-svc/pandoc/container/README.adoc delete mode 100644 k9-svc/pandoc/container/compose.example.toml delete mode 100644 k9-svc/pandoc/container/compose.toml delete mode 100755 k9-svc/pandoc/container/ct-build.sh delete mode 100644 k9-svc/pandoc/container/deploy.k9.ncl delete mode 100755 k9-svc/pandoc/container/entrypoint.sh delete mode 100644 k9-svc/pandoc/container/manifest.toml delete mode 100644 k9-svc/pandoc/container/vordr.toml delete mode 100644 k9-svc/pandoc/contractile.just delete mode 100644 k9-svc/pandoc/docs/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/QUICKSTART.adoc delete mode 100644 k9-svc/pandoc/docs/README.adoc delete mode 100644 k9-svc/pandoc/docs/RSR_OUTLINE.adoc delete mode 100644 k9-svc/pandoc/docs/STATE-VISUALIZER.adoc delete mode 100644 k9-svc/pandoc/docs/architecture/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/architecture/THREAT-MODEL.adoc delete mode 100644 k9-svc/pandoc/docs/attribution/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/attribution/CITATION.cff delete mode 100644 k9-svc/pandoc/docs/attribution/CITATIONS.adoc delete mode 100644 k9-svc/pandoc/docs/attribution/CODEOWNERS.adoc delete mode 100644 k9-svc/pandoc/docs/attribution/MAINTAINERS.adoc delete mode 100644 k9-svc/pandoc/docs/attribution/README.adoc delete mode 100644 k9-svc/pandoc/docs/decisions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/decisions/0000-template.adoc delete mode 100644 k9-svc/pandoc/docs/decisions/0001-adopt-rsr-standard.adoc delete mode 100644 k9-svc/pandoc/docs/decisions/README.adoc delete mode 100644 k9-svc/pandoc/docs/developer/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/developer/ABI-FFI-README.adoc delete mode 100644 k9-svc/pandoc/docs/developer/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/CRG-CRITERIA.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/CRG-CRITERIA.adoc delete mode 100644 k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.adoc delete mode 100644 k9-svc/pandoc/docs/governance/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc delete mode 100644 k9-svc/pandoc/docs/governance/TSDM.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/TSDM.adoc delete mode 100644 k9-svc/pandoc/docs/governance/audit/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/audit/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/audit/compliance/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/audit/effects/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/audit/systems/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/adaptive/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/corrective/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/maintenance/perfective/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/planning/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/planning/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/planning/could/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/planning/must/README.adoc delete mode 100644 k9-svc/pandoc/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/governance/planning/should/README.adoc delete mode 100644 k9-svc/pandoc/docs/legal/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/legal/EXHIBIT-A-ETHICAL-USE.txt delete mode 100644 k9-svc/pandoc/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt delete mode 100644 k9-svc/pandoc/docs/practice/.gitkeep delete mode 100644 k9-svc/pandoc/docs/practice/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/practice/AI-CONVENTIONS.adoc delete mode 100644 k9-svc/pandoc/docs/practice/README.adoc delete mode 100644 k9-svc/pandoc/docs/practice/STATE-VISUALIZER-GUIDE.adoc delete mode 100644 k9-svc/pandoc/docs/reports/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/README.adoc delete mode 100644 k9-svc/pandoc/docs/reports/compliance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/compliance/README.adoc delete mode 100644 k9-svc/pandoc/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/maintenance/README.adoc delete mode 100644 k9-svc/pandoc/docs/reports/performance/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/performance/README.adoc delete mode 100644 k9-svc/pandoc/docs/reports/quality/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/quality/README.adoc delete mode 100644 k9-svc/pandoc/docs/reports/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/reports/security/README.adoc delete mode 100644 k9-svc/pandoc/docs/standards/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/standards/README.adoc delete mode 100644 k9-svc/pandoc/docs/templates/contractiles/README.adoc delete mode 100644 k9-svc/pandoc/docs/templates/contractiles/dust/Dustfile.a2ml delete mode 100644 k9-svc/pandoc/docs/templates/contractiles/intend/Intentfile.a2ml delete mode 100644 k9-svc/pandoc/docs/templates/contractiles/must/Mustfile.a2ml delete mode 100644 k9-svc/pandoc/docs/templates/contractiles/trust/Trustfile.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/.gitkeep delete mode 100644 k9-svc/pandoc/docs/theory/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/computing/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/computing/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/formalisms/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/mathematics/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/ontologies/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/other/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/other/README.adoc delete mode 100644 k9-svc/pandoc/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/theory/socio-technical/README.adoc delete mode 100644 k9-svc/pandoc/docs/whitepapers/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/whitepapers/README.adoc delete mode 100644 k9-svc/pandoc/docs/whitepapers/academic/.gitkeep delete mode 100644 k9-svc/pandoc/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/whitepapers/academic/README.adoc delete mode 100644 k9-svc/pandoc/docs/whitepapers/industry/.gitkeep delete mode 100644 k9-svc/pandoc/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/whitepapers/industry/README.adoc delete mode 100644 k9-svc/pandoc/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/whitepapers/outreach/README.adoc delete mode 100644 k9-svc/pandoc/docs/wikis/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/docs/wikis/README.adoc delete mode 100644 k9-svc/pandoc/examples/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/examples/README.adoc delete mode 100644 k9-svc/pandoc/examples/web-project-deno.json delete mode 100644 k9-svc/pandoc/features/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/features/README.adoc delete mode 100644 k9-svc/pandoc/features/boj-server/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/features/boj-server/README.adoc delete mode 100644 k9-svc/pandoc/features/panic-attacker/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/features/panic-attacker/README.adoc delete mode 100644 k9-svc/pandoc/features/ssg/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/features/ssg/README.adoc delete mode 100755 k9-svc/pandoc/features/ssg/ssg-bootstrap.sh delete mode 100644 k9-svc/pandoc/k9-filter.lua delete mode 100644 k9-svc/pandoc/k9-reader.lua delete mode 100644 k9-svc/pandoc/k9-writer.lua delete mode 100644 k9-svc/pandoc/k9.html delete mode 100644 k9-svc/pandoc/k9.lua delete mode 100644 k9-svc/pandoc/pandoc-k9-scm-1.rockspec delete mode 100644 k9-svc/pandoc/sample.k9 delete mode 100644 k9-svc/pandoc/sample.k9.ncl delete mode 100644 k9-svc/pandoc/src/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/README.adoc delete mode 100644 k9-svc/pandoc/src/aspects/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/aspects/README.adoc delete mode 100644 k9-svc/pandoc/src/aspects/integrity/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/aspects/integrity/README.adoc delete mode 100644 k9-svc/pandoc/src/aspects/observability/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/aspects/observability/README.adoc delete mode 100644 k9-svc/pandoc/src/aspects/security/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/aspects/security/README.adoc delete mode 100644 k9-svc/pandoc/src/bridges/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/contracts/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/contracts/README.adoc delete mode 100644 k9-svc/pandoc/src/core/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/definitions/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/definitions/README.adoc delete mode 100644 k9-svc/pandoc/src/errors/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/errors/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/abi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/abi/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/ffi/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/ffi/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/ffi/build.zig delete mode 100644 k9-svc/pandoc/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/ffi/src/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/ffi/src/main.zig delete mode 100644 k9-svc/pandoc/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/ffi/test/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/ffi/test/integration_test.zig delete mode 100644 k9-svc/pandoc/src/interface/generated/0.3-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/generated/README.adoc delete mode 100644 k9-svc/pandoc/src/interface/generated/abi/.gitkeep delete mode 100644 k9-svc/pandoc/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/src/interface/generated/abi/README.adoc delete mode 100644 k9-svc/pandoc/verification/0.1-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/README.adoc delete mode 100644 k9-svc/pandoc/verification/benchmarks/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/benchmarks/README.adoc delete mode 100644 k9-svc/pandoc/verification/coverage/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/coverage/README.adoc delete mode 100644 k9-svc/pandoc/verification/fuzzing/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/fuzzing/README.adoc delete mode 100644 k9-svc/pandoc/verification/proofs/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/proofs/README.adoc delete mode 100644 k9-svc/pandoc/verification/safety_case/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/safety_case/README.adoc delete mode 100644 k9-svc/pandoc/verification/simulations/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/simulations/README.adoc delete mode 100644 k9-svc/pandoc/verification/tests/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/tests/README.adoc delete mode 100644 k9-svc/pandoc/verification/traceability/0.2-AI-MANIFEST.a2ml delete mode 100644 k9-svc/pandoc/verification/traceability/README.adoc delete mode 100644 k9-svc/receipt/PROFILE.a2ml delete mode 100644 k9-svc/receipt/README.adoc delete mode 100644 k9-svc/receipt/example-receipt.a2ml delete mode 100644 k9-svc/receipt/example-receipt.json delete mode 100644 k9-svc/receipt/receipt.schema.json delete mode 100644 k9-svc/release-k9.k9.ncl delete mode 100755 k9-svc/scripts/deploy-site.sh delete mode 100644 k9-svc/showcase/content/examples.adoc delete mode 100644 k9-svc/showcase/content/getting-started.adoc delete mode 100644 k9-svc/showcase/content/index.adoc delete mode 100644 k9-svc/showcase/content/integrations.adoc delete mode 100644 k9-svc/showcase/content/security-levels.adoc delete mode 100644 k9-svc/showcase/output/examples.html delete mode 100644 k9-svc/showcase/output/getting-started.html delete mode 100644 k9-svc/showcase/output/index.html delete mode 100644 k9-svc/showcase/output/integrations.html delete mode 100644 k9-svc/showcase/output/security-levels.html delete mode 100644 k9-svc/showcase/template.html delete mode 100755 k9-svc/sign.sh delete mode 120000 k9-svc/site/assets/style.css delete mode 100644 k9-svc/site/downloads.adoc delete mode 100644 k9-svc/site/index.adoc delete mode 100644 k9-svc/site/public/.well-known/security.txt delete mode 100644 k9-svc/site/public/CNAME delete mode 100644 k9-svc/site/public/downloads/README.adoc delete mode 100644 k9-svc/site/public/downloads/k9-svc-templates.tar.gz delete mode 100644 k9-svc/site/public/downloads/level1-data.k9.ncl delete mode 100644 k9-svc/site/public/downloads/level2-validated.k9.ncl delete mode 100644 k9-svc/site/public/downloads/level3-signed.k9.ncl delete mode 100644 k9-svc/site/public/favicon.svg delete mode 100644 k9-svc/site/public/robots.txt delete mode 100644 k9-svc/site/roadmap.adoc delete mode 100644 k9-svc/site/spec.adoc delete mode 100644 k9-svc/site/start.adoc delete mode 120000 k9-svc/site/templates/default.html delete mode 100755 k9-svc/test.sh delete mode 100644 k9-svc/tools/Justfile delete mode 100644 k9-svc/tools/README.adoc delete mode 100644 k9-svc/tools/github-action/action.yml delete mode 100644 k9-svc/tools/manifest.scm delete mode 100644 k9-svc/tools/src/k9-init/Cargo.lock delete mode 100644 k9-svc/tools/src/k9-init/Cargo.toml delete mode 100644 k9-svc/tools/src/k9-init/src/main.rs delete mode 100644 k9-svc/tools/src/k9-sign/Cargo.lock delete mode 100644 k9-svc/tools/src/k9-sign/Cargo.toml delete mode 100644 k9-svc/tools/src/k9-sign/src/main.rs delete mode 100644 k9-svc/tools/src/k9-validate/Cargo.lock delete mode 100644 k9-svc/tools/src/k9-validate/Cargo.toml delete mode 100644 k9-svc/tools/src/k9-validate/src/main.rs delete mode 100644 k9-svc/tools/templates/minimal/template.k9.ncl delete mode 100644 k9-svc/tools/vscode-extension/package.json diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 2b0561ba..893b1dfb 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -40,13 +40,6 @@ "file": "a2ml/bindings/rust/benches/a2ml_bench.rs", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Criterion bench harness, not a production hot path; expect on static fixtures is idiomatic and unreachable by user input. Rule should exclude benches/." }, - { - "severity": "medium", - "rule_module": "code_safety", - "type": "expect_in_hot_path", - "file": "k9-svc/bindings/rust/benches/k9_bench.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Not a hot production path: criterion benchmark harness over constant fixtures. expect() with a message is the idiomatic bench failure mode. Rule should exclude benches/ directories." - }, { "severity": "high", "rule_module": "code_safety", @@ -65,15 +58,6 @@ "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#492" }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "lock_unwrap", - "file": "k9-svc/lsp/src/main.rs", - "note": "TRACKED DEBT (hypatia triage 2026-07-21): Production LSP server: one panicked holder poisons the mutex and every later request panics, killing the server. Fix (parking_lot or poison recovery) is non-trivial. k9-svc evicting under #491.", - "expires_at": "2026-10-21", - "tracking_issue": "hyperpolymath/standards#491" - }, { "severity": "high", "rule_module": "code_safety", @@ -115,13 +99,6 @@ "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#399" }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "shell_download_then_run", - "file": "k9-svc/k9-sign/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The curl|sh is never executed \u2014 it is a printed installation hint. Rule should ignore pattern inside echo/string literals." - }, { "severity": "high", "rule_module": "code_safety", @@ -216,20 +193,6 @@ "file": "a2ml/lsp/src/hover.rs", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same infallible const-regex/mandatory-capture pattern as diagnostics.rs; cannot panic at runtime. Baseline permanently." }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "k9-svc/bindings/rust/src/parser.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): The single production unwrap is provably infallible (strip_prefix guarded by starts_with of the same literal). Remaining unwraps are a doc-comment (L60) and #[test] code (L421+)." - }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "unwrap_without_check", - "file": "k9-svc/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): All 14 unwraps are Regex::new on string-literal patterns (infallible at runtime) or caps.get(n) for groups guaranteed by those same literal patterns. No reachable panic on any input." - }, { "severity": "high", "rule_module": "code_safety", @@ -350,27 +313,6 @@ "file": "avow-protocol/avow-lib/examples/rust/src/main.rs", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); as_ptr into an FFI param struct is the intended example-code pattern. avow-protocol/** carved out to #492." }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "k9-svc/k9-sign/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Doubly false: CSA mirror double-report (#378) AND underlying pattern is an echoed instruction string, not an executed pipeline. k9-svc/** carved out to #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "k9-svc/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report of Hypatia's own alert (standards#378). k9-svc/** carved out to #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA001", - "file": "k9-svc/lsp/src/main.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378); the lock().unwrap() pattern is tracked by the primary code_safety rule. k9-svc/** carved out to #491." - }, { "severity": "high", "rule_module": "code_scanning_alerts", @@ -506,27 +448,6 @@ "file": "avow-protocol/avow-lib/examples/rust/src/main.rs", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report per standards#378: hypatia re-ingests its own code-scanning alert. Underlying file is avow-protocol product awaiting eviction (#492); as_ptr in an FFI example is idiomatic." }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "k9-svc/k9-sign/install.sh", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378), and the underlying alert itself misfires on an echoed string, not executed code. k9-svc/** also carved out under #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "k9-svc/lsp/src/diagnostics.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own unwrap_dangerous_default alert; k9-svc/** tracked under eviction #491." - }, - { - "severity": "high", - "rule_module": "code_scanning_alerts", - "type": "CSA003", - "file": "k9-svc/lsp/src/main.rs", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Mirror double-report (standards#378) of hypatia's own lock_unwrap alert; k9-svc/** product debt tracked under eviction #491." - }, { "severity": "high", "rule_module": "code_scanning_alerts", @@ -622,48 +543,6 @@ "file": "a2ml/pandoc/.envrc", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same templated .envrc placeholder; commented out, value \"...\". No secret." }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/actions/validate/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same template placeholder; commented out, no value. Not a secret; baseline permanently, fix rule upstream." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/bindings/deno/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Placeholder in a direnv template, commented out, value is literal ellipsis. Not a secret. Upstream rule should ignore commented lines / \"...\" values. Dir tracked by #490/#491 eviction anyway." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/bindings/haskell/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same template placeholder; commented out, no value. Not a secret; baseline permanently, fix rule upstream." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/bindings/rust/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same template placeholder as deno/.envrc; commented out, no value. Not a secret; baseline permanently, fix rule upstream." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/editors/vscode/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same template placeholder; commented out, no value. Not a secret; baseline permanently, fix rule upstream." - }, - { - "severity": "critical", - "rule_module": "security_errors", - "type": "secret_detected", - "file": "k9-svc/pandoc/.envrc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Same template placeholder; commented out, no value. Not a secret; baseline permanently, fix rule upstream." - }, { "severity": "medium", "rule_module": "structural_drift", @@ -783,13 +662,6 @@ "file": "k9-coordination-protocol/spec/COORDINATION-K9-SPEC.adoc", "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Illustrative YAML example in a protocol spec (sample invariants/protected config for a hypothetical project). Not a reference to this repo's tree." }, - { - "severity": "medium", - "rule_module": "structural_drift", - "type": "SD022", - "file": "k9-svc/examples/NOT-a-good-fit.adoc", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Hypothetical anti-pattern example in a doc titled NOT-a-good-fit \u2014 the directory is deliberately fictional. (k9-svc is also carve-out #491, but the finding is simply wrong.)" - }, { "severity": "medium", "rule_module": "structural_drift", diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index 11124a01..683292ed 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -45,7 +45,7 @@ name = "A2ML — Attested Markup Language" stream = "foundation" home = "a2ml/" canonical_doc = "a2ml/README.adoc" -source_hash = "sha256:a79bce448d650dabd8d831212880b4814da1d1f6583de0ad2d39875c5a1fbecf" +source_hash = "sha256:0a1d767bef0a5eb5c9483598d92d12d998e7544a71ee1683be6938bdf346cd66" route = "the typed/verified machine-readable document format" [[spec]] @@ -54,8 +54,8 @@ name = "K9 Self-Validating Components" stream = "foundation" home = "k9-svc/" canonical_doc = "k9-svc/README.adoc" -source_hash = "sha256:6bcd9a401b27600886129a8b644746fff23e4633b51936b965f51238afb9fa04" -route = "self-validating components with embedded contracts + deploy logic" +source_hash = "sha256:4ba193d1382c4e15031060a2c7194547546bcfcfc3d9ecdc98a46e252b5530cc" +route = "the K9 specification, security analysis and adoption guidance (implementations live in hyperpolymath/k9-ecosystem)" [[spec]] id = "contractiles" @@ -72,7 +72,7 @@ name = "META.a2ml spec" stream = "foundation" home = "meta-a2ml/" canonical_doc = "meta-a2ml/README.adoc" -source_hash = "sha256:2818a77ee141782f336b43f2266783691064b775deb33ea768c1560268375835" +source_hash = "sha256:bd3936fa6ba46443167950d983749e4b130373183f3d647aa60aebde7789bede" route = "architecture decisions / governance metadata format" [[spec]] @@ -81,7 +81,7 @@ name = "STATE.a2ml spec" stream = "foundation" home = "state-a2ml/" canonical_doc = "state-a2ml/README.adoc" -source_hash = "sha256:b610769df9d0119793f830208be964c97894242c987c3a9791856d06f7b24f29" +source_hash = "sha256:8ec140f16e80e96a53c8365df6c06fea50bf2625f84e4ddaa306e5d10721af18" route = "project-state metadata format (drives this registry's topology)" [[spec]] @@ -90,7 +90,7 @@ name = "ECOSYSTEM.a2ml spec" stream = "foundation" home = "ecosystem-a2ml/" canonical_doc = "ecosystem-a2ml/README.adoc" -source_hash = "sha256:a0d9c7728e32a36d4eaa0ddf22bb2fc7b60a85e9b50d267673e1abb2e2ef94c9" +source_hash = "sha256:7fbd11721e97bd85f8200db8a75267be4d7347f82ad0226e9b1296c92d47f9f2" route = "ecosystem-positioning metadata format" [[spec]] @@ -99,7 +99,7 @@ name = "AGENTIC.a2ml spec" stream = "foundation" home = "agentic-a2ml/" canonical_doc = "agentic-a2ml/README.adoc" -source_hash = "sha256:b95623f7df243aed2c791c327790cfc4d28fc61a3163625ac6c41e85d8c0f83e" +source_hash = "sha256:025e72fc7cbddeeb4e92b3d1aedd74e812f164644dd9ecd26010e4ff26a74c3a" route = "AI-agent operational gating / entropy budgets" [[spec]] @@ -108,7 +108,7 @@ name = "NEUROSYM.a2ml spec" stream = "foundation" home = "neurosym-a2ml/" canonical_doc = "neurosym-a2ml/README.adoc" -source_hash = "sha256:be62099578501b961a948d2218e4ab07ee2b575d8affd03724df493fb63d2e8e" +source_hash = "sha256:753f11a288d6402296a6dc2fc69c0cca986e164d6319b7b789e159995816ec61" route = "symbolic semantics / proof obligations" [[spec]] @@ -117,7 +117,7 @@ name = "PLAYBOOK.a2ml spec" stream = "foundation" home = "playbook-a2ml/" canonical_doc = "playbook-a2ml/README.adoc" -source_hash = "sha256:eb5a05e3853039b03e1f2376a1711365e2b9f657befe55fbfb4aa6d87a5d9eb3" +source_hash = "sha256:fa6ca3574c64d2c03851fee9a0b5ab28b16eb81ce605690f95571640a577b218" route = "executable operational runbooks" [[spec]] @@ -126,7 +126,7 @@ name = "ANCHOR.a2ml spec" stream = "foundation" home = "anchor-a2ml/" canonical_doc = "anchor-a2ml/README.adoc" -source_hash = "sha256:3948f88c03367bd21992dd068b6ea4d0a9c86a98ea6a51567eaff4990df9a70a" +source_hash = "sha256:d33c7ff6c44dc734eb8fd05bd5c7491176da20237b0a5d8212df25471e6b2765" route = "project-recalibration intervention format" [[spec]] @@ -162,7 +162,7 @@ name = "AXEL Protocol" stream = "protocol" home = "axel-protocol/" canonical_doc = "axel-protocol/README.adoc" -source_hash = "sha256:b0b7c07f4d63aa11557fa53d289010826bd5d84cb48489ee1f708af5d9c639dc" +source_hash = "sha256:e5107e43de348a9aecb9991e33bf066fefcc2b4738925140ea91a2fde627c56d" route = "age-gating + explicit-content enforcement" [[spec]] @@ -180,7 +180,7 @@ name = "ARG — Adoption Readiness Grades" stream = "readiness" home = "adoption-readiness-grades/" canonical_doc = "adoption-readiness-grades/README.adoc" -source_hash = "sha256:8943491cf3991b8c6fd5a53bd83657c63978592510cbe79996b4034ab34ae40d" +source_hash = "sha256:89999392cd908835ea7aa0e8ccbdefbdeacab7bc012c4f040aadc811f9caf587" route = "per-language adoption-maturity profile templates" [[spec]] @@ -189,7 +189,7 @@ name = "FRG — Foundations Readiness Grades" stream = "readiness" home = "foundations-readiness-grades/" canonical_doc = "foundations-readiness-grades/README.adoc" -source_hash = "sha256:af968fdd30947f20898895497dcba7b40850e84d35b5b384ef6d0e509ab6afbd" +source_hash = "sha256:e8cd80df1620ee6cb95a68758c7c51a6406ebbd46cb60e4c8e83cc5d771fa83e" route = "per-language foundational-maturity profile templates" [[spec]] @@ -198,7 +198,7 @@ name = "CRG — Component Readiness Grades" stream = "readiness" home = "component-readiness-grades/" canonical_doc = "component-readiness-grades/README.adoc" -source_hash = "sha256:30a65855c396c43955d3abf77623ecec5932347c9ff83b6ab510b99176acec83" +source_hash = "sha256:a101418a64260691a18f696cd388f6a254a46b73ae680c6e3d1cf46788a3d7a2" route = "the X..A grading system for components" [[spec]] @@ -207,7 +207,7 @@ name = "TRG — Toolchain Readiness Grades" stream = "readiness" home = "toolchain-readiness-grades/" canonical_doc = "toolchain-readiness-grades/README.adoc" -source_hash = "sha256:6290b871c14e8e15ebc07602400bf49deba27724b70dced8e0c0ed7e44859fe5" +source_hash = "sha256:9f88c4e947226a0c53a419458949533eb84c2d7e8a343cb2d547ccca880939b6" route = "per-toolchain readiness profile templates" [[spec]] @@ -243,7 +243,7 @@ name = "ENSAID Config" stream = "governance" home = "ensaid-config/" canonical_doc = "ensaid-config/README.adoc" -source_hash = "sha256:1a5b75d3459b63bf7f3ced7eb8b7e7372c08c3b1d6fbaac6da98d008250d9020" +source_hash = "sha256:c56e9784c957b9bd29704d41cbf7d88b1495789e0ad1c628de42abe900d319ef" route = "the ensaid configuration standard" [[spec]] @@ -288,7 +288,7 @@ name = "A2ML Templates" stream = "integration" home = "a2ml-templates/" canonical_doc = "a2ml-templates/STATE.a2ml.v2.spec.adoc" -source_hash = "sha256:1cd30a08f73b51804af7adb3862c20983b97d30542cc7ff2a653fec4ff4e0063" +source_hash = "sha256:ff30b8e1e7c5d4dcf12d17789e40064b632c92bca3d8c2f891f109dc9157dc4a" route = "copy-in templates for the 7 A2ML files" [[spec]] diff --git a/.machine_readable/scorecards/k9-svc.scorecard.a2ml b/.machine_readable/scorecards/k9-svc.scorecard.a2ml index 976356f9..7a757aad 100644 --- a/.machine_readable/scorecards/k9-svc.scorecard.a2ml +++ b/.machine_readable/scorecards/k9-svc.scorecard.a2ml @@ -12,19 +12,19 @@ assessor = "estate-audit" [[must]] id = "M1" text = "Every `.k9` file MUST begin with the magic number `K9!` (0x4B 0x39 0x21) for L1 identification." -system = "test.sh 'Example Components' section (checks `head -1 examples/hello.k9 | grep K9!`) and mime/k9.xml, mime/k9.magic magic-byte definitions; run in CI job 'test' and 'mime' in .github/workflows/ci.yml." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: test.sh 'Example Components' section (checks `head -1 examples/hello.k9 | grep K9!`) and mime/k9.xml, mime/k9.magic magic-byte definitions; run in CI job 'test' and 'mime' in .github/workflows/ci.yml." +status = "manual-only" evidence = "/home/user/standards/k9-svc/test.sh lines ~128-219 assert hello.k9, k9.xml and k9.magic all carry the K9! magic; examples/hello.k9 exists on disk and CI job `test`/`mime` in ci.yml executes test.sh and xmllint/file checks on push and PR." -check = "test \"$(head -c3 k9-svc/examples/hello.k9)\" = 'K9!' && grep -q 'K9!' k9-svc/mime/k9.xml && grep -q 'K9!' k9-svc/mime/k9.magic" + effects = "Downstream OS/kernel MIME recognition (Freedesktop, UTI, Minix mime.types) and any consumer tool that dispatches on the magic number depend on this holding; if broken, file-type detection silently fails across all K9 consumers." [[must]] id = "M2" text = "An implementation MUST enforce the three-tier Leash security model (Kennel/Yard/Hunt) with escalating capability (data-only -> pure Nickel eval -> full triad execution)." -system = "leash.ncl (canonical encoding) typechecked in CI job 'validate' (`nickel typecheck leash.ncl`) in .github/workflows/ci.yml; test.sh 'Schema Validation' section also runs `nickel typecheck leash.ncl`." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: leash.ncl (canonical encoding) typechecked in CI job 'validate' (`nickel typecheck leash.ncl`) in .github/workflows/ci.yml; test.sh 'Schema Validation' section also runs `nickel typecheck leash.ncl`." +status = "manual-only" evidence = "/home/user/standards/k9-svc/leash.ncl defines `levels.kennel/yard/hunt` with distinct `allows` maps; CI job 'validate' in .github/workflows/ci.yml runs `nickel typecheck leash.ncl` on every push/PR, and test.sh line ~111-115 does the same locally." -check = "grep -q 'kennel' k9-svc/leash.ncl && grep -q 'yard' k9-svc/leash.ncl && grep -q 'hunt' k9-svc/leash.ncl && grep -q 'nickel typecheck leash.ncl' k9-svc/.github/workflows/ci.yml" + effects = "Any tool executing a .k9 component (must, Just recipes, k9-sign, future runtimes) relies on this typed contract; a break would let a Yard component perform I/O or a Kennel component execute code." [[must]] @@ -51,28 +51,28 @@ effects = "Auditability/attestation claims in SPEC.adoc ('Every K9 run emits a r [[must]] id = "M6" text = "MIME registration for `.k9`/`.k9.ncl` MUST be provided for Linux (Freedesktop XML), macOS (UTI plist), and Minix (static mime.types mapping)." -system = "mime/k9.xml, mime/k9.uti.plist, mime/mime.types on disk; validated by CI job 'mime' in .github/workflows/ci.yml (`xmllint --noout mime/k9.xml mime/k9.uti.plist`, `file --compile mime/k9.magic || true`) and register.ncl typechecked in CI job 'validate'." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: mime/k9.xml, mime/k9.uti.plist, mime/mime.types on disk; validated by CI job 'mime' in .github/workflows/ci.yml (`xmllint --noout mime/k9.xml mime/k9.uti.plist`, `file --compile mime/k9.magic || true`) and register.ncl typechecked in CI job 'validate'." +status = "manual-only" evidence = "/home/user/standards/k9-svc/mime/k9.xml, k9.uti.plist, mime.types, k9.magic all exist; ci.yml job 'mime' runs xmllint validation on push/PR; job 'validate' runs `nickel typecheck register.ncl`." -check = "xmllint --noout k9-svc/mime/k9.xml k9-svc/mime/k9.uti.plist && test -f k9-svc/mime/mime.types && test -f k9-svc/mime/k9.magic" + effects = "OS-level file-manager/desktop integration for K9 files across the three named platforms depends on these being syntactically valid and present." [[should]] id = "S1" text = "An implementation SHOULD refuse to run as root by default, requiring an explicit `K9_ALLOW_ROOT=true` or `--allow-root` escape hatch." -system = "must shim `check_root()` function (/home/user/standards/k9-svc/must lines ~20-40); exercised indirectly whenever `./must` is invoked (no dedicated CI job running must as root to prove the refusal path, but the code path is present and unconditional)." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: must shim `check_root()` function (/home/user/standards/k9-svc/must lines ~20-40); exercised indirectly whenever `./must` is invoked (no dedicated CI job running must as root to prove the refusal path, but the code path is present and unconditional)." +status = "manual-only" evidence = "/home/user/standards/k9-svc/must defines `check_root()` which checks `id -u` and exits with a warning unless `K9_ALLOW_ROOT=true`; this function is called before other must subcommands per the script's control flow." -check = "grep -q 'check_root' k9-svc/must && grep -q 'K9_ALLOW_ROOT' k9-svc/must" + effects = "Prevents accidental privileged execution of Hunt-level components by naive users/CI runners; without it, a compromised or buggy component would have full system access by default." [[should]] id = "S2" text = "The reference signing tool (k9-sign) SHOULD be a memory-safe implementation with an automated test suite covering keygen/sign/verify/trust/list." -system = "k9-sign/src/tests.rs (15 #[test] functions) run via CI job 'test' in .github/workflows/k9-sign-ci.yml (`cargo test --verbose` and `cargo test --release --verbose`) across ubuntu-latest/macos-latest x stable/beta matrix." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: k9-sign/src/tests.rs (15 #[test] functions) run via CI job 'test' in .github/workflows/k9-sign-ci.yml (`cargo test --verbose` and `cargo test --release --verbose`) across ubuntu-latest/macos-latest x stable/beta matrix." +status = "manual-only" evidence = "/home/user/standards/k9-svc/k9-sign/src/tests.rs contains 15 `#[test]` functions (grep count); k9-sign-ci.yml job 'test' runs `cargo test --verbose -- --test-threads=1` in both debug and release mode on a 2x2 OS/toolchain matrix on every push/PR touching k9-sign/**." -check = "test $(grep -c '#\\[test\\]' k9-svc/k9-sign/src/tests.rs) -ge 10 && grep -q 'cargo test' k9-svc/.github/workflows/k9-sign-ci.yml" + effects = "Bindings and tools that shell out to k9-sign for Ed25519 signing rely on this correctness; a regression would compromise the signature precondition of the Hunt gate." [[should]] @@ -92,19 +92,19 @@ effects = "Users/decision-makers rely on these docs for informed adoption decisi [[should]] id = "S5" text = "The Nickel schema files (pedigree.ncl, register.ncl, leash.ncl) SHOULD typecheck cleanly on every push and pull request." -system = "CI job 'validate' in .github/workflows/ci.yml runs `nickel typecheck pedigree.ncl`, `nickel typecheck register.ncl`, `nickel typecheck leash.ncl` on push to main and on PRs." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: CI job 'validate' in .github/workflows/ci.yml runs `nickel typecheck pedigree.ncl`, `nickel typecheck register.ncl`, `nickel typecheck leash.ncl` on push to main and on PRs." +status = "manual-only" evidence = ".github/workflows/ci.yml job 'validate' step 'Validate schemas' runs the three nickel typecheck commands unconditionally on every push/PR (triggers block at top of file)." -check = "grep -q 'nickel typecheck pedigree.ncl' k9-svc/.github/workflows/ci.yml && grep -q 'nickel typecheck register.ncl' k9-svc/.github/workflows/ci.yml && grep -q 'nickel typecheck leash.ncl' k9-svc/.github/workflows/ci.yml" + effects = "Any downstream binding (rust/haskell/gleam/elixir/deno) or tool that imports these .ncl files as the canonical schema depends on them being syntactically and typologically valid." [[could]] id = "C1" text = "K9 COULD ship language bindings (Rust, Haskell, Gleam, Elixir, Deno) for parsing/rendering `.k9` files outside the reference shell/Nickel toolchain." -system = "bindings/rust/src/{lib,parser,renderer,error}.rs (497-line parser), bindings/haskell/src/Data/K9/*.hs, bindings/gleam/src/k9_gleam/*.gleam (+ test/k9_gleam_test.gleam), bindings/elixir/lib/k9/*.ex, bindings/deno/mod.ts; bindings/gleam has a dedicated .github/workflows/ present, other bindings' CI status not independently confirmed in this pass." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: bindings/rust/src/{lib,parser,renderer,error}.rs (497-line parser), bindings/haskell/src/Data/K9/*.hs, bindings/gleam/src/k9_gleam/*.gleam (+ test/k9_gleam_test.gleam), bindings/elixir/lib/k9/*.ex, bindings/deno/mod.ts; bindings/gleam has a dedicated .github/workflows/ present, other bindings' CI status not independently confirmed in this pass." +status = "manual-only" evidence = "Non-trivial, non-stub source files exist for all five bindings (e.g. bindings/rust/src/parser.rs 497 lines, bindings/rust/tests/crg_c_tests.rs 580 lines; bindings/haskell/src/Data/K9/Parser.hs 234 lines; bindings/gleam has a test/ directory with k9_gleam_test.gleam)." -check = "test $(wc -l < k9-svc/bindings/rust/src/parser.rs) -gt 100 && test $(wc -l < k9-svc/bindings/haskell/src/Data/K9/Parser.hs) -gt 100 && test -f k9-svc/bindings/gleam/test/k9_gleam_test.gleam && test -f k9-svc/bindings/elixir/lib/k9/parser.ex && test -f k9-svc/bindings/deno/mod.affine" + effects = "Consumers wanting to parse/render .k9 in Rust/Haskell/Gleam/Elixir/Deno ecosystems depend on these; if a binding's own CI is not wired up, drift from the canonical pedigree.ncl schema would go unnoticed (not independently verified here)." [[could]] @@ -117,8 +117,8 @@ effects = "Packaging manifests can silently drift from the actual repo layout (e [[could]] id = "C3" text = "K9 COULD support container-based deployment as a first-class, non-root, multi-stage build on a minimal/hardened base image." -system = "Containerfile (Chainguard wolfi-base per README); validated by CI job 'container' in .github/workflows/ci.yml (`podman build`, then `podman run --rm k9-svc:ci status` and `run typecheck`) and test.sh 'Container' section (4 tests: multi-stage build, non-root user)." -status = "pass" +system = "none in this repo — the implementation moved to hyperpolymath/k9-ecosystem under standards#491. Previously verified by: Containerfile (Chainguard wolfi-base per README); validated by CI job 'container' in .github/workflows/ci.yml (`podman build`, then `podman run --rm k9-svc:ci status` and `run typecheck`) and test.sh 'Container' section (4 tests: multi-stage build, non-root user)." +status = "manual-only" evidence = "/home/user/standards/k9-svc/Containerfile exists; ci.yml job 'container' builds and smoke-tests the image on every push/PR (needs: validate); TESTING.adoc documents a 4-test Container section in test.sh." -check = "test -f k9-svc/Containerfile && grep -q 'container:' k9-svc/.github/workflows/ci.yml" + effects = "Users following the README's `podman build/run` quick-start depend on this; a break would surface immediately in CI rather than only for end users." diff --git a/COMPLIANCE-DASHBOARD.adoc b/COMPLIANCE-DASHBOARD.adoc index ae28b686..6d016f5b 100644 --- a/COMPLIANCE-DASHBOARD.adoc +++ b/COMPLIANCE-DASHBOARD.adoc @@ -25,7 +25,7 @@ ____ | Spec | MUST status | MUST (pass/total) | SHOULD (pass/total) | COULD (pass/total) | Systems coverage | Grounded passes | Assessed | `+estate-constitution+` | ❌ gap | 2/4 | 1/1 | 0/0 | 60% | 3/3 | 2026-07-11 | `+a2ml+` | ✅ met | 4/5 | 4/5 | 0/3 | 84% | 8/8 | 2026-07-03 -| `+k9-svc+` | ❌ gap | 3/6 | 3/5 | 2/3 | 100% | 8/8 | 2026-07-03 +| `+k9-svc+` | ❌ gap | 0/6 | 0/5 | 0/3 | 100% | – | 2026-07-03 | `+contractiles+` | ❌ gap | 0/5 | 0/3 | 0/3 | 54% | – | 2026-07-03 | `+meta-a2ml+` | ❌ gap | 1/5 | 1/4 | 1/3 | 83% | 3/3 | 2026-07-03 | `+state-a2ml+` | ❌ gap | 0/5 | 1/4 | 1/3 | 50% | 2/2 | 2026-07-03 @@ -58,9 +58,9 @@ ____ * *Specs registered (local):* 29 * *Specs with a scorecard:* 29 / 29 -* *MUST requirements:* 44 passing / 142 total (71 failing) +* *MUST requirements:* 41 passing / 142 total (71 failing) * *Estate systems coverage:* 67% of 330 graded requirements have a mechanical check -* *Grounded passes:* 82 / 82 (100%) pass rows carry an executable `+check+` run by `+--verify+` +* *Grounded passes:* 74 / 74 (100%) pass rows carry an executable `+check+` run by `+--verify+` == How this dashboard stays honest diff --git a/Justfile b/Justfile index dc7c0cd8..aa7597e6 100644 --- a/Justfile +++ b/Justfile @@ -156,8 +156,7 @@ build: @echo "=== Standards Monorepo Build ===" @echo "[1/3] a2ml/bindings/rust" @cd a2ml/bindings/rust && cargo build 2>&1 || echo " SKIP: cargo not available" - @echo "[2/3] k9-svc/bindings/rust" - @cd k9-svc/bindings/rust && cargo build 2>&1 || echo " SKIP: cargo not available" + @echo "[2/3] k9 Rust binding — moved to hyperpolymath/k9-ecosystem (rs/) under #491" @echo "[3/3] groove-protocol/reference/ipv6t" @cd groove-protocol/reference/ipv6t && zig build 2>&1 || echo " SKIP: zig not available" @echo "=== Build complete ===" @@ -167,7 +166,7 @@ test: @bash scripts/run-required-test-suite.sh "MCP repo guardian (Deno — 36 tests)" "0-ai-gatekeeper-protocol/mcp-repo-guardian" deno test --allow-read test/manifest_test.js @bash scripts/run-required-test-suite.sh "Repo guardian offline core (Rust — 29 tests)" "0-ai-gatekeeper-protocol/repo-guardian-fs/tests-offline" cargo test @bash scripts/run-required-test-suite.sh "A2ML Rust binding (47 tests + 3 doctests)" "a2ml/bindings/rust" cargo test - @bash scripts/run-required-test-suite.sh "K9 Rust binding (42 tests + 3 doctests)" "k9-svc/bindings/rust" cargo test + # K9 Rust binding tests now live in hyperpolymath/k9-ecosystem (rs/) — see #491 # Regression test: test aggregation fails for missing prerequisites and test failures. test-runner-test: @@ -181,7 +180,6 @@ session-detritus-test: fmt: @echo "=== Standards Monorepo Format ===" @cd a2ml/bindings/rust && cargo fmt 2>&1 || echo " SKIP" - @cd k9-svc/bindings/rust && cargo fmt 2>&1 || echo " SKIP" @cd 0-ai-gatekeeper-protocol/mcp-repo-guardian && deno fmt 2>&1 || echo " SKIP" @echo "=== Format complete ===" @@ -190,7 +188,6 @@ lint: @echo "=== Standards Monorepo Lint ===" @echo "[1/2] Rust clippy" @cd a2ml/bindings/rust && cargo clippy --all-targets 2>&1 || echo " SKIP" - @cd k9-svc/bindings/rust && cargo clippy --all-targets 2>&1 || echo " SKIP" @echo "[2/2] Deno lint" @cd 0-ai-gatekeeper-protocol/mcp-repo-guardian && deno lint 2>&1 || echo " SKIP" @echo "=== Lint complete ===" @@ -199,7 +196,6 @@ lint: clean: @echo "=== Cleaning ===" @cd a2ml/bindings/rust && cargo clean 2>&1 || true - @cd k9-svc/bindings/rust && cargo clean 2>&1 || true @cd groove-protocol/reference/ipv6t && rm -rf zig-out zig-cache .zig-cache 2>/dev/null || true @echo "=== Clean complete ===" diff --git a/TOPOLOGY.adoc b/TOPOLOGY.adoc index 86c6a3a0..87b4a22c 100644 --- a/TOPOLOGY.adoc +++ b/TOPOLOGY.adoc @@ -23,7 +23,7 @@ ____ |=== | Spec | Home | If you want… | A2ML — Attested Markup Language | link:a2ml/[`+a2ml/+`] | the typed/verified machine-readable document format -| K9 Self-Validating Components | link:k9-svc/[`+k9-svc/+`] | self-validating components with embedded contracts + deploy logic +| K9 Self-Validating Components | link:k9-svc/[`+k9-svc/+`] | the K9 specification, security analysis and adoption guidance (implementations live in hyperpolymath/k9-ecosystem) | Contractiles (Must/Trust/Dust/Intend) | link:contractiles/[`+contractiles/+`] | policy-enforcement primitives the K9 layer is built from | META.a2ml spec | link:meta-a2ml/[`+meta-a2ml/+`] | architecture decisions / governance metadata format | STATE.a2ml spec | link:state-a2ml/[`+state-a2ml/+`] | project-state metadata format (drives this registry's topology) diff --git a/k9-svc/.github/workflows/6scm-sync.yml b/k9-svc/.github/workflows/6scm-sync.yml deleted file mode 100644 index 387bbf9e..00000000 --- a/k9-svc/.github/workflows/6scm-sync.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: 6SCM Mirror Check - -on: - push: - paths: - - '.machine_readable/**' - pull_request: - paths: - - '.machine_readable/**' - -jobs: - check: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Check 6scm mirrors - run: bash scripts/check-6scm.sh diff --git a/k9-svc/.github/workflows/ci.yml b/k9-svc/.github/workflows/ci.yml deleted file mode 100644 index b1b31c82..00000000 --- a/k9-svc/.github/workflows/ci.yml +++ /dev/null @@ -1,95 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: K9 SVC CI - -on: - push: - branches: [main] - pull_request: - branches: [main] - -permissions: read-all - -jobs: - validate: - name: Validate Schemas - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Nickel - run: | - curl -fsSL https://github.com/tweag/nickel/releases/latest/download/nickel-x86_64-linux -o nickel - chmod +x nickel - sudo mv nickel /usr/local/bin/ - - - name: Install Just - run: | - curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin - - - name: Validate schemas - run: | - nickel typecheck pedigree.ncl - nickel typecheck register.ncl - nickel typecheck leash.ncl - - - name: Check environment - run: ./must status - - container: - name: Build Container - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: validate - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Build with Podman - run: | - podman build -t k9-svc:ci . - - - name: Test container - run: | - podman run --rm k9-svc:ci status - podman run --rm k9-svc:ci run typecheck - - test: - name: Run Tests - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: validate - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Nickel - run: | - curl -fsSL https://github.com/tweag/nickel/releases/latest/download/nickel-x86_64-linux -o nickel - chmod +x nickel - sudo mv nickel /usr/local/bin/ - - - name: Install Just - run: | - curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin - - - name: Run test suite - run: ./test.sh - - mime: - name: Validate MIME Files - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Validate XML - run: | - xmllint --noout mime/k9.xml - xmllint --noout mime/k9.uti.plist - - - name: Check magic file syntax - run: | - file --compile mime/k9.magic || true diff --git a/k9-svc/.github/workflows/codeql.yml b/k9-svc/.github/workflows/codeql.yml deleted file mode 100644 index 261b34bb..00000000 --- a/k9-svc/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/.github/workflows/governance.yml b/k9-svc/.github/workflows/governance.yml deleted file mode 100644 index 64ce492b..00000000 --- a/k9-svc/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/.github/workflows/hypatia-scan.yml b/k9-svc/.github/workflows/hypatia-scan.yml deleted file mode 100644 index 4bc2b381..00000000 --- a/k9-svc/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/.github/workflows/k9-sign-ci.yml b/k9-svc/.github/workflows/k9-sign-ci.yml deleted file mode 100644 index 17e9b71f..00000000 --- a/k9-svc/.github/workflows/k9-sign-ci.yml +++ /dev/null @@ -1,264 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: k9-sign CI - -on: - push: - branches: [ main, develop ] - paths: - - 'k9-sign/**' - - '.github/workflows/k9-sign-ci.yml' - pull_request: - branches: [ main ] - paths: - - 'k9-sign/**' - - '.github/workflows/k9-sign-ci.yml' - -permissions: read-all - -env: - RUST_BACKTRACE: 1 - CARGO_TERM_COLOR: always - -jobs: - test: - name: Test Suite - runs-on: ${{ matrix.os }} - timeout-minutes: 30 - strategy: - fail-fast: false - matrix: - os: [ubuntu-latest, macos-latest] - rust: [stable, beta] - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - with: - toolchain: ${{ matrix.rust }} - components: rustfmt, clippy - - - name: Cache cargo registry - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 - with: - path: ~/.cargo/registry - key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} - - - name: Cache cargo index - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 - with: - path: ~/.cargo/git - key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }} - - - name: Cache cargo build - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 - with: - path: k9-sign/target - key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }} - - - name: Run tests - working-directory: k9-sign - run: cargo test --verbose -- --test-threads=1 - - - name: Run tests (release mode) - working-directory: k9-sign - run: cargo test --release --verbose -- --test-threads=1 - - build: - name: Build Binary - runs-on: ${{ matrix.os }} - timeout-minutes: 30 - strategy: - matrix: - os: [ubuntu-latest, macos-latest] - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - with: - toolchain: stable - - - name: Build release binary - working-directory: k9-sign - run: cargo build --release --verbose - - - name: Check binary size - working-directory: k9-sign - run: | - ls -lh target/release/k9-sign - echo "Binary size: $(du -h target/release/k9-sign | cut -f1)" - - - name: Smoke test binary - working-directory: k9-sign - run: | - ./target/release/k9-sign --version - ./target/release/k9-sign --help - - - name: Upload binary artifact - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3 - with: - name: k9-sign-${{ matrix.os }} - path: k9-sign/target/release/k9-sign - retention-days: 7 - - lint: - name: Lint & Format Check - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - with: - toolchain: stable - components: rustfmt, clippy - - - name: Check formatting - working-directory: k9-sign - run: cargo fmt -- --check - - - name: Run clippy - working-directory: k9-sign - run: cargo clippy --all-targets --all-features -- -D warnings - - security: - name: Security Audit - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - - - name: Install cargo-audit - run: cargo install cargo-audit - - - name: Run security audit - working-directory: k9-sign - run: cargo audit - - benchmark: - name: Performance Benchmark - runs-on: ubuntu-latest - timeout-minutes: 30 - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - - - name: Build release binary - working-directory: k9-sign - run: cargo build --release - - - name: Benchmark keygen - working-directory: k9-sign - run: | - echo "Benchmarking keygen (10 iterations)..." - for i in {1..10}; do - time ./target/release/k9-sign keygen bench-key-$i - done - - - name: Benchmark sign/verify - working-directory: k9-sign - run: | - # Create test file - dd if=/dev/urandom of=test.bin bs=1M count=1 - - # Trust key - ./target/release/k9-sign trust ~/.config/k9/keys/bench-key-1.pub - - # Benchmark sign - echo "Benchmarking sign (10 iterations)..." - for i in {1..10}; do - rm -f test.bin.sig - time ./target/release/k9-sign sign test.bin bench-key-1 - done - - # Benchmark verify - echo "Benchmarking verify (10 iterations)..." - for i in {1..10}; do - time ./target/release/k9-sign verify test.bin - done - - integration: - name: Integration Test - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: [test, build] - - steps: - - name: Checkout code - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable - - - name: Build k9-sign - working-directory: k9-sign - run: cargo build --release - - - name: Full workflow test - working-directory: k9-sign - run: | - set -e - - # 1. Generate keypair - echo "==> Generating keypair..." - ./target/release/k9-sign keygen integration-key - - # 2. Trust key - echo "==> Trusting key..." - ./target/release/k9-sign trust ~/.config/k9/keys/integration-key.pub - - # 3. Create test component - echo "==> Creating test component..." - cat > test-component.k9.ncl <<'EOF' - K9! - leash = 'Hunt - pedigree = { - schema_version = "1.0.0", - component_type = "integration-test" - } - EOF - - # 4. Sign component - echo "==> Signing component..." - ./target/release/k9-sign sign test-component.k9.ncl integration-key - - # 5. Verify signature - echo "==> Verifying signature..." - ./target/release/k9-sign verify test-component.k9.ncl - - # 6. Authorize Hunt component - echo "==> Authorizing Hunt component..." - ./target/release/k9-sign authorize test-component.k9.ncl - - # 7. List keys - echo "==> Listing keys..." - ./target/release/k9-sign list - - echo "" - echo "✓ Integration test passed!" - - all-checks: - name: All Checks Passed - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [test, build, lint, security, integration] - steps: - - name: Success - run: echo "All k9-sign CI checks passed!" diff --git a/k9-svc/.github/workflows/scorecard.yml b/k9-svc/.github/workflows/scorecard.yml deleted file mode 100644 index 7a3b5907..00000000 --- a/k9-svc/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/Containerfile b/k9-svc/Containerfile deleted file mode 100644 index baa5525c..00000000 --- a/k9-svc/Containerfile +++ /dev/null @@ -1,104 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Containerfile - K9 SVC Runtime Container -# -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Uses Chainguard base images for minimal attack surface: -# - Builder stage: Rust toolchain on wolfi-base for compiling nickel and just -# - Runtime stage: wolfi-base with only the binaries needed to run k9 components -# -# Chainguard images have no shell (in static variants), no package manager -# bloat, and minimal CVE surface. We use wolfi-base (not static) because -# k9-svc needs a shell for the must shim and Just recipes. -# -# Build: podman build -t k9-svc:latest . -# Run: podman run --rm -it k9-svc:latest status -# Mount: podman run --rm -it -v ./components:/k9/components k9-svc:latest validate-all - -# ───────────────────────────────────────────────────────────────────── -# Builder Stage -# -# Compiles nickel-lang-cli and just from source using Rust. -# This stage is discarded after the binaries are copied out. -# ───────────────────────────────────────────────────────────────────── -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# Install build dependencies via apk (wolfi's package manager). -# - rust and cargo for compiling nickel and just -# - curl and ca-certificates for downloading crate dependencies -# - gcc and musl-dev for linking native code -RUN apk update && apk add --no-cache \ - rust \ - cargo \ - curl \ - ca-certificates \ - gcc \ - musl-dev - -# Install Nickel (the typed configuration language that powers k9 validation) -RUN cargo install nickel-lang-cli --locked - -# Install Just (the task runner that powers k9 recipes) -RUN cargo install just --locked - -# ───────────────────────────────────────────────────────────────────── -# Runtime Stage -# -# Minimal Chainguard image with only the binaries and files needed -# to run k9 components. No build tools, no package manager bloat. -# ───────────────────────────────────────────────────────────────────── -FROM cgr.dev/chainguard/wolfi-base:latest - -LABEL org.opencontainers.image.title="K9 SVC Runtime" -LABEL org.opencontainers.image.description="Self-Validating Component runtime environment" -LABEL org.opencontainers.image.version="1.0.0-alpha" -LABEL org.opencontainers.image.vendor="hyperpolymath" -LABEL org.opencontainers.image.licenses="PMPL-1.0-or-later" -LABEL org.opencontainers.image.source="https://github.com/hyperpolymath/standards/tree/main/k9-svc" - -# Install minimal runtime dependencies via apk. -# - ca-certificates: for TLS verification when Hunt components access network -# - file: for MIME type detection (used by `file --mime-type` in k9 validation) -# - libgcc: runtime library needed by compiled Rust binaries -RUN apk update && apk add --no-cache \ - ca-certificates \ - file \ - libgcc - -# Create non-root user for security. -# k9 components should never run as root unless explicitly required -# by a Hunt-level component (and even then, avoid it). -RUN adduser -D -s /bin/sh k9user -USER k9user -WORKDIR /home/k9user/k9 - -# Copy binaries from builder stage. -# Only nickel and just are needed at runtime — no Rust toolchain. -COPY --from=builder /root/.cargo/bin/nickel /usr/local/bin/nickel -COPY --from=builder /root/.cargo/bin/just /usr/local/bin/just - -# Copy K9 SVC files into the container. -# These are the core schemas, the must shim, and the examples. -COPY --chown=k9user:k9user must justfile pedigree.ncl register.ncl leash.ncl ./ -COPY --chown=k9user:k9user mime/ ./mime/ -COPY --chown=k9user:k9user examples/ ./examples/ - -# Verify the triad is functional. -# This is the dogfooding step: the container validates itself during build. -# If any of these fail, the build fails — no broken images ship. -RUN ./must status && \ - nickel typecheck pedigree.ncl && \ - nickel typecheck register.ncl && \ - nickel typecheck leash.ncl - -# Default entrypoint: the must shim, which detects the environment -# and delegates to just/nickel as appropriate. -ENTRYPOINT ["./must"] -CMD ["status"] - -# Volume for mounting external components. -# Users mount their .k9 and .k9.ncl files here for validation/deployment. -VOLUME ["/home/k9user/k9/components"] - -# Expose nothing by default (K9 is not a server). -# Hunt-level components that need ports can override this. diff --git a/k9-svc/GUIDE.adoc b/k9-svc/GUIDE.adoc index 7fb68f04..acf22779 100644 --- a/k9-svc/GUIDE.adoc +++ b/k9-svc/GUIDE.adoc @@ -125,7 +125,7 @@ Before running Hunt components: [source,bash] ---- # Check a single component -just leash-level examples/deploy.k9.ncl +just leash-level https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl # List all example security levels just leash-list @@ -137,7 +137,7 @@ just leash-list The simplest component - just data with a magic number. -.examples/hello.k9 +.https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 [source] ---- K9! @@ -153,7 +153,7 @@ message = "Hello from K9!" Components with typed contracts. Nickel evaluates them safely. -.examples/config.k9.ncl +.https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/config.k9.ncl [source,nickel] ---- let pedigree = import "../pedigree.ncl" in @@ -193,7 +193,7 @@ Validate with: [source,bash] ---- -nickel typecheck examples/config.k9.ncl +nickel typecheck https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/config.k9.ncl just show-config # Export as JSON ---- @@ -224,7 +224,7 @@ Hunt components can: Components that can execute recipes. **Requires cryptographic signature.** -.examples/deploy.k9.ncl +.https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl [source,nickel] ---- let pedigree = import "../pedigree.ncl" in @@ -277,9 +277,9 @@ just list-keys [source,bash] ---- # Sign with your key -just sign examples/deploy.k9.ncl alice +just sign https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl alice -# Creates: examples/deploy.k9.ncl.sig +# Creates: https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl.sig # Also outputs signature for embedding in pedigree ---- @@ -301,7 +301,7 @@ just trust /path/to/alice.pub [source,bash] ---- # Verify a component -just verify examples/deploy.k9.ncl +just verify https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl # Output: ✓ Signature VALID (key: alice) ---- @@ -310,7 +310,7 @@ just verify examples/deploy.k9.ncl [source,bash] ---- # Check if component is authorized for execution -just authorize examples/deploy.k9.ncl +just authorize https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl ---- This checks: @@ -338,8 +338,8 @@ just install-mime-system just install-magic # Verify -file examples/hello.k9 -# Output: examples/hello.k9: K9 Self-Validating Component +file https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 +# Output: https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9: K9 Self-Validating Component ---- === macOS @@ -493,7 +493,7 @@ openssl genpkey -algorithm Ed25519 -out /dev/null update-mime-database ~/.local/share/mime # Check registration -xdg-mime query filetype examples/hello.k9 +xdg-mime query filetype https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 ---- === Container build fails @@ -643,7 +643,7 @@ Key features of this component: production, verifies that container images are signed with cerro-torre. * **Self-validation** — The component typechecks itself before deployment. -See: `examples/container-deploy.k9.ncl` for the complete implementation. +See: `https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/container-deploy.k9.ncl` for the complete implementation. === Example: Config Validator as a Yard Component @@ -672,7 +672,7 @@ This component can: * Verify that environment variables match expected patterns * Export validated config as JSON for consumption by other tools -See: `examples/config.k9.ncl` for a Yard-level configuration example. +See: `https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/config.k9.ncl` for a Yard-level configuration example. === How k9-svc Wraps selur-compose @@ -699,7 +699,7 @@ requires authorization. === Anti-Pattern Warnings -Before wrapping something in k9-svc, read link:examples/NOT-a-good-fit.adoc[NOT-a-good-fit.adoc]. +Before wrapping something in k9-svc, read link:https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/NOT-a-good-fit.adoc[NOT-a-good-fit.adoc]. Common mistakes: @@ -714,7 +714,7 @@ Common mistakes: * **Do NOT** wrap every directory in a2ml manifests. One at the repo root is sufficient for most projects. -See: link:examples/NOT-a-good-fit.adoc[Comparison, Deprecation Analysis, and Anti-Patterns] +See: link:https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/NOT-a-good-fit.adoc[Comparison, Deprecation Analysis, and Anti-Patterns] for the full analysis. == License diff --git a/k9-svc/Justfile b/k9-svc/Justfile deleted file mode 100644 index 3b06ef01..00000000 --- a/k9-svc/Justfile +++ /dev/null @@ -1,364 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# justfile - K9 SVC Orchestration (The Muscle) -# -# Part of the must-just-nickel triad. -# Usage: ./must run OR just - -set shell := ["sh", "-eu", "-c"] -set dotenv-load - -# Default recipe: show status -default: - @./must status - -# ───────────────────────────────────────────────────────────── -# Environment & Setup -# ───────────────────────────────────────────────────────────── - -# Ensure the triad is installed -ensure: - @./must ensure - -# Show K9 environment report -status: - @./must status - -# Check all dependencies are available -check-deps: - @echo "K9: Checking dependencies..." - @command -v nickel >/dev/null 2>&1 && echo " ✓ Nickel: $(nickel --version 2>/dev/null || echo 'installed')" || echo " ✗ Nickel: NOT FOUND" - @command -v just >/dev/null 2>&1 && echo " ✓ Just: $(just --version)" || echo " ✗ Just: NOT FOUND" - @command -v podman >/dev/null 2>&1 && echo " ✓ Podman: $(podman --version)" || echo " ○ Podman: not installed (optional)" - @command -v file >/dev/null 2>&1 && echo " ✓ file: available" || echo " ○ file: not installed" - @echo "K9: Dependency check complete." - -# Compatibility alias from previous Makefile workflow -check: check-deps - -# Sync .machine_readable metadata into 6scm mirrors -sync-6scm: - @mkdir -p .machine_readable/6scm - @for f in AGENTIC.scm ECOSYSTEM.scm META.scm NEUROSYM.scm PLAYBOOK.scm STATE.scm; do \ - if [ -f ".machine_readable/$$f" ]; then cp -f ".machine_readable/$$f" ".machine_readable/6scm/$$f"; fi; \ - done - -# Check .machine_readable 6scm mirrors are in sync -check-6scm: - @scripts/check-6scm.sh - -# ───────────────────────────────────────────────────────────── -# MIME Registration -# ───────────────────────────────────────────────────────────── - -# Register .k9 MIME type (user-level, Linux) -install-mime: - @echo "K9: Installing MIME type for current user..." - @mkdir -p ~/.local/share/mime/packages - @cp mime/k9.xml ~/.local/share/mime/packages/ - @update-mime-database ~/.local/share/mime 2>/dev/null || true - @echo "K9: User MIME registration complete." - -# Register .k9 MIME type (system-wide, requires sudo) -install-mime-system: - @echo "K9: Installing MIME type system-wide..." - @sudo cp mime/k9.xml /usr/share/mime/packages/ - @sudo update-mime-database /usr/share/mime - @echo "K9: System MIME registration complete." - -# Install magic file for file(1) detection -install-magic: - @echo "K9: Installing magic file..." - @mkdir -p ~/.local/share/file - @cp mime/k9.magic ~/.local/share/file/ - @cat mime/k9.magic >> ~/.magic 2>/dev/null || cp mime/k9.magic ~/.magic - @file --compile ~/.magic 2>/dev/null || true - @echo "K9: Magic file installed. Test with: file examples/hello.k9" - -# Install macOS UTI (macOS only) -install-uti: - @echo "K9: Installing macOS UTI..." - @mkdir -p ~/Library/Application\ Support/K9 - @cp mime/k9.uti.plist ~/Library/Application\ Support/K9/ - @echo "K9: UTI installed. May require logout/login to take effect." - -# Verify MIME registration -verify-mime: - @echo "K9: Verifying MIME registration..." - @file --mime-type examples/hello.k9 2>/dev/null || echo " Note: Install magic file with 'just install-magic'" - @xdg-mime query filetype examples/hello.k9 2>/dev/null || echo " Note: MIME database may need update" - -# Full MIME setup (user-level) -setup-mime: install-mime install-magic - @echo "K9: Full MIME setup complete." - -# Install K9 user tooling and schemas (Makefile parity) -install: - @prefix="${PREFIX:-$HOME/.local}"; \ - bindir="$$prefix/bin"; \ - sharedir="$$prefix/share/k9"; \ - mimedir="$$prefix/share/mime/packages"; \ - echo "K9: Installing to $$prefix..."; \ - mkdir -p "$$bindir" "$$sharedir" "$$sharedir/examples" "$$sharedir/assets" "$$mimedir"; \ - install -m 755 must "$$bindir/k9-must"; \ - install -m 755 sign.sh "$$bindir/k9-sign"; \ - install -m 644 Justfile "$$sharedir/Justfile"; \ - install -m 644 pedigree.ncl register.ncl leash.ncl "$$sharedir/"; \ - install -m 644 examples/*.k9 "$$sharedir/examples/" 2>/dev/null || true; \ - install -m 644 examples/*.k9.ncl "$$sharedir/examples/" 2>/dev/null || true; \ - install -m 644 assets/*.svg "$$sharedir/assets/" 2>/dev/null || true; \ - install -m 644 mime/k9.xml "$$mimedir/"; \ - update-mime-database "$$prefix/share/mime" 2>/dev/null || true; \ - install -m 644 README.adoc SPEC.adoc GUIDE.adoc LICENSE "$$sharedir/" 2>/dev/null || true; \ - printf '#!/bin/sh\nexec just --justfile %s/share/k9/Justfile "$$@"\n' "$$prefix" > "$$bindir/k9"; \ - chmod 755 "$$bindir/k9"; \ - echo "K9: Installation complete." - -install-system: - @PREFIX=/usr/local just install - -uninstall: - @prefix="${PREFIX:-$HOME/.local}"; \ - bindir="$$prefix/bin"; \ - sharedir="$$prefix/share/k9"; \ - mimedir="$$prefix/share/mime/packages"; \ - echo "K9: Uninstalling from $$prefix..."; \ - rm -f "$$bindir/k9" "$$bindir/k9-must" "$$bindir/k9-sign"; \ - rm -rf "$$sharedir"; \ - rm -f "$$mimedir/k9.xml"; \ - update-mime-database "$$prefix/share/mime" 2>/dev/null || true; \ - echo "K9: Uninstallation complete." - -uninstall-system: - @PREFIX=/usr/local just uninstall - -# ───────────────────────────────────────────────────────────── -# Validation (The Brain) -# ───────────────────────────────────────────────────────────── - -# Typecheck all Nickel schemas -typecheck: - @echo "K9: Typechecking all schemas..." - @nickel typecheck pedigree.ncl - @nickel typecheck register.ncl - @nickel typecheck leash.ncl - @echo "K9: All schemas valid." - -# Validate the pedigree schema -validate-pedigree: - @echo "K9: Validating pedigree.ncl..." - @nickel typecheck pedigree.ncl - @echo "K9: Pedigree schema valid." - -# Validate a .k9 component against the pedigree -validate file: - @echo "K9: Validating {{file}} against pedigree..." - @nickel typecheck {{file}} - @echo "K9: {{file}} passes validation." - -# Full validation suite -validate-all: typecheck - @echo "K9: Validating example components..." - @nickel typecheck examples/config.k9.ncl || true - @nickel typecheck examples/deploy.k9.ncl || true - @echo "K9: Validation suite complete." - -# ───────────────────────────────────────────────────────────── -# Security (The Leash) -# ───────────────────────────────────────────────────────────── - -# Check security level of a component -leash-level file: - @echo "K9: Checking security level for {{file}}..." - @if grep -q "trust_level.*'Hunt" {{file}} 2>/dev/null; then \ - echo " Level: 'Hunt (FULL EXECUTION - requires authorization)"; \ - elif grep -q "trust_level.*'Yard" {{file}} 2>/dev/null; then \ - echo " Level: 'Yard (Nickel evaluation only)"; \ - else \ - echo " Level: 'Kennel (pure data, safe)"; \ - fi - -# List security levels of all examples -leash-list: - @echo "K9: Security levels of example components:" - @echo "" - @for f in examples/*.k9 examples/*.k9.ncl; do \ - if [ -f "$$f" ]; then \ - printf " %-30s " "$$f:"; \ - if grep -q "trust_level.*'Hunt" "$$f" 2>/dev/null; then \ - echo "'Hunt ⚠️"; \ - elif grep -q "trust_level.*'Yard" "$$f" 2>/dev/null; then \ - echo "'Yard"; \ - else \ - echo "'Kennel ✓"; \ - fi; \ - fi; \ - done - -# Authorize a Hunt-level component (placeholder - would involve signing) -authorize file: - @echo "K9: Authorization requested for {{file}}..." - @echo " ⚠️ WARNING: Hunt-level execution can modify your system." - @echo "" - @echo " In production, this would:" - @echo " 1. Verify the component's cryptographic signature" - @echo " 2. Check against trusted public keys" - @echo " 3. Record authorization in audit log" - @echo "" - @echo " For now, this is a placeholder. Review the file manually." - -# ───────────────────────────────────────────────────────────── -# Build & Deploy -# ───────────────────────────────────────────────────────────── - -# Build documentation -docs: - @echo "K9: Generating documentation..." - @mkdir -p docs - @if command -v asciidoctor >/dev/null 2>&1; then \ - asciidoctor -o docs/README.html README.adoc 2>/dev/null || true; \ - asciidoctor -o docs/SPEC.html SPEC.adoc 2>/dev/null || true; \ - echo "K9: HTML docs generated in docs/"; \ - else \ - echo "K9: asciidoctor not found, skipping HTML generation"; \ - fi - -# Build container image -build-container: - @echo "K9: Building container image..." - @podman build -t k9-svc:latest . - @echo "K9: Container built as k9-svc:latest" - -# Run container -run-container *args: - @podman run --rm -it k9-svc:latest {{args}} - -# Deploy via Podman (if available) -deploy-podman: build-container - @echo "K9: Deploying via Podman..." - @podman run --rm k9-svc:latest dogfood - @echo "K9: Podman deployment complete." - -# Deploy natively (no container) -deploy-native: - @echo "K9: Native deployment..." - @./must ensure - @just validate-all - @just setup-mime - @echo "K9: Native deployment complete." - -# Auto-select deployment method -deploy: - @if command -v podman >/dev/null 2>&1; then \ - just deploy-podman; \ - else \ - just deploy-native; \ - fi - -# ───────────────────────────────────────────────────────────── -# Development -# ───────────────────────────────────────────────────────────── - -# Format Nickel files -fmt: - @echo "K9: Formatting Nickel files..." - @nickel format pedigree.ncl 2>/dev/null || true - @nickel format register.ncl 2>/dev/null || true - @nickel format leash.ncl 2>/dev/null || true - @echo "K9: Formatting complete." - -# Interactive Nickel REPL with pedigree loaded -repl: - @nickel repl --import pedigree.ncl - -# Export pedigree schema as JSON (for tooling) -export-schema: - @nickel export pedigree.ncl --format json - -# Export leash levels as JSON -export-leash: - @nickel export leash.ncl --format json - -# Show example config as JSON -show-config: - @nickel export examples/config.k9.ncl --field config --format json - -# ───────────────────────────────────────────────────────────── -# Dogfooding -# ───────────────────────────────────────────────────────────── - -# The ultimate test: use K9 to validate K9 -dogfood: - @echo "K9: Dogfooding - validating ourselves..." - @./must ensure - @just typecheck - @just leash-list - @just verify-mime || true - @echo "" - @echo "K9: Dogfooding complete. We eat what we cook. 🐕" - -# ───────────────────────────────────────────────────────────── -# Clean -# ───────────────────────────────────────────────────────────── - -# Clean generated files -clean: - @echo "K9: Cleaning generated files..." - @rm -rf docs/*.html - @rm -f ~/.magic.mgc - @echo "K9: Clean complete." - -# Uninstall MIME registration -uninstall-mime: - @echo "K9: Removing MIME registration..." - @rm -f ~/.local/share/mime/packages/k9.xml - @update-mime-database ~/.local/share/mime 2>/dev/null || true - @rm -f ~/.magic - @echo "K9: MIME registration removed." - -# ───────────────────────────────────────────────────────────── -# Signing (Hunt Authorization) -# ───────────────────────────────────────────────────────────── - -# Generate a new signing keypair -keygen name="primary": - @./sign.sh keygen {{name}} - -# Sign a component file -sign file name="primary": - @./sign.sh sign {{file}} {{name}} - -# Verify a component's signature -verify file: - @./sign.sh verify {{file}} - -# Full Hunt authorization check (cryptographic) -authorize-hunt file: - @./sign.sh authorize {{file}} - -# Add a public key to trusted keys -trust pubkey: - @./sign.sh trust {{pubkey}} - -# List all keys -list-keys: - @./sign.sh list - -# ───────────────────────────────────────────────────────────── -# Testing -# ───────────────────────────────────────────────────────────── - -# Run the test suite -test: - @./test.sh - -# Quick validation test -test-quick: - @echo "K9: Quick test..." - @nickel typecheck pedigree.ncl - @nickel typecheck leash.ncl - @echo "K9: Quick test passed." - -# Build the real k9-svc.net site (site/) with ddraig-ssg and deploy it to -# Cloudflare Pages. Requires CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID. -site-deploy: - @./scripts/deploy-site.sh diff --git a/k9-svc/README.adoc b/k9-svc/README.adoc index f8fa809b..f692f038 100644 --- a/k9-svc/README.adoc +++ b/k9-svc/README.adoc @@ -102,9 +102,9 @@ k9-sign trust ~/.config/k9/keys/primary.pub ./must run dogfood # Security tools -./k9-scan examples/hello.k9 # Static analysis -./must verify examples/hello.k9 # Signature verification -./must --dry-run run examples/hello.k9 # Preview mode +./k9-scan https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Static analysis +./must verify https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Signature verification +./must --dry-run run https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Preview mode ---- == The Triad diff --git a/k9-svc/TESTING.adoc b/k9-svc/TESTING.adoc index 664938a9..bf0ed74c 100644 --- a/k9-svc/TESTING.adoc +++ b/k9-svc/TESTING.adoc @@ -90,10 +90,10 @@ sudo pacman -S nickel just openssl libxml2 podman just setup-mime # Verify -xdg-mime query filetype examples/hello.k9 +xdg-mime query filetype https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Expected: application/vnd.k9 -file examples/hello.k9 +file https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Expected: K9 Self-Validating Component ---- @@ -132,7 +132,7 @@ brew install nickel just openssl@3 just install-uti # Verify (may require logout/login) -mdls -name kMDItemContentType examples/hello.k9 +mdls -name kMDItemContentType https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/hello.k9 # Expected: com.hyperpolymath.k9 ---- @@ -299,7 +299,7 @@ rm /tmp/testfile /tmp/testfile.sig [source,bash] ---- # Check Hunt component authorization -./sign.sh authorize examples/deploy.k9.ncl +./sign.sh authorize https://github.com/hyperpolymath/k9-ecosystem/blob/main/examples/deploy.k9.ncl # Will fail if not signed by trusted key # To test fully: diff --git a/k9-svc/actions/validate/.devcontainer/Containerfile b/k9-svc/actions/validate/.devcontainer/Containerfile deleted file mode 100644 index ee96d670..00000000 --- a/k9-svc/actions/validate/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Dev Container image for k9-validate-action -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t k9-validate-action-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/k9-validate-action - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/actions/validate/.devcontainer/README.adoc b/k9-svc/actions/validate/.devcontainer/README.adoc deleted file mode 100644 index a17cc9fa..00000000 --- a/k9-svc/actions/validate/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: Jonathan D.A. Jewell - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `k9-validate-action` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/actions/validate/.devcontainer/devcontainer.json b/k9-svc/actions/validate/.devcontainer/devcontainer.json deleted file mode 100644 index 3e0abed5..00000000 --- a/k9-svc/actions/validate/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// Dev Container configuration for k9-validate-action -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "k9-validate-action", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/actions/validate/.editorconfig b/k9-svc/actions/validate/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/actions/validate/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/actions/validate/.envrc b/k9-svc/actions/validate/.envrc deleted file mode 100644 index 3a363980..00000000 --- a/k9-svc/actions/validate/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="k9-validate-action" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/actions/validate/.gitattributes b/k9-svc/actions/validate/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/actions/validate/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/actions/validate/.github/.mailmap b/k9-svc/actions/validate/.github/.mailmap deleted file mode 100644 index e555414f..00000000 --- a/k9-svc/actions/validate/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -Jonathan D.A. Jewell <> diff --git a/k9-svc/actions/validate/.github/.nojekyll b/k9-svc/actions/validate/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/actions/validate/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/actions/validate/.github/CODEOWNERS b/k9-svc/actions/validate/.github/CODEOWNERS deleted file mode 100644 index 8d339b77..00000000 --- a/k9-svc/actions/validate/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace hyperpolymath with your GitHub username or team - -# Default owners for everything -* @hyperpolymath - -# Security-sensitive files require explicit review -SECURITY.md @hyperpolymath -.github/workflows/ @hyperpolymath -Trustfile.a2ml @hyperpolymath -.machine_readable/ @hyperpolymath diff --git a/k9-svc/actions/validate/.github/CODE_OF_CONDUCT.md b/k9-svc/actions/validate/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index a116e919..00000000 --- a/k9-svc/actions/validate/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in k9-validate-action a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | j.d.a.jewell@open.ac.uk | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **48 hours** -2. The Code of Conduct Committee will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a Code of Conduct Committee member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The Code of Conduct Committee will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** j.d.a.jewell@open.ac.uk with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different Code of Conduct Committee member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://github.com/hyperpolymath/k9-validate-action/discussions) (for general questions) -- Email j.d.a.jewell@open.ac.uk (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: 2026 · Based on Contributor Covenant 2.1 diff --git a/k9-svc/actions/validate/.github/CONTRIBUTING.md b/k9-svc/actions/validate/.github/CONTRIBUTING.md deleted file mode 100644 index 9ae3d2f4..00000000 --- a/k9-svc/actions/validate/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://github.com/hyperpolymath/k9-validate-action.git -cd k9-validate-action - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create k9-validate-action-dev -toolbox enter k9-validate-action-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -k9-validate-action/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `main` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://github.com/hyperpolymath/k9-validate-action/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://github.com/hyperpolymath/k9-validate-action/labels/help%20wanted) — Community help needed -- [`documentation`](https://github.com/hyperpolymath/k9-validate-action/labels/documentation) — Docs improvements -- [`perimeter-3`](https://github.com/hyperpolymath/k9-validate-action/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/actions/validate/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/actions/validate/.github/FUNDING.yml b/k9-svc/actions/validate/.github/FUNDING.yml deleted file mode 100644 index 688a442c..00000000 --- a/k9-svc/actions/validate/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for hyperpolymath projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: hyperpolymath -ko_fi: hyperpolymath -liberapay: hyperpolymath diff --git a/k9-svc/actions/validate/.github/GOVERNANCE.md b/k9-svc/actions/validate/.github/GOVERNANCE.md deleted file mode 100644 index 80329eb7..00000000 --- a/k9-svc/actions/validate/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **k9-validate-action**. - ---- - -## Project Governance Model - -k9-validate-action follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) 2026 hyperpolymath. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index 9392b64d..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for hyperpolymath/k9-validate-action -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index 48665388..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for hyperpolymath/k9-validate-action -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/hyperpolymath/k9-validate-action/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/hyperpolymath/k9-validate-action/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 66bc7b67..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for hyperpolymath/k9-validate-action -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 18697797..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for hyperpolymath/k9-validate-action -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 72e7f33b..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for hyperpolymath/k9-validate-action -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index b3f778aa..00000000 --- a/k9-svc/actions/validate/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for hyperpolymath/k9-validate-action -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/hyperpolymath/k9-validate-action/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/actions/validate/.github/MAINTAINERS b/k9-svc/actions/validate/.github/MAINTAINERS deleted file mode 100644 index 63989c71..00000000 --- a/k9-svc/actions/validate/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -Jonathan D.A. Jewell (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/actions/validate/.github/README.adoc b/k9-svc/actions/validate/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/actions/validate/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/actions/validate/.github/SECURITY.md b/k9-svc/actions/validate/.github/SECURITY.md deleted file mode 100644 index 4c639fff..00000000 --- a/k9-svc/actions/validate/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/hyperpolymath/k9-validate-action/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | j.d.a.jewell@open.ac.uk | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint j.d.a.jewell@open.ac.uk - -# Encrypt your report -gpg --armor --encrypt --recipient j.d.a.jewell@open.ac.uk report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`hyperpolymath/k9-validate-action`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/hyperpolymath/k9-validate-action/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using k9-validate-action, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/hyperpolymath/k9-validate-action/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/hyperpolymath/k9-validate-action/security/advisories/new) or j.d.a.jewell@open.ac.uk | -| **General questions** | [GitHub Discussions](https://github.com/hyperpolymath/k9-validate-action/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep k9-validate-action and its users safe.* 🛡️ - ---- - -Last updated: 2026 · Policy version: 1.0.0 diff --git a/k9-svc/actions/validate/.github/SUPPORT b/k9-svc/actions/validate/.github/SUPPORT deleted file mode 100644 index 369f1d60..00000000 --- a/k9-svc/actions/validate/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/hyperpolymath/k9-validate-action/discussions -- GitHub Issues: https://github.com/hyperpolymath/k9-validate-action/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/actions/validate/.github/copilot-instructions.md b/k9-svc/actions/validate/.github/copilot-instructions.md deleted file mode 100644 index 7efa7538..00000000 --- a/k9-svc/actions/validate/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `Jonathan D.A. Jewell (hyperpolymath) ` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/actions/validate/.github/dependabot.yml b/k9-svc/actions/validate/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/actions/validate/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/actions/validate/.github/pull_request_template.md b/k9-svc/actions/validate/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/actions/validate/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/actions/validate/.github/workflows/codeql.yml b/k9-svc/actions/validate/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/actions/validate/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/actions/validate/.github/workflows/governance.yml b/k9-svc/actions/validate/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/actions/validate/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/actions/validate/.github/workflows/hypatia-scan.yml b/k9-svc/actions/validate/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/actions/validate/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/actions/validate/.github/workflows/jekyll.yml b/k9-svc/actions/validate/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/actions/validate/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/actions/validate/.github/workflows/mirror.yml b/k9-svc/actions/validate/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/actions/validate/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/actions/validate/.github/workflows/release.yml b/k9-svc/actions/validate/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/actions/validate/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/actions/validate/.github/workflows/rhodibot.yml b/k9-svc/actions/validate/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/actions/validate/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/actions/validate/.github/workflows/scorecard-enforcer.yml b/k9-svc/actions/validate/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/actions/validate/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/actions/validate/.github/workflows/scorecard.yml b/k9-svc/actions/validate/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/actions/validate/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/actions/validate/.github/workflows/secret-scanner.yml b/k9-svc/actions/validate/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/actions/validate/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/actions/validate/.github/workflows/static-analysis-gate.yml b/k9-svc/actions/validate/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/actions/validate/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/actions/validate/.gitignore b/k9-svc/actions/validate/.gitignore deleted file mode 100644 index 037efd36..00000000 --- a/k9-svc/actions/validate/.gitignore +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/actions/validate/.gitlab-ci.yml b/k9-svc/actions/validate/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/actions/validate/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/actions/validate/.guix-channel b/k9-svc/actions/validate/.guix-channel deleted file mode 100644 index 239a8755..00000000 --- a/k9-svc/actions/validate/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -;; -;; Guix channel definition for k9-validate-action -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name 'k9-validate-action) -;; (url "https://github.com/hyperpolymath/k9-validate-action") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/hyperpolymath/k9-validate-action") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/actions/validate/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/actions/validate/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/actions/validate/.machine_readable/CLADE.a2ml b/k9-svc/actions/validate/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/actions/validate/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/actions/validate/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/actions/validate/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index ca6b11d5..00000000 --- a/k9-svc/actions/validate/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "k9-validate-action Development" -# description = "Panels for k9-validate-action development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/actions/validate/.machine_readable/README.adoc b/k9-svc/actions/validate/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/actions/validate/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/actions/validate/.machine_readable/ai/.clinerules b/k9-svc/actions/validate/.machine_readable/ai/.clinerules deleted file mode 100644 index d962549e..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: Jonathan D.A. Jewell (hyperpolymath) - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/actions/validate/.machine_readable/ai/.cursorrules b/k9-svc/actions/validate/.machine_readable/ai/.cursorrules deleted file mode 100644 index f87d41d0..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: Jonathan D.A. Jewell (hyperpolymath) - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/actions/validate/.machine_readable/ai/.windsurfrules b/k9-svc/actions/validate/.machine_readable/ai/.windsurfrules deleted file mode 100644 index d962549e..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: Jonathan D.A. Jewell (hyperpolymath) - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/actions/validate/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/actions/validate/.machine_readable/ai/AI.a2ml b/k9-svc/actions/validate/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/actions/validate/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/actions/validate/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index 4a942abf..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/Jonathan D.A. Jewell/Jane Doe/g' $(grep -rl 'Jonathan D.A. Jewell' .) -sed -i 's/j.d.a.jewell@open.ac.uk/jane@example.org/g' $(grep -rl 'j.d.a.jewell@open.ac.uk' .) -sed -i 's/hyperpolymath/my-org/g' $(grep -rl 'hyperpolymath' .) -sed -i 's/k9-validate-action/my-project/g' $(grep -rl 'k9-validate-action' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/k9-validate-action/my-project/g' $(grep -rl 'k9-validate-action' .) -sed -i 's/github.com/github.com/g' $(grep -rl 'github.com' .) -sed -i "s/2026/$(date +%Y)/g" $(grep -rl '2026' .) -sed -i "s/2026-03-16/$(date +%Y-%m-%d)/g" $(grep -rl '2026-03-16' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `Jonathan D.A. Jewell` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `j.d.a.jewell@open.ac.uk` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `hyperpolymath` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `Jewell` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `Jonathan D.A.` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `J.` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `k9-validate-action` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `k9-validate-action` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `hyperpolymath` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `github.com` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `2026` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `2026-03-16` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `2026-03-16` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `j.d.a.jewell@open.ac.uk` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `https://github.com/hyperpolymath/k9-validate-action` | Project website | `https://example.org` | SECURITY.md | -| `j.d.a.jewell@open.ac.uk` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `Code of Conduct Committee` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `48 hours` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `main` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `PMPL-1.0-or-later` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/actions/validate/.machine_readable/ai/README.adoc b/k9-svc/actions/validate/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/actions/validate/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/actions/validate/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/actions/validate/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/actions/validate/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/actions/validate/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index bf084038..00000000 --- a/k9-svc/actions/validate/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "2026-03-16" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "hyperpolymath/k9-validate-action" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "k9-validate-action" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/actions/validate/.machine_readable/anchors/README.adoc b/k9-svc/actions/validate/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/actions/validate/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/actions/validate/.machine_readable/compliance/reuse/dep5 b/k9-svc/actions/validate/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 31334bd2..00000000 --- a/k9-svc/actions/validate/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: k9-validate-action -Upstream-Contact: Jonathan D.A. Jewell -Source: https://github.com/hyperpolymath/k9-validate-action - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: 2026 Jonathan D.A. Jewell (hyperpolymath) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/actions/validate/.machine_readable/compliance/rust/deny.toml b/k9-svc/actions/validate/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/actions/validate/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/actions/validate/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/actions/validate/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/actions/validate/.machine_readable/configs/README.adoc b/k9-svc/actions/validate/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/actions/validate/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/actions/validate/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/actions/validate/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index fc7dd7e4..00000000 --- a/k9-svc/actions/validate/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# hyperpolymath — GitHub organization or username -# k9-validate-action — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/hyperpolymath/k9-validate-action -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/hyperpolymath/k9-validate-action -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/actions/validate/.machine_readable/contractiles/README.adoc b/k9-svc/actions/validate/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/actions/validate/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/actions/validate/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/actions/validate/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/actions/validate/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/actions/validate/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/actions/validate/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/actions/validate/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/actions/validate/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/actions/validate/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/actions/validate/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 6e0b878f..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-03-16" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 6c31d372..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-03-16" - -[project] -name = "k9-validate-action" -purpose = "" -role = "infrastructure" # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/META.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index a7d64e31..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-03-16" - -[project-info] -type = "infrastructure" # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 5cef0a4e..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-03-16" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index d768f719..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-03-16" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/actions/validate/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/actions/validate/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index 7527bd70..00000000 --- a/k9-svc/actions/validate/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "k9-validate-action" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "k9-validate-action" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/actions/validate/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/actions/validate/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/actions/validate/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index a7df7cfe..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "2026-03-16" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/actions/validate/.machine_readable/policies/README.adoc b/k9-svc/actions/validate/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/actions/validate/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/actions/validate/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/actions/validate/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/actions/validate/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/actions/validate/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/actions/validate/.machine_readable/scripts/forge/README.adoc b/k9-svc/actions/validate/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/actions/validate/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/actions/validate/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/actions/validate/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/actions/validate/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/actions/validate/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/actions/validate/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/actions/validate/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/actions/validate/.machine_readable/scripts/verification/README.adoc b/k9-svc/actions/validate/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/actions/validate/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/actions/validate/.tool-versions b/k9-svc/actions/validate/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/actions/validate/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/actions/validate/.well-known/ai.txt b/k9-svc/actions/validate/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/actions/validate/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/actions/validate/.well-known/humans.txt b/k9-svc/actions/validate/.well-known/humans.txt deleted file mode 100644 index 07b70a5c..00000000 --- a/k9-svc/actions/validate/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: Jonathan D.A. Jewell (hyperpolymath) -Contact: j.d.a.jewell@open.ac.uk -From: United Kingdom - -/* SITE */ -Last update: 2026-03-16 -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/actions/validate/.well-known/security.txt b/k9-svc/actions/validate/.well-known/security.txt deleted file mode 100644 index 94b49682..00000000 --- a/k9-svc/actions/validate/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:j.d.a.jewell@open.ac.uk -Expires: 2026-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://github.com/hyperpolymath/k9-validate-action/.well-known/security.txt -Policy: https://github.com/hyperpolymath/k9-validate-action/blob/main/SECURITY.md -Hiring: https://https://github.com/hyperpolymath/k9-validate-action/careers diff --git a/k9-svc/actions/validate/0-AI-MANIFEST.a2ml b/k9-svc/actions/validate/0-AI-MANIFEST.a2ml deleted file mode 100644 index ccd3eacd..00000000 --- a/k9-svc/actions/validate/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **k9-validate-action**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "Jonathan D.A. Jewell " -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -k9-validate-action/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/actions/validate/CHANGELOG.adoc b/k9-svc/actions/validate/CHANGELOG.adoc deleted file mode 100644 index ca1c6528..00000000 --- a/k9-svc/actions/validate/CHANGELOG.adoc +++ /dev/null @@ -1,9 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [Unreleased] diff --git a/k9-svc/actions/validate/CONTRIBUTING.adoc b/k9-svc/actions/validate/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/actions/validate/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/actions/validate/Containerfile b/k9-svc/actions/validate/Containerfile deleted file mode 100644 index 4d50adec..00000000 --- a/k9-svc/actions/validate/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Containerfile for k9-validate-action -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/actions/validate/Justfile b/k9-svc/actions/validate/Justfile deleted file mode 100644 index 534e838d..00000000 --- a/k9-svc/actions/validate/Justfile +++ /dev/null @@ -1,910 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "k9-validate-action" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-hyperpolymath}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-hyperpolymath}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/hyperpolymath" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/actions/validate/LICENSE b/k9-svc/actions/validate/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/actions/validate/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/actions/validate/README.adoc b/k9-svc/actions/validate/README.adoc deleted file mode 100644 index 8775089a..00000000 --- a/k9-svc/actions/validate/README.adoc +++ /dev/null @@ -1,168 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -= K9 Validate Action -:author: Jonathan D.A. Jewell -:revdate: 2026-03-17 -:toc: preamble -:icons: font - -GitHub Action that scans and validates K9 configuration files (`.k9` and -`.k9.ncl`) in your repository. Checks structural integrity, security level -compliance, pedigree completeness, and hunt-level signature requirements. - -== What It Validates - -The action performs five checks on every K9 file discovered: - -[cols="1,1,3"] -|=== -| Check | Severity | Description - -| K9! magic number -| Error -| The first non-empty line must be exactly `K9!`. - -| SPDX header -| Warning -| An `SPDX-License-Identifier` must appear within the first 10 lines. - -| Pedigree block -| Error -| A `pedigree = { ... }` section must exist, containing at minimum a `name` - field. A `version` or `schema_version` field is expected (warning if missing). - -| Security level -| Error -| The `leash` or `security_level` field must be one of: `kennel`, `yard`, - `hunt` (case-insensitive). Nickel enum tick syntax (`'Kennel`) is handled. - -| Hunt-level signature -| Error -| Files with security level `hunt` must include a `signature` or - `signature_required` field. -|=== - -== Usage - -Add this step to any workflow to validate K9 files on push or pull request: - -[source,yaml] ----- -name: Validate K9 -on: [push, pull_request] - -permissions: - contents: read - -jobs: - validate: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - uses: hyperpolymath/standards/k9-svc/actions/validate@main - with: - path: '.' # Directory to scan (default: repo root) - strict: 'false' # Promote warnings to errors (default: false) ----- - -=== Using Outputs - -[source,yaml] ----- - - uses: hyperpolymath/standards/k9-svc/actions/validate@main - id: k9 - - run: | - echo "Scanned: ${{ steps.k9.outputs.files-scanned }}" - echo "Errors: ${{ steps.k9.outputs.errors }}" - echo "Warnings: ${{ steps.k9.outputs.warnings }}" ----- - -== Inputs - -[cols="1,1,3"] -|=== -| Input | Default | Description - -| `path` -| `.` -| Directory path to scan for `.k9` and `.k9.ncl` files. The scan is recursive - and excludes `.git/`. - -| `strict` -| `false` -| When `true`, all warnings are promoted to errors and the action fails on any - validation issue. -|=== - -== Outputs - -[cols="1,3"] -|=== -| Output | Description - -| `files-scanned` -| Total number of K9 files discovered and processed. - -| `errors` -| Count of validation errors found. Non-zero causes exit code 1. - -| `warnings` -| Count of validation warnings found. In strict mode, these become errors. -|=== - -== Exit Codes - -[cols="1,3"] -|=== -| Code | Meaning - -| `0` -| All files valid (or warnings only in non-strict mode). - -| `1` -| One or more validation errors were found. -|=== - -Validation results are also emitted as GitHub Actions annotations (the -`::error` and `::warning` workflow commands), so issues appear inline on the -Files Changed tab of pull requests. - -== Security Levels - -K9 uses a "leash" metaphor for trust tiers: - -[cols="1,1,3"] -|=== -| Level | Trust | Requirements - -| `kennel` -| Data-only -| No signature required. Pure configuration values. No execution capabilities. - -| `yard` -| Validated -| Nickel contracts enforced. Type-checked before use. Limited permissions. - -| `hunt` -| Full access -| *Signature required.* Can execute commands and access system resources. -|=== - -== Implementation - -The action is a composite action (`using: composite`) that runs -`validate-k9.sh` -- a portable Bash script with no external dependencies -beyond `bash` and `find`. It uses `set -euo pipefail` for safety and -produces structured output via `$GITHUB_OUTPUT`. - -== Part of the K9 Ecosystem - -This action is part of the -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9 Self-Validating Components] -suite within the `standards` monorepo. Related tools: - -* link:../../bindings/[`bindings/`] -- Language bindings (Deno, Rust, Gleam, Elixir, Haskell) -* link:../../pandoc/[`pandoc/`] -- Pandoc reader, writer, and filter -* link:../../editors/vscode/[`editors/vscode/`] -- VS Code extension -* link:../../SPEC.adoc[`SPEC.adoc`] -- K9 format specification diff --git a/k9-svc/actions/validate/ROADMAP.adoc b/k9-svc/actions/validate/ROADMAP.adoc deleted file mode 100644 index 9829f827..00000000 --- a/k9-svc/actions/validate/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Validate Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/actions/validate/SECURITY.adoc b/k9-svc/actions/validate/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/actions/validate/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/actions/validate/action.yml b/k9-svc/actions/validate/action.yml deleted file mode 100644 index 8f5c962c..00000000 --- a/k9-svc/actions/validate/action.yml +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# action.yml — Validate K9 Configuration Files GitHub Action -# Scans repository for .k9 and .k9.ncl files and validates structure, -# magic number, pedigree blocks, and security level constraints. - -name: 'Validate K9 Configurations' -description: >- - Scan and validate K9 configuration files (.k9 and .k9.ncl) in your - repository. Checks for K9! magic number, pedigree block (name, version, - security_level), valid security levels (kennel/yard/hunt), and ensures - hunt-level files include a signature field. -author: 'Jonathan D.A. Jewell' - -branding: - icon: 'lock' - color: 'orange' - -inputs: - path: - description: >- - Directory path to scan for K9 files. - Defaults to the repository root. - required: false - default: '.' - strict: - description: >- - When true, warnings are promoted to errors and the action - will fail on any validation issue. Defaults to false. - required: false - default: 'false' - -outputs: - files-scanned: - description: 'Number of K9 files scanned' - value: ${{ steps.validate.outputs.files_scanned }} - errors: - description: 'Number of validation errors found' - value: ${{ steps.validate.outputs.errors }} - warnings: - description: 'Number of validation warnings found' - value: ${{ steps.validate.outputs.warnings }} - -runs: - using: 'composite' - steps: - - name: Validate K9 configurations - id: validate - shell: bash - env: - INPUT_PATH: ${{ inputs.path }} - INPUT_STRICT: ${{ inputs.strict }} - run: | - "${GITHUB_ACTION_PATH}/validate-k9.sh" diff --git a/k9-svc/actions/validate/container/.gatekeeper.yaml b/k9-svc/actions/validate/container/.gatekeeper.yaml deleted file mode 100644 index 96dbfae5..00000000 --- a/k9-svc/actions/validate/container/.gatekeeper.yaml +++ /dev/null @@ -1,122 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Svalinn gatekeeper policy for k9-validate-action -# -# Controls which operations are permitted through the edge gateway. -# This template provides moderate security defaults — not wide-open test -# mode, but not production-hardened either. Tighten the values below -# before deploying to production. -# -# See: stapeln/container-stack/svalinn/ - -version: "1.0" - -# ============================================================================ -# Authentication -# ============================================================================ -# -# Define which endpoints require authentication and at what level. - -auth: - # Public endpoints — no authentication required. - # Health and readiness probes must always be public so that - # orchestrators (selur, Podman, k8s) can check service status. - public: - - path: "/health" - methods: ["GET"] - - path: "/ready" - methods: ["GET"] - - path: "/metrics" - methods: ["GET"] - - # Endpoints requiring JWT or OAuth2 authentication. - # Svalinn validates the token before forwarding the request. - authenticated: - - path: "/api/v1/*" - methods: ["GET", "POST", "PUT", "DELETE"] - -# ============================================================================ -# Rate Limiting -# ============================================================================ -# -# Protects backend services from overload. Values here are moderate -# defaults — adjust based on your service capacity. - -rate_limits: - # Global limit: applied to all authenticated clients. - global: - requests_per_second: 500 - burst: 1000 - - # Write operations: stricter limit to protect data stores. - writes: - paths: ["/api/v1/*"] - methods: ["POST", "PUT", "DELETE"] - requests_per_second: 100 - burst: 200 - -# ============================================================================ -# Container Trust -# ============================================================================ -# -# Svalinn verifies that all .ctp bundles in the stack are signed by -# trusted keys and carry the required attestations. - -trust: - # Only accept .ctp bundles signed by these keys. - trusted_signers: - - key_id: "k9-validate-action-release" - algorithm: "Ed25519" - public_key_file: "/etc/svalinn/keys/k9-validate-action-release.pub" - - # Require these attestations on all .ctp bundles. - required_attestations: - - "source-signature" - - "sbom-complete" - - # Reject unsigned or untrusted images. - reject_unsigned: true - -# ============================================================================ -# Request Validation -# ============================================================================ -# -# Input validation at the gateway layer — catches malformed requests -# before they reach the application. - -validation: - # Maximum request body size. - max_body_size: "8MB" - - # Reject requests with NaN or Infinity in numeric fields. - reject_nan_inf: true - - # Maximum result limit per list/search query. - max_result_limit: 500 - -# ============================================================================ -# CORS -# ============================================================================ -# -# Cross-Origin Resource Sharing policy. The defaults below allow all -# origins — restrict to your frontend domain(s) in production. - -cors: - allow_origins: ["*"] - allow_methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"] - allow_headers: ["Content-Type", "Authorization"] - max_age: 3600 - -# ============================================================================ -# Logging -# ============================================================================ -# -# Structured logging for svalinn itself. Audit paths log all requests -# (including body hashes) for post-incident investigation. - -logging: - format: "json" - level: "info" - # Log all write operations for audit trail. - audit_paths: - - "/api/v1/*" diff --git a/k9-svc/actions/validate/container/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/actions/validate/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/actions/validate/container/Containerfile b/k9-svc/actions/validate/container/Containerfile deleted file mode 100644 index 04ae633a..00000000 --- a/k9-svc/actions/validate/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# k9-validate-action Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t k9-validate-action:latest -f container/Containerfile . -# -# Run: -# podman run -p 8080:8080 k9-validate-action:latest -# -# Run with persistent volume: -# podman run -p 8080:8080 -v k9-validate-action-data:/data k9-validate-action:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/k9-validate-action -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/k9-validate-action/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/k9-validate-action -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="k9-validate-action" \ - org.opencontainers.image.description="" \ - org.opencontainers.image.url="https://github.com/hyperpolymath/k9-validate-action" \ - org.opencontainers.image.source="https://github.com/hyperpolymath/k9-validate-action" \ - org.opencontainers.image.vendor="hyperpolymath" \ - org.opencontainers.image.licenses="PMPL-1.0-or-later" \ - org.opencontainers.image.authors="Jonathan D.A. Jewell " \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/k9-validate-action /app/k9-validate-action -# COPY --from=builder /build/_build/prod/rel/k9-validate-action /app/release/ -# COPY --from=builder /build/zig-out/bin/k9-validate-action /app/k9-validate-action - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT=8080 -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE 8080 - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/actions/validate/container/README.adoc b/k9-svc/actions/validate/container/README.adoc deleted file mode 100644 index f5d8974b..00000000 --- a/k9-svc/actions/validate/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -= k9-validate-action Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/actions/validate/container/compose.example.toml b/k9-svc/actions/validate/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/actions/validate/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/actions/validate/container/compose.toml b/k9-svc/actions/validate/container/compose.toml deleted file mode 100644 index 7c9be08f..00000000 --- a/k9-svc/actions/validate/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# k9-validate-action selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f k9-validate-action # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.k9-validate-action] -image = "ghcr.io/hyperpolymath/k9-validate-action:latest.ctp" -ports = ["8080:8080"] -environment = { - APP_HOST = "[::]", - APP_PORT = "8080", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["k9-validate-action-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://k9-validate-action:8080", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["k9-validate-action"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.k9-validate-action-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/actions/validate/container/ct-build.sh b/k9-svc/actions/validate/container/ct-build.sh deleted file mode 100755 index 10cf29ec..00000000 --- a/k9-svc/actions/validate/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# k9-validate-action — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: k9-validate-action-release) -# CT_REGISTRY — OCI registry to push to (default: ghcr.io/hyperpolymath) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-k9-validate-action-release}" -CT_REGISTRY="${CT_REGISTRY:-ghcr.io/hyperpolymath}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="k9-validate-action" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== k9-validate-action Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/actions/validate/container/deploy.k9.ncl b/k9-svc/actions/validate/container/deploy.k9.ncl deleted file mode 100644 index e2d3de0f..00000000 --- a/k9-svc/actions/validate/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — k9-validate-action deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "k9-validate-action-deploy", - version = "1.0.0", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "k9-validate-action deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "ghcr.io/hyperpolymath/k9-validate-action", - port = 8080, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for k9-validate-action..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying k9-validate-action to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back k9-validate-action deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/actions/validate/container/entrypoint.sh b/k9-svc/actions/validate/container/entrypoint.sh deleted file mode 100755 index 57bbc37e..00000000 --- a/k9-svc/actions/validate/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# k9-validate-action container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping k9-validate-action..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting k9-validate-action..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-8080}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/k9-validate-action -# exec /app/release/bin/k9-validate-action start -# exec /app/k9-validate-action serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/actions/validate/container/manifest.toml b/k9-svc/actions/validate/container/manifest.toml deleted file mode 100644 index 36ab23a1..00000000 --- a/k9-svc/actions/validate/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for k9-validate-action .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "k9-validate-action" -version = "1.0.0" -revision = 1 -summary = "" -description = """ -k9-validate-action — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "PMPL-1.0-or-later" -homepage = "https://github.com/hyperpolymath/k9-validate-action" -maintainer = "Jonathan D.A. Jewell " - -[provenance] -upstream = "https://github.com/hyperpolymath/k9-validate-action" -import_date = 2026-03-16T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "8080" - -[outputs] -primary = "k9-validate-action" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [8080] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/actions/validate/container/vordr.toml b/k9-svc/actions/validate/container/vordr.toml deleted file mode 100644 index 459b4f11..00000000 --- a/k9-svc/actions/validate/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for k9-validate-action -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "k9-validate-action" -version = "1.0.0" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:8080/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:8080/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/k9-validate-action.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "j.d.a.jewell@open.ac.uk" -# from = "vordr@k9-validate-action.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/actions/validate/contractile.just b/k9-svc/actions/validate/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/actions/validate/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/actions/validate/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/actions/validate/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/actions/validate/docs/QUICKSTART.adoc b/k9-svc/actions/validate/docs/QUICKSTART.adoc deleted file mode 100644 index b20b3d0a..00000000 --- a/k9-svc/actions/validate/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/hyperpolymath/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/actions/validate/docs/README.adoc b/k9-svc/actions/validate/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/actions/validate/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/actions/validate/docs/RSR_OUTLINE.adoc b/k9-svc/actions/validate/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/actions/validate/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/actions/validate/docs/STATE-VISUALIZER.adoc b/k9-svc/actions/validate/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/actions/validate/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/actions/validate/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/actions/validate/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/actions/validate/docs/architecture/THREAT-MODEL.adoc b/k9-svc/actions/validate/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index a829944f..00000000 --- a/k9-svc/actions/validate/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: k9-validate-action - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | k9-validate-action | -| Version | 1.0 | -| Last Reviewed | 2026-03-16 | -| Author | Jonathan D.A. Jewell | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of k9-validate-action and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/actions/validate/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/actions/validate/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/actions/validate/docs/attribution/CITATION.cff b/k9-svc/actions/validate/docs/attribution/CITATION.cff deleted file mode 100644 index 2b1da917..00000000 --- a/k9-svc/actions/validate/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "Jewell" - given-names: "Jonathan D.A." - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "k9-validate-action" -version: 0.1.0 -date-released: 2026-03-16 -url: "https://github.com/hyperpolymath/k9-validate-action" -repository-code: "https://github.com/hyperpolymath/k9-validate-action" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/actions/validate/docs/attribution/CITATIONS.adoc b/k9-svc/actions/validate/docs/attribution/CITATIONS.adoc deleted file mode 100644 index 7c11ac80..00000000 --- a/k9-svc/actions/validate/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= k9-validate-action - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{k9-validate-action_2026, - author = {Jewell, Jonathan D.A.}, - title = {k9-validate-action}, - year = {2026}, - url = {https://github.com/hyperpolymath/k9-validate-action}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Jewell, J. (2026) _k9-validate-action_ [Computer software]. Available at: https://github.com/hyperpolymath/k9-validate-action - -== OSCOLA - -Jonathan D.A. Jewell, 'k9-validate-action' (2026) - -== MLA - -Jewell, Jonathan D.A. "k9-validate-action." 2026, github.com/hyperpolymath/k9-validate-action. - -== APA 7 - -Jewell, J. (2026). _k9-validate-action_ [Computer software]. GitHub. https://github.com/hyperpolymath/k9-validate-action - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/actions/validate/docs/attribution/CODEOWNERS.adoc b/k9-svc/actions/validate/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/actions/validate/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/actions/validate/docs/attribution/MAINTAINERS.adoc b/k9-svc/actions/validate/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index 48d97817..00000000 --- a/k9-svc/actions/validate/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| Jonathan D.A. Jewell -| Lead Maintainer -| https://github.com/hyperpolymath[@hyperpolymath] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/actions/validate/docs/attribution/README.adoc b/k9-svc/actions/validate/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/actions/validate/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/actions/validate/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/actions/validate/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/actions/validate/docs/decisions/0000-template.adoc b/k9-svc/actions/validate/docs/decisions/0000-template.adoc deleted file mode 100644 index 67103043..00000000 --- a/k9-svc/actions/validate/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/actions/validate/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/actions/validate/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 1306493c..00000000 --- a/k9-svc/actions/validate/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/hyperpolymath/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/actions/validate/docs/decisions/README.adoc b/k9-svc/actions/validate/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/actions/validate/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/actions/validate/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/actions/validate/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/actions/validate/docs/developer/ABI-FFI-README.adoc b/k9-svc/actions/validate/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index be49b45b..00000000 --- a/k9-svc/actions/validate/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -PMPL-1.0-or-later - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/hyperpolymath/rhodium-standard-repositories) diff --git a/k9-svc/actions/validate/docs/developer/README.adoc b/k9-svc/actions/validate/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/actions/validate/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/actions/validate/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/actions/validate/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.adoc b/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/actions/validate/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/actions/validate/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/actions/validate/docs/governance/README.adoc b/k9-svc/actions/validate/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/actions/validate/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/actions/validate/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/actions/validate/docs/governance/TSDM.a2ml b/k9-svc/actions/validate/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/actions/validate/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/actions/validate/docs/governance/TSDM.adoc b/k9-svc/actions/validate/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/actions/validate/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/actions/validate/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/actions/validate/docs/governance/audit/README.adoc b/k9-svc/actions/validate/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/actions/validate/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/actions/validate/docs/governance/audit/compliance/README.adoc b/k9-svc/actions/validate/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/actions/validate/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/actions/validate/docs/governance/audit/effects/README.adoc b/k9-svc/actions/validate/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/actions/validate/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/actions/validate/docs/governance/audit/systems/README.adoc b/k9-svc/actions/validate/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/actions/validate/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/actions/validate/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/actions/validate/docs/governance/maintenance/README.adoc b/k9-svc/actions/validate/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/actions/validate/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/actions/validate/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/actions/validate/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/actions/validate/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/actions/validate/docs/governance/maintenance/corrective/README.adoc b/k9-svc/actions/validate/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/actions/validate/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/actions/validate/docs/governance/maintenance/perfective/README.adoc b/k9-svc/actions/validate/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/actions/validate/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/actions/validate/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/actions/validate/docs/governance/planning/README.adoc b/k9-svc/actions/validate/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/actions/validate/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/actions/validate/docs/governance/planning/could/README.adoc b/k9-svc/actions/validate/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/actions/validate/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/actions/validate/docs/governance/planning/must/README.adoc b/k9-svc/actions/validate/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/actions/validate/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/actions/validate/docs/governance/planning/should/README.adoc b/k9-svc/actions/validate/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/actions/validate/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/actions/validate/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/actions/validate/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/actions/validate/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/actions/validate/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/actions/validate/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/actions/validate/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/actions/validate/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/actions/validate/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/actions/validate/docs/practice/.gitkeep b/k9-svc/actions/validate/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/actions/validate/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/actions/validate/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/actions/validate/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index a80cdf7e..00000000 --- a/k9-svc/actions/validate/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **Jonathan D.A. Jewell** -- Email: **j.d.a.jewell@open.ac.uk** -- Copyright: `Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) ` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/actions/validate/docs/practice/README.adoc b/k9-svc/actions/validate/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/actions/validate/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/actions/validate/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/actions/validate/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index 835db9c6..00000000 --- a/k9-svc/actions/validate/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -Jonathan D.A. Jewell (hyperpolymath) -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) diff --git a/k9-svc/actions/validate/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/actions/validate/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/actions/validate/docs/reports/README.adoc b/k9-svc/actions/validate/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/actions/validate/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/actions/validate/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/actions/validate/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/actions/validate/docs/reports/compliance/README.adoc b/k9-svc/actions/validate/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/actions/validate/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/actions/validate/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/actions/validate/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/actions/validate/docs/reports/maintenance/README.adoc b/k9-svc/actions/validate/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/actions/validate/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/actions/validate/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/actions/validate/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/actions/validate/docs/reports/performance/README.adoc b/k9-svc/actions/validate/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/actions/validate/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/actions/validate/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/actions/validate/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/actions/validate/docs/reports/quality/README.adoc b/k9-svc/actions/validate/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/actions/validate/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/actions/validate/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/actions/validate/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/actions/validate/docs/reports/security/README.adoc b/k9-svc/actions/validate/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/actions/validate/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/actions/validate/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/actions/validate/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/actions/validate/docs/standards/README.adoc b/k9-svc/actions/validate/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/actions/validate/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/actions/validate/docs/templates/contractiles/README.adoc b/k9-svc/actions/validate/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/actions/validate/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/actions/validate/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/actions/validate/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/actions/validate/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/actions/validate/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/actions/validate/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/actions/validate/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/actions/validate/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/actions/validate/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/actions/validate/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/actions/validate/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/actions/validate/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/actions/validate/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/actions/validate/docs/theory/.gitkeep b/k9-svc/actions/validate/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/actions/validate/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/actions/validate/docs/theory/README.adoc b/k9-svc/actions/validate/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/actions/validate/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/actions/validate/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/actions/validate/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/actions/validate/docs/theory/computing/README.adoc b/k9-svc/actions/validate/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/actions/validate/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/actions/validate/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/actions/validate/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/actions/validate/docs/theory/formalisms/README.adoc b/k9-svc/actions/validate/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/actions/validate/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/actions/validate/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/actions/validate/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/actions/validate/docs/theory/mathematics/README.adoc b/k9-svc/actions/validate/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/actions/validate/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/actions/validate/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/actions/validate/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/actions/validate/docs/theory/ontologies/README.adoc b/k9-svc/actions/validate/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/actions/validate/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/actions/validate/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/actions/validate/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/actions/validate/docs/theory/other/README.adoc b/k9-svc/actions/validate/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/actions/validate/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/actions/validate/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/actions/validate/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/actions/validate/docs/theory/socio-technical/README.adoc b/k9-svc/actions/validate/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/actions/validate/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/actions/validate/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/actions/validate/docs/whitepapers/README.adoc b/k9-svc/actions/validate/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/actions/validate/docs/whitepapers/academic/.gitkeep b/k9-svc/actions/validate/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/actions/validate/docs/whitepapers/academic/README.adoc b/k9-svc/actions/validate/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/actions/validate/docs/whitepapers/industry/.gitkeep b/k9-svc/actions/validate/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/actions/validate/docs/whitepapers/industry/README.adoc b/k9-svc/actions/validate/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/actions/validate/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/actions/validate/docs/whitepapers/outreach/README.adoc b/k9-svc/actions/validate/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/actions/validate/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/actions/validate/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/actions/validate/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/actions/validate/docs/wikis/README.adoc b/k9-svc/actions/validate/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/actions/validate/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/actions/validate/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/actions/validate/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/actions/validate/examples/README.adoc b/k9-svc/actions/validate/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/actions/validate/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/actions/validate/examples/web-project-deno.json b/k9-svc/actions/validate/examples/web-project-deno.json deleted file mode 100644 index 5ddd3bd7..00000000 --- a/k9-svc/actions/validate/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/hyperpolymath/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/actions/validate/features/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/actions/validate/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/actions/validate/features/README.adoc b/k9-svc/actions/validate/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/actions/validate/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/actions/validate/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/actions/validate/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/actions/validate/features/boj-server/README.adoc b/k9-svc/actions/validate/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/actions/validate/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/actions/validate/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/actions/validate/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/actions/validate/features/panic-attacker/README.adoc b/k9-svc/actions/validate/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/actions/validate/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/actions/validate/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/actions/validate/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/actions/validate/features/ssg/README.adoc b/k9-svc/actions/validate/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/actions/validate/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/actions/validate/features/ssg/ssg-bootstrap.sh b/k9-svc/actions/validate/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/actions/validate/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/actions/validate/src/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index c92e124d..00000000 --- a/k9-svc/actions/validate/src/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary source code directory. Organized by role and architectural - aspect. - -canonical_locations: - core: "core/" - interface: "interface/" - bridges: "bridges/" - contracts: "contracts/" - errors: "errors/" - definitions: "definitions/" - aspects: "aspects/" - -invariants: - - "Core logic MUST reside in core/" - - "Verified seams MUST reside in interface/" - - "Safety constraints MUST reside in contracts/" - - "Failure dictionaries MUST reside in errors/" diff --git a/k9-svc/actions/validate/src/README.adoc b/k9-svc/actions/validate/src/README.adoc deleted file mode 100644 index 5529f66f..00000000 --- a/k9-svc/actions/validate/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= src Pillar diff --git a/k9-svc/actions/validate/src/aspects/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/aspects/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d5b209e..00000000 --- a/k9-svc/actions/validate/src/aspects/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-aspects" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Cross-cutting concerns and domain-specific aspects (Security, - Observability, Integrity). - -canonical_locations: - security: "security/" - observability: "observability/" - integrity: "integrity/" diff --git a/k9-svc/actions/validate/src/aspects/README.adoc b/k9-svc/actions/validate/src/aspects/README.adoc deleted file mode 100644 index 6456f962..00000000 --- a/k9-svc/actions/validate/src/aspects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Aspects Pillar diff --git a/k9-svc/actions/validate/src/aspects/integrity/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/aspects/integrity/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f114cbd2..00000000 --- a/k9-svc/actions/validate/src/aspects/integrity/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-integrity" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the integrity aspect. diff --git a/k9-svc/actions/validate/src/aspects/integrity/README.adoc b/k9-svc/actions/validate/src/aspects/integrity/README.adoc deleted file mode 100644 index f15d829d..00000000 --- a/k9-svc/actions/validate/src/aspects/integrity/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Integrity Aspect diff --git a/k9-svc/actions/validate/src/aspects/observability/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/aspects/observability/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index e16cbdf9..00000000 --- a/k9-svc/actions/validate/src/aspects/observability/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-observability" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the observability aspect. diff --git a/k9-svc/actions/validate/src/aspects/observability/README.adoc b/k9-svc/actions/validate/src/aspects/observability/README.adoc deleted file mode 100644 index 7852ee64..00000000 --- a/k9-svc/actions/validate/src/aspects/observability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Observability Aspect diff --git a/k9-svc/actions/validate/src/aspects/security/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/aspects/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 09965363..00000000 --- a/k9-svc/actions/validate/src/aspects/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the security aspect. diff --git a/k9-svc/actions/validate/src/aspects/security/README.adoc b/k9-svc/actions/validate/src/aspects/security/README.adoc deleted file mode 100644 index 3c3536ec..00000000 --- a/k9-svc/actions/validate/src/aspects/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Aspect diff --git a/k9-svc/actions/validate/src/bridges/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/bridges/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d3e27a0..00000000 --- a/k9-svc/actions/validate/src/bridges/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-bridges" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Integration logic for external systems (API, Database, RPC, etc.). diff --git a/k9-svc/actions/validate/src/contracts/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/contracts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0bd9198f..00000000 --- a/k9-svc/actions/validate/src/contracts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-contracts" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Contracts unit for high-rigor source code. diff --git a/k9-svc/actions/validate/src/contracts/README.adoc b/k9-svc/actions/validate/src/contracts/README.adoc deleted file mode 100644 index 9cfa2098..00000000 --- a/k9-svc/actions/validate/src/contracts/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Contracts Unit diff --git a/k9-svc/actions/validate/src/core/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/core/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 22846c78..00000000 --- a/k9-svc/actions/validate/src/core/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-core" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary application logic and core domain models. diff --git a/k9-svc/actions/validate/src/definitions/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/definitions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e54f4dab..00000000 --- a/k9-svc/actions/validate/src/definitions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-definitions" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Definitions unit for high-rigor source code. diff --git a/k9-svc/actions/validate/src/definitions/README.adoc b/k9-svc/actions/validate/src/definitions/README.adoc deleted file mode 100644 index 95483497..00000000 --- a/k9-svc/actions/validate/src/definitions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Definitions Unit diff --git a/k9-svc/actions/validate/src/errors/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/errors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index dddcc6c4..00000000 --- a/k9-svc/actions/validate/src/errors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-errors" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Errors unit for high-rigor source code. diff --git a/k9-svc/actions/validate/src/errors/README.adoc b/k9-svc/actions/validate/src/errors/README.adoc deleted file mode 100644 index 460fc1e9..00000000 --- a/k9-svc/actions/validate/src/errors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Errors Unit diff --git a/k9-svc/actions/validate/src/interface/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 7f0f471b..00000000 --- a/k9-svc/actions/validate/src/interface/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "interface-seams-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Consolidated "Verified Interface Seams" unit. This directory unifies the - formal specification (ABI), the bridge implementation (FFI), and the - resulting artifacts (Generated). - -canonical_locations: - abi: "abi/" - ffi: "ffi/" - generated: "generated/" - -invariants: - - "ABI MUST be Idris2 (.idr)" - - "FFI MUST be Zig (.zig)" - - "Generated artifacts MUST be C-compatible" - - "The 'Truth' lives in abi/; the 'Implementation' lives in ffi/" diff --git a/k9-svc/actions/validate/src/interface/README.adoc b/k9-svc/actions/validate/src/interface/README.adoc deleted file mode 100644 index 8faf0aad..00000000 --- a/k9-svc/actions/validate/src/interface/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= interface Unit diff --git a/k9-svc/actions/validate/src/interface/abi/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/abi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 91cafa01..00000000 --- a/k9-svc/actions/validate/src/interface/abi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for abi. diff --git a/k9-svc/actions/validate/src/interface/abi/README.adoc b/k9-svc/actions/validate/src/interface/abi/README.adoc deleted file mode 100644 index 2330304d..00000000 --- a/k9-svc/actions/validate/src/interface/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= abi Logic diff --git a/k9-svc/actions/validate/src/interface/ffi/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/ffi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index bf456ae2..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ffi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for ffi. diff --git a/k9-svc/actions/validate/src/interface/ffi/README.adoc b/k9-svc/actions/validate/src/interface/ffi/README.adoc deleted file mode 100644 index 8fe57d34..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= ffi Logic diff --git a/k9-svc/actions/validate/src/interface/ffi/build.zig b/k9-svc/actions/validate/src/interface/ffi/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/k9-svc/actions/validate/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 5b5f1b1e..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "src-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Src logic at level 4. diff --git a/k9-svc/actions/validate/src/interface/ffi/src/README.adoc b/k9-svc/actions/validate/src/interface/ffi/src/README.adoc deleted file mode 100644 index a5c0c6d5..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Src Logic diff --git a/k9-svc/actions/validate/src/interface/ffi/src/main.zig b/k9-svc/actions/validate/src/interface/ffi/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/k9-svc/actions/validate/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index e02427f8..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "test-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Test logic at level 4. diff --git a/k9-svc/actions/validate/src/interface/ffi/test/README.adoc b/k9-svc/actions/validate/src/interface/ffi/test/README.adoc deleted file mode 100644 index f6f38bf6..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/test/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Test Logic diff --git a/k9-svc/actions/validate/src/interface/ffi/test/integration_test.zig b/k9-svc/actions/validate/src/interface/ffi/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/k9-svc/actions/validate/src/interface/ffi/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/k9-svc/actions/validate/src/interface/generated/0.3-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/generated/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0088b80c..00000000 --- a/k9-svc/actions/validate/src/interface/generated/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "generated-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for generated. diff --git a/k9-svc/actions/validate/src/interface/generated/README.adoc b/k9-svc/actions/validate/src/interface/generated/README.adoc deleted file mode 100644 index 3691b062..00000000 --- a/k9-svc/actions/validate/src/interface/generated/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= generated Logic diff --git a/k9-svc/actions/validate/src/interface/generated/abi/.gitkeep b/k9-svc/actions/validate/src/interface/generated/abi/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/actions/validate/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml b/k9-svc/actions/validate/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 4eeb5808..00000000 --- a/k9-svc/actions/validate/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Abi logic at level 4. diff --git a/k9-svc/actions/validate/src/interface/generated/abi/README.adoc b/k9-svc/actions/validate/src/interface/generated/abi/README.adoc deleted file mode 100644 index aff61a99..00000000 --- a/k9-svc/actions/validate/src/interface/generated/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Abi Logic diff --git a/k9-svc/actions/validate/validate-k9.sh b/k9-svc/actions/validate/validate-k9.sh deleted file mode 100755 index 24466c06..00000000 --- a/k9-svc/actions/validate/validate-k9.sh +++ /dev/null @@ -1,346 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# validate-k9.sh — K9 configuration file validation script -# -# K9 files come in two dialects, validated differently (standards#434): -# -# Plain dialect (.k9) — text/YAML-ish documents. The `K9!` magic line is -# the format marker and MUST be the first non-empty line. Fields use -# `key: value` form. -# -# Nickel dialect (.k9.ncl) — Nickel source. A bare `K9!` line is a Nickel -# syntax error, so the format marker is carried differently: a -# `magic_number = "K9!"` field, a literal `K9!` preamble line (template -# files that are preprocessed before evaluation), or by construction — -# the file imports/merges a K9 pedigree schema (`K9Pedigree`, -# `pedigree_schema`, or an `import ".…k9.ncl"` of a base template that -# itself carries the magic). Library/contractile modules are that last -# class and are first-class citizens, not violations. -# -# Checks: -# 1. Format marker (dialect-appropriate, see above) -# 2. Pedigree presence with required fields (name; version as warning) -# 3. Security level is one of: kennel, yard, hunt (case-insensitive) -# 4. Hunt-level files must have a signature or signature_required field -# 5. SPDX-License-Identifier header presence -# -# This is a LEXICAL linter (grep-grade), not a Nickel evaluator. Field -# checks are file-scope presence checks on purpose: Nickel lets authors -# factor the pedigree through `let` bindings and `&` merges, which no -# line-oriented block tracker can follow. (A previous version tracked -# brace depth to scope checks to the pedigree block; it missed every -# `let component_pedigree = {…}` factoring and miscounted its own opening -# brace. Do not reintroduce block scoping here — deep validation belongs -# to the Nickel contracts themselves.) -# -# Environment variables: -# INPUT_PATH — Directory to scan (default: .) -# INPUT_STRICT — Promote warnings to errors (default: false) -# -# Exit codes: -# 0 — All files valid (or only warnings in non-strict mode) -# 1 — Validation errors found - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCAN_PATH="${INPUT_PATH:-.}" -STRICT="${INPUT_STRICT:-false}" - -# Outside GitHub Actions GITHUB_OUTPUT is unset; under `set -u` an unset -# expansion inside a redirection aborts the whole script (the `|| true` -# cannot catch an expansion error). Default to /dev/null for local runs. -GITHUB_OUTPUT="${GITHUB_OUTPUT:-/dev/null}" - -# Counters -FILES_SCANNED=0 -ERRORS=0 -WARNINGS=0 - -# Valid security levels (the leash metaphor) -VALID_LEVELS="kennel yard hunt" - -# --------------------------------------------------------------------------- -# Helper: emit GitHub annotation -# --------------------------------------------------------------------------- -annotate() { - local level="$1" file="$2" line="$3" message="$4" - echo "::${level} file=${file},line=${line}::${message}" -} - -# --------------------------------------------------------------------------- -# Helper: report issue (respects strict mode) -# --------------------------------------------------------------------------- -report_issue() { - local severity="$1" file="$2" line="$3" message="$4" - - if [[ "$severity" == "warning" && "$STRICT" == "true" ]]; then - severity="error" - fi - - annotate "$severity" "$file" "$line" "$message" - - if [[ "$severity" == "error" ]]; then - ERRORS=$((ERRORS + 1)) - else - WARNINGS=$((WARNINGS + 1)) - fi -} - -# --------------------------------------------------------------------------- -# Helper: normalise a security level string -# --------------------------------------------------------------------------- -# Strips quotes, leading/trailing whitespace, Nickel enum tick prefix. -# Handles both separators: `leash = 'Hunt` (Nickel) and `leash: hunt` (plain). -normalise_level() { - local raw="$1" - # Remove surrounding quotes, tick prefix ('Kennel -> Kennel), whitespace - if [[ "$raw" == *"="* ]]; then - raw="${raw#*=}" # Remove everything before = - else - raw="${raw#*:}" # Plain dialect: remove everything before : - fi - raw="${raw//\"/}" # Remove double quotes - raw="${raw//\'/}" # Remove single quotes (Nickel tick) - raw="${raw//,/}" # Remove trailing commas - raw="${raw%%#*}" # Remove inline comments - # Trim ALL leading/trailing whitespace (a single-space `%% ` pattern - # strips only one char and let `'Kennel # comment` survive as - # "kennel " — an invalid-level false positive) - raw="${raw#"${raw%%[![:space:]]*}"}" - raw="${raw%"${raw##*[![:space:]]}"}" - echo "${raw,,}" # Lowercase -} - -# --------------------------------------------------------------------------- -# Validator: check a single K9 file -# --------------------------------------------------------------------------- -validate_k9() { - local file="$1" - FILES_SCANNED=$((FILES_SCANNED + 1)) - - # Dialect: .k9.ncl is Nickel source; bare .k9 is the plain dialect. - local dialect="plain" - if [[ "$file" == *.k9.ncl ]]; then - dialect="ncl" - fi - - # --- Check 1: format marker (dialect-appropriate) --- - local first_content_line="" - local first_content_line_num=0 - local line_num=0 - - while IFS= read -r line; do - line_num=$((line_num + 1)) - # Skip empty lines - if [[ -z "${line// /}" ]]; then - continue - fi - first_content_line="$line" - first_content_line_num=$line_num - break - done < "$file" - - if [[ "$dialect" == "plain" ]]; then - if [[ "$first_content_line" != "K9!" ]]; then - report_issue "error" "$file" "$first_content_line_num" \ - "Missing K9! magic number. First non-empty line must be exactly 'K9!'" - fi - else - # Nickel dialect: a bare K9! line is a Nickel syntax error, so the - # marker may instead be a magic_number field or arrive by construction - # through a pedigree-schema import/merge (library modules, #434). - local has_marker=false - if [[ "$first_content_line" == "K9!" ]]; then - has_marker=true - elif grep -Eq '^[[:space:]]*magic_number[[:space:]]*=[[:space:]]*"K9!"' "$file"; then - has_marker=true - elif grep -Eq '(K9Pedigree|pedigree_schema)[[:space:]]*&|&[[:space:]]*(.*\.)?(K9Pedigree|pedigree_schema)|import[[:space:]]*"[^"]*\.k9\.ncl"' "$file"; then - has_marker=true - fi - - if [[ "$has_marker" == "false" ]]; then - report_issue "error" "$file" "$first_content_line_num" \ - "Missing K9 format marker. A .k9.ncl file needs a magic_number = \"K9!\" field, a K9! preamble line, or a K9 pedigree schema import/merge" - fi - fi - - # --- Check 2: SPDX header --- - local has_spdx=false - line_num=0 - while IFS= read -r line; do - line_num=$((line_num + 1)) - if [[ $line_num -gt 10 ]]; then - break - fi - if [[ "$line" == *"SPDX-License-Identifier"* ]]; then - has_spdx=true - break - fi - done < "$file" - - if [[ "$has_spdx" == "false" ]]; then - report_issue "warning" "$file" 1 \ - "Missing SPDX-License-Identifier in first 10 lines" - fi - - # --- Check 3: Pedigree presence with required fields --- - # File-scope scans by design (see header): Nickel factoring means the - # pedigree may be `pedigree = {…}`, a let-bound `let component_pedigree - # = {…}`, a schema merge `X.pedigree_schema & {…}` / `X.K9Pedigree & - # {…}`, or — plain dialect — a `metadata:`/`pedigree:` YAML block. - local has_pedigree=false - local has_pedigree_name=false - local has_pedigree_version=false - local has_security_level=false - local security_level_value="" - local security_level_line=0 - local has_signature_field=false - - line_num=0 - while IFS= read -r line; do - line_num=$((line_num + 1)) - - # Pedigree construct, Nickel forms: direct, let-bound, schema merge - if [[ "$line" =~ ^[[:space:]]*(let[[:space:]]+)?[A-Za-z_]*pedigree[[:space:]]*= ]] \ - || [[ "$line" =~ (K9Pedigree|pedigree_schema)[[:space:]]*\& ]] \ - || [[ "$line" =~ \&[[:space:]]*([A-Za-z_][A-Za-z0-9_]*\.)?(K9Pedigree|pedigree_schema) ]]; then - has_pedigree=true - fi - - # Pedigree construct, plain dialect: top-level metadata:/pedigree: block - if [[ "$dialect" == "plain" ]] \ - && [[ "$line" =~ ^(metadata|pedigree):[[:space:]]*$ ]]; then - has_pedigree=true - fi - - # Required fields, either separator (= Nickel, : plain) - if [[ "$line" =~ ^[[:space:]]*name[[:space:]]*[=:] ]]; then - has_pedigree_name=true - fi - - if [[ "$line" =~ ^[[:space:]]*(version|schema_version)[[:space:]]*[=:] ]]; then - has_pedigree_version=true - fi - - # Security level (leash field) - if [[ "$line" =~ ^[[:space:]]*(leash|security_level)[[:space:]]*[=:] ]]; then - has_security_level=true - security_level_value="$(normalise_level "$line")" - security_level_line=$line_num - fi - - # Signature fields - if [[ "$line" =~ ^[[:space:]]*(signature|signature_required)[[:space:]]*[=:] ]]; then - has_signature_field=true - fi - done < "$file" - - if [[ "$has_pedigree" == "false" ]]; then - report_issue "error" "$file" 1 \ - "Missing pedigree. K9 files need a pedigree section: 'pedigree = { ... }', a pedigree-schema merge, or (plain dialect) a 'metadata:' block" - else - if [[ "$has_pedigree_name" == "false" ]]; then - report_issue "error" "$file" 1 \ - "Pedigree block missing 'name' field (in pedigree.metadata.name or pedigree.name)" - fi - - if [[ "$has_pedigree_version" == "false" ]]; then - report_issue "warning" "$file" 1 \ - "Pedigree block missing 'version' or 'schema_version' field" - fi - fi - - # --- Check 4: Security level validation --- - if [[ "$has_security_level" == "true" && "$security_level_value" =~ ^\{\{.*\}\}$ ]]; then - # Scaffold file: the level is a template placeholder to be filled at - # instantiation time. Note it, but a template cannot validate as - # concrete and flagging it every run just trains people to ignore - # the gate. - annotate "notice" "$file" "$security_level_line" \ - "Security level is a template placeholder (${security_level_value}); skipping level validation" - elif [[ "$has_security_level" == "true" ]]; then - local level_valid=false - for valid in $VALID_LEVELS; do - if [[ "$security_level_value" == "$valid" ]]; then - level_valid=true - break - fi - done - - if [[ "$level_valid" == "false" ]]; then - report_issue "error" "$file" "$security_level_line" \ - "Invalid security level '${security_level_value}'. Must be one of: kennel, yard, hunt" - fi - else - if [[ "$has_pedigree" == "true" ]]; then - report_issue "warning" "$file" 1 \ - "No security level (leash/security_level) found in pedigree block" - fi - fi - - # --- Check 5: Hunt-level signature requirement --- - if [[ "$security_level_value" == "hunt" && "$has_signature_field" == "false" ]]; then - report_issue "error" "$file" "$security_level_line" \ - "Hunt-level K9 file must include a 'signature' or 'signature_required' field" - fi -} - -# --------------------------------------------------------------------------- -# Main: discover and validate K9 files -# --------------------------------------------------------------------------- - -echo "::group::K9 Configuration Validation" -echo "Scanning ${SCAN_PATH} for K9 files (.k9, .k9.ncl)..." -echo "" - -# Find all K9 files, excluding .git directory -mapfile -t k9_files < <(find "$SCAN_PATH" \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path '*/.git/*' -type f | sort) - -if [[ ${#k9_files[@]} -eq 0 ]]; then - echo "::notice::No K9 files found in ${SCAN_PATH}" - echo "files_scanned=0" >> "$GITHUB_OUTPUT" 2>/dev/null || true - echo "errors=0" >> "$GITHUB_OUTPUT" 2>/dev/null || true - echo "warnings=0" >> "$GITHUB_OUTPUT" 2>/dev/null || true - echo "::endgroup::" - exit 0 -fi - -echo "Found ${#k9_files[@]} K9 file(s)" -echo "" - -for file in "${k9_files[@]}"; do - echo " Validating: ${file}" - validate_k9 "$file" -done - -echo "" -echo "────────────────────────────────────────" -echo "Files scanned: ${FILES_SCANNED}" -echo "Errors: ${ERRORS}" -echo "Warnings: ${WARNINGS}" -echo "Strict mode: ${STRICT}" -echo "────────────────────────────────────────" - -# Write outputs for GitHub Actions -{ - echo "files_scanned=${FILES_SCANNED}" - echo "errors=${ERRORS}" - echo "warnings=${WARNINGS}" -} >> "$GITHUB_OUTPUT" 2>/dev/null || true - -echo "::endgroup::" - -# Exit with failure if errors were found -if [[ $ERRORS -gt 0 ]]; then - echo "::error::K9 validation failed with ${ERRORS} error(s)" - exit 1 -fi - -echo "K9 validation passed." -exit 0 diff --git a/k9-svc/actions/validate/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/actions/validate/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/actions/validate/verification/README.adoc b/k9-svc/actions/validate/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/actions/validate/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/actions/validate/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/actions/validate/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/actions/validate/verification/benchmarks/README.adoc b/k9-svc/actions/validate/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/actions/validate/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/actions/validate/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/actions/validate/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/actions/validate/verification/coverage/README.adoc b/k9-svc/actions/validate/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/actions/validate/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/actions/validate/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/actions/validate/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/actions/validate/verification/fuzzing/README.adoc b/k9-svc/actions/validate/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/actions/validate/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/actions/validate/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/actions/validate/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/actions/validate/verification/proofs/README.adoc b/k9-svc/actions/validate/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/actions/validate/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/actions/validate/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/actions/validate/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/actions/validate/verification/safety_case/README.adoc b/k9-svc/actions/validate/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/actions/validate/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/actions/validate/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/actions/validate/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/actions/validate/verification/simulations/README.adoc b/k9-svc/actions/validate/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/actions/validate/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/actions/validate/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/actions/validate/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/actions/validate/verification/tests/README.adoc b/k9-svc/actions/validate/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/actions/validate/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/actions/validate/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/actions/validate/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/actions/validate/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/actions/validate/verification/traceability/README.adoc b/k9-svc/actions/validate/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/actions/validate/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/benchmarks/k9-bench.sh b/k9-svc/benchmarks/k9-bench.sh deleted file mode 100755 index 57e65689..00000000 --- a/k9-svc/benchmarks/k9-bench.sh +++ /dev/null @@ -1,382 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: MPL-2.0 -# K9-SVC Performance Benchmark Suite -# -# Comprehensive benchmarking of K9 components: -# - must script execution time -# - Nickel evaluation performance -# - k9-sign operations (keygen, sign, verify) -# - k9-scan static analysis -# - Just recipe execution - -set -euo pipefail - -VERSION="1.0.0" -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -OUTPUT_DIR="${SCRIPT_DIR}/results" -TIMESTAMP="$(date +%Y%m%d-%H%M%S)" -RESULT_FILE="${OUTPUT_DIR}/benchmark-${TIMESTAMP}.json" - -# Colors -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[0;34m' -NC='\033[0m' # No Color - -info() { echo -e "${BLUE}ℹ️ ${NC}$1"; } -success() { echo -e "${GREEN}✓${NC} $1"; } -warn() { echo -e "${YELLOW}⚠️ ${NC}$1"; } -error() { echo -e "${RED}❌ ${NC}$1" >&2; } - -# Benchmark result accumulator -BENCHMARK_RESULTS=() - -# Record a benchmark result -record_result() { - local name="$1" - local iterations="$2" - local total_time_ms="$3" - local avg_time_ms=$(echo "scale=2; $total_time_ms / $iterations" | bc) - - BENCHMARK_RESULTS+=("{\"name\":\"$name\",\"iterations\":$iterations,\"total_ms\":$total_time_ms,\"avg_ms\":$avg_time_ms}") - - info " $name: ${avg_time_ms}ms avg ($iterations iterations)" -} - -# Benchmark a command -benchmark_command() { - local name="$1" - local iterations="$2" - shift 2 - local cmd="$@" - - info "Benchmarking: $name ($iterations iterations)..." - - local start_ms=$(date +%s%3N) - for ((i=1; i<=iterations; i++)); do - eval "$cmd" >/dev/null 2>&1 || true - done - local end_ms=$(date +%s%3N) - - local total_time=$((end_ms - start_ms)) - record_result "$name" "$iterations" "$total_time" -} - -# Benchmark with varying input sizes -benchmark_scaling() { - local name="$1" - local base_cmd="$2" - local sizes=(10 100 1000 10000) - - info "Benchmarking scaling: $name" - - for size in "${sizes[@]}"; do - local cmd=$(echo "$base_cmd" | sed "s/SIZE/$size/g") - local iterations=10 - benchmark_command "${name}_${size}" "$iterations" "$cmd" - done -} - -# Create test files for benchmarking -create_test_files() { - info "Creating test files..." - - mkdir -p "${SCRIPT_DIR}/test-data" - - # Small K9 component (1KB) - cat > "${SCRIPT_DIR}/test-data/small.k9.ncl" <<'EOF' -K9! -leash = 'Kennel -pedigree = { schema_version = "1.0.0", component_type = "test" } -config = { value = 42 } -EOF - - # Medium K9 component (10KB) - cat > "${SCRIPT_DIR}/test-data/medium.k9.ncl" <<'EOF' -K9! -leash = 'Yard -pedigree = { schema_version = "1.0.0", component_type = "test" } -config = { - items | Array Number = std.array.generate (fun i => i) 1000, - validation = std.array.all (fun x => x >= 0) items, -} -EOF - - # Large K9 component (100KB) - generate programmatically - { - echo "K9!" - echo "leash = 'Yard" - echo "pedigree = { schema_version = \"1.0.0\", component_type = \"test\" }" - echo "config = {" - echo " large_array | Array Number = [" - for i in {1..10000}; do - echo " $i," - done - echo " ]," - echo "}" - } > "${SCRIPT_DIR}/test-data/large.k9.ncl" - - # Binary file for k9-sign benchmarks - dd if=/dev/urandom of="${SCRIPT_DIR}/test-data/binary-1kb.bin" bs=1024 count=1 2>/dev/null - dd if=/dev/urandom of="${SCRIPT_DIR}/test-data/binary-1mb.bin" bs=1048576 count=1 2>/dev/null - dd if=/dev/urandom of="${SCRIPT_DIR}/test-data/binary-10mb.bin" bs=1048576 count=10 2>/dev/null - - success "Test files created" -} - -# Benchmark 1: must script -benchmark_must() { - echo "" - info "═══ Benchmark 1: must script ═══" - - cd "$SCRIPT_DIR/.." - - benchmark_command "must_status" 100 "./must status" - benchmark_command "must_version" 100 "./must --version" - benchmark_command "must_help" 50 "./must --help" - - success "must benchmarks complete" -} - -# Benchmark 2: Nickel evaluation -benchmark_nickel() { - echo "" - info "═══ Benchmark 2: Nickel evaluation ═══" - - if ! command -v nickel >/dev/null 2>&1; then - warn "Nickel not found, skipping Nickel benchmarks" - return - fi - - cd "${SCRIPT_DIR}/test-data" - - benchmark_command "nickel_eval_small" 100 "nickel export <<< '{value = 42}'" - benchmark_command "nickel_eval_medium" 50 "nickel export small.k9.ncl" - benchmark_command "nickel_eval_large" 10 "nickel export medium.k9.ncl" - - success "Nickel benchmarks complete" -} - -# Benchmark 3: k9-sign operations -benchmark_k9_sign() { - echo "" - info "═══ Benchmark 3: k9-sign operations ═══" - - if ! command -v k9-sign >/dev/null 2>&1; then - warn "k9-sign not found, skipping k9-sign benchmarks" - return - fi - - cd "${SCRIPT_DIR}/test-data" - - # Keygen benchmark - info " Benchmarking keygen..." - local start_ms=$(date +%s%3N) - for i in {1..10}; do - k9-sign keygen "bench-key-$i" 2>/dev/null || true - done - local end_ms=$(date +%s%3N) - record_result "k9_sign_keygen" 10 $((end_ms - start_ms)) - - # Sign benchmarks (different file sizes) - k9-sign trust ~/.config/k9/keys/bench-key-1.pub 2>/dev/null || true - - benchmark_command "k9_sign_1kb" 100 "k9-sign sign binary-1kb.bin bench-key-1 2>/dev/null && rm -f binary-1kb.bin.sig" - benchmark_command "k9_sign_1mb" 50 "k9-sign sign binary-1mb.bin bench-key-1 2>/dev/null && rm -f binary-1mb.bin.sig" - benchmark_command "k9_sign_10mb" 10 "k9-sign sign binary-10mb.bin bench-key-1 2>/dev/null && rm -f binary-10mb.bin.sig" - - # Verify benchmarks - k9-sign sign binary-1kb.bin bench-key-1 2>/dev/null - k9-sign sign binary-1mb.bin bench-key-1 2>/dev/null - k9-sign sign binary-10mb.bin bench-key-1 2>/dev/null - - benchmark_command "k9_verify_1kb" 100 "k9-sign verify binary-1kb.bin 2>/dev/null" - benchmark_command "k9_verify_1mb" 50 "k9-sign verify binary-1mb.bin 2>/dev/null" - benchmark_command "k9_verify_10mb" 10 "k9-sign verify binary-10mb.bin 2>/dev/null" - - # Cleanup - rm -f ~/.config/k9/keys/bench-key-*.{key,pub} - - success "k9-sign benchmarks complete" -} - -# Benchmark 4: k9-scan static analysis -benchmark_k9_scan() { - echo "" - info "═══ Benchmark 4: k9-scan static analysis ═══" - - cd "$SCRIPT_DIR/.." - - if [ ! -f "./k9-scan" ]; then - warn "k9-scan not found, skipping k9-scan benchmarks" - return - fi - - benchmark_command "k9_scan_small" 50 "./k9-scan benchmarks/test-data/small.k9.ncl" - benchmark_command "k9_scan_medium" 20 "./k9-scan benchmarks/test-data/medium.k9.ncl" - benchmark_command "k9_scan_examples" 20 "./k9-scan examples/hello.k9.ncl" - - success "k9-scan benchmarks complete" -} - -# Benchmark 5: Just recipe execution -benchmark_just() { - echo "" - info "═══ Benchmark 5: Just recipe execution ═══" - - if ! command -v just >/dev/null 2>&1; then - warn "just not found, skipping just benchmarks" - return - fi - - cd "$SCRIPT_DIR/.." - - benchmark_command "just_list" 50 "just --list" - benchmark_command "just_summary" 50 "just --summary" - - success "Just benchmarks complete" -} - -# Generate performance report -generate_report() { - echo "" - info "═══ Generating Performance Report ═══" - - mkdir -p "$OUTPUT_DIR" - - # JSON report - cat > "$RESULT_FILE" < "$md_file" <> "$md_file" - done - - cat >> "$md_file" </dev/null 2>&1 || true - done - local end=$(date +%s%3N) - - local total=$((end - start)) - local avg=$(echo "scale=2; $total / $iterations" | bc) - - printf "%-40s %6s ms/op (%d iterations)\n" "$desc" "$avg" "$iterations" -} - -echo "╔══════════════════════════════════════════════════════════╗" -echo "║ K9-SVC Quick Performance Benchmark ║" -echo "╚══════════════════════════════════════════════════════════╝" -echo "" - -cd "$K9_ROOT" - -# Benchmark 1: must script -echo "Must Script:" -time_command " must status" 50 "./must status" -time_command " must --version" 50 "./must --version" -time_command " must --help" 20 "./must --help" -echo "" - -# Benchmark 2: k9-scan (if exists) -if [ -f "./k9-scan" ]; then - echo "K9-Scan:" - time_command " k9-scan (small file)" 20 "./k9-scan examples/hello.k9.ncl" - echo "" -fi - -# Benchmark 3: k9-sign (if installed) -if command -v k9-sign >/dev/null 2>&1; then - echo "K9-Sign:" - - # Create test file - dd if=/dev/urandom of=/tmp/k9-test-1kb.bin bs=1024 count=1 2>/dev/null - - # Generate test key if needed - if [ ! -f ~/.config/k9/keys/perf-test.key ]; then - k9-sign keygen perf-test 2>/dev/null - fi - - k9-sign trust ~/.config/k9/keys/perf-test.pub 2>/dev/null - - time_command " k9-sign keygen" 10 "k9-sign keygen temp-key-\$RANDOM 2>/dev/null && rm -f ~/.config/k9/keys/temp-key-*.{key,pub}" - time_command " k9-sign sign (1KB)" 50 "k9-sign sign /tmp/k9-test-1kb.bin perf-test 2>/dev/null && rm -f /tmp/k9-test-1kb.bin.sig" - - # Sign once for verify test - k9-sign sign /tmp/k9-test-1kb.bin perf-test 2>/dev/null - time_command " k9-sign verify (1KB)" 50 "k9-sign verify /tmp/k9-test-1kb.bin 2>/dev/null" - - # Cleanup - rm -f /tmp/k9-test-1kb.bin /tmp/k9-test-1kb.bin.sig - echo "" -fi - -echo "╔══════════════════════════════════════════════════════════╗" -echo "║ ✅ Quick Benchmark Complete ║" -echo "╚══════════════════════════════════════════════════════════╝" diff --git a/k9-svc/bindings/README.adoc b/k9-svc/bindings/README.adoc deleted file mode 100644 index 44585657..00000000 --- a/k9-svc/bindings/README.adoc +++ /dev/null @@ -1,192 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -= K9 Language Bindings -:author: Jonathan D.A. Jewell -:revdate: 2026-03-17 -:toc: preamble -:icons: font - -Official language bindings for parsing and rendering -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9 Self-Validating Component] -specifications. Each binding provides a typed AST, parser, and renderer for the -K9 format -- the security-tiered configuration language built on Nickel contracts. - -== Feature Matrix - -[cols="1,1,1,1,1,1"] -|=== -| Feature | Deno (ReScript) | Rust | Gleam | Elixir | Haskell - -| Parse `.k9` (YAML-like) -| Yes -| Yes -| Yes -| Yes -| Yes - -| Parse `.k9.ncl` (Nickel) -| Yes -| Yes -| Yes -| Yes -| Yes - -| Render to K9 -| Yes -| Yes -| Yes -| Yes -| Yes - -| Typed AST -| Yes -| Yes (serde) -| Yes -| Yes (structs) -| Yes (ADTs) - -| Security levels -| Kennel/Yard/Hunt -| Kennel/Yard/Hunt -| Kennel/Yard/Hunt -| Kennel/Yard/Hunt -| Kennel/Yard/Hunt - -| Contracts support -| Yes -| Yes -| Yes -| Yes -| Yes - -| Round-trip fidelity -| Partial -| Partial -| Partial -| Partial -| YAML only - -| Package registry -| https://jsr.io/@hyperpolymath/k9[JSR] -| https://crates.io/crates/k9-svc[crates.io] -| https://hex.pm/packages/k9_gleam[Hex.pm] -| https://hex.pm/packages/k9_ex[Hex.pm] -| https://hackage.haskell.org/package/k9[Hackage] - -| License -| PMPL-1.0-or-later -| MPL-2.0 -| MPL-2.0 -| MPL-2.0 -| MPL-2.0 -|=== - -NOTE: Gleam, Elixir, Rust, and Haskell bindings use MPL-2.0 as a fallback because -their respective package registries (Hex.pm, crates.io, Hackage) require -OSI-approved licenses. PMPL-1.0-or-later is the preferred license. - -== Quick Install - -=== Deno (ReScript) - -The primary binding, built with ReScript and published to JSR. - -[source,sh] ----- -deno add @hyperpolymath/k9 ----- - -=== Rust - -[source,sh] ----- -cargo add k9-svc ----- - -=== Gleam - -[source,sh] ----- -gleam add k9_gleam ----- - -=== Elixir - -Add to `mix.exs`: - -[source,elixir] ----- -defp deps do - [{:k9_ex, "~> 0.1.0"}] -end ----- - -=== Haskell - -[source,sh] ----- -cabal install k9 ----- - -Or add to your `.cabal` file: - -[source,cabal] ----- -build-depends: k9 >= 0.1 && < 0.2 ----- - -== Shared API Surface - -All bindings expose the same conceptual API: - -`parse(input)`:: - Parse a K9 string (`.k9` or `.k9.ncl`) into a typed `Component` AST. - -`render(component)`:: - Render a `Component` AST back to K9 surface syntax. - -The `Component` type in every binding contains: - -* *Pedigree* -- name, version, description, author, SPDX license -* *SecurityPolicy* -- trust level (Kennel/Yard/Hunt) and permission flags - (network, filesystem write, subprocess) -* *Target* -- OS, edge mode, Podman requirement, memory constraint -* *Recipes* -- install, validate, deploy, migrate, and custom recipes -* *Validation* -- checksum, pedigree version, hunt authorisation flag -* *Contracts* -- contractile clauses (must/trust/dust/intend/k9) - -== Security Levels - -K9 uses a "leash" metaphor for trust tiers: - -Kennel:: - Pure data. No code execution. Safe to open anywhere. -Yard:: - Controlled execution with Nickel contract evaluation. Limited permissions. -Hunt:: - Full execution with shell commands. Requires explicit signature/authorisation. - -== Directory Layout - -[source] ----- -bindings/ - deno/ # @hyperpolymath/k9 — ReScript on Deno - rust/ # k9-svc crate - gleam/ # k9_gleam package - elixir/ # k9_ex package - haskell/ # k9 library ----- - -== Part of the K9 Ecosystem - -These bindings are part of the -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9 Self-Validating Components] -suite within the `standards` monorepo. Related tools: - -* link:../actions/validate/[`actions/validate`] -- GitHub Action for CI validation -* link:../pandoc/[`pandoc`] -- Pandoc reader, writer, and filter -* link:../editors/vscode/[`editors/vscode`] -- VS Code extension -* link:../SPEC.adoc[`SPEC.adoc`] -- K9 format specification -* link:../pedigree.ncl[`pedigree.ncl`] -- Nickel contract schema diff --git a/k9-svc/bindings/deno/.devcontainer/Containerfile b/k9-svc/bindings/deno/.devcontainer/Containerfile deleted file mode 100644 index b0a6fd1b..00000000 --- a/k9-svc/bindings/deno/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Dev Container image for {{PROJECT_NAME}} -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/{{PROJECT_NAME}} - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/bindings/deno/.devcontainer/README.adoc b/k9-svc/bindings/deno/.devcontainer/README.adoc deleted file mode 100644 index 3bfb50e5..00000000 --- a/k9-svc/bindings/deno/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}> - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/bindings/deno/.devcontainer/devcontainer.json b/k9-svc/bindings/deno/.devcontainer/devcontainer.json deleted file mode 100644 index a4b33e0a..00000000 --- a/k9-svc/bindings/deno/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -// -// Dev Container configuration for {{PROJECT_NAME}} -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "{{PROJECT_NAME}}", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/bindings/deno/.editorconfig b/k9-svc/bindings/deno/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/bindings/deno/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/bindings/deno/.envrc b/k9-svc/bindings/deno/.envrc deleted file mode 100644 index 4ca685b4..00000000 --- a/k9-svc/bindings/deno/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/bindings/deno/.gitattributes b/k9-svc/bindings/deno/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/bindings/deno/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/bindings/deno/.github/.mailmap b/k9-svc/bindings/deno/.github/.mailmap deleted file mode 100644 index 0ada9de5..00000000 --- a/k9-svc/bindings/deno/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}> diff --git a/k9-svc/bindings/deno/.github/.nojekyll b/k9-svc/bindings/deno/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/bindings/deno/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/bindings/deno/.github/CODEOWNERS b/k9-svc/bindings/deno/.github/CODEOWNERS deleted file mode 100644 index 611b5a84..00000000 --- a/k9-svc/bindings/deno/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace {{OWNER}} with your GitHub username or team - -# Default owners for everything -* @{{OWNER}} - -# Security-sensitive files require explicit review -SECURITY.md @{{OWNER}} -.github/workflows/ @{{OWNER}} -Trustfile.a2ml @{{OWNER}} -.machine_readable/ @{{OWNER}} diff --git a/k9-svc/bindings/deno/.github/CODE_OF_CONDUCT.md b/k9-svc/bindings/deno/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index 2777a724..00000000 --- a/k9-svc/bindings/deno/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in {{PROJECT_NAME}} a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://{{FORGE}}/{{OWNER}}/{{REPO}}/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: {{CURRENT_YEAR}} · Based on Contributor Covenant 2.1 diff --git a/k9-svc/bindings/deno/.github/CONTRIBUTING.md b/k9-svc/bindings/deno/.github/CONTRIBUTING.md deleted file mode 100644 index 02758c67..00000000 --- a/k9-svc/bindings/deno/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://{{FORGE}}/{{OWNER}}/{{REPO}}.git -cd {{REPO}} - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create {{REPO}}-dev -toolbox enter {{REPO}}-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -{{REPO}}/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `{{MAIN_BRANCH}}` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/help%20wanted) — Community help needed -- [`documentation`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/documentation) — Docs improvements -- [`perimeter-3`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/bindings/deno/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/bindings/deno/.github/FUNDING.yml b/k9-svc/bindings/deno/.github/FUNDING.yml deleted file mode 100644 index c078261e..00000000 --- a/k9-svc/bindings/deno/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for {{OWNER}} projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: {{OWNER}} -ko_fi: {{OWNER}} -liberapay: {{OWNER}} diff --git a/k9-svc/bindings/deno/.github/GOVERNANCE.md b/k9-svc/bindings/deno/.github/GOVERNANCE.md deleted file mode 100644 index fcbcec0c..00000000 --- a/k9-svc/bindings/deno/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **{{PROJECT_NAME}}**. - ---- - -## Project Governance Model - -{{PROJECT_NAME}} follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) {{CURRENT_YEAR}} {{OWNER}}. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index ec2aa283..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for {{OWNER}}/{{REPO}} -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index cb7a33cb..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for {{OWNER}}/{{REPO}} -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/{{OWNER}}/{{REPO}}/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 6aa9e631..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for {{OWNER}}/{{REPO}} -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 88e07205..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for {{OWNER}}/{{REPO}} -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 6d88090c..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for {{OWNER}}/{{REPO}} -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index 48bb574e..00000000 --- a/k9-svc/bindings/deno/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for {{OWNER}}/{{REPO}} -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/bindings/deno/.github/MAINTAINERS b/k9-svc/bindings/deno/.github/MAINTAINERS deleted file mode 100644 index 145c4e96..00000000 --- a/k9-svc/bindings/deno/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -{{AUTHOR}} <{{AUTHOR_EMAIL}}> (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/bindings/deno/.github/README.adoc b/k9-svc/bindings/deno/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/bindings/deno/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/bindings/deno/.github/SECURITY.md b/k9-svc/bindings/deno/.github/SECURITY.md deleted file mode 100644 index 7dd7b29e..00000000 --- a/k9-svc/bindings/deno/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`{{OWNER}}/{{REPO}}`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using {{PROJECT_NAME}}, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ - ---- - -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 diff --git a/k9-svc/bindings/deno/.github/SUPPORT b/k9-svc/bindings/deno/.github/SUPPORT deleted file mode 100644 index b06c59a3..00000000 --- a/k9-svc/bindings/deno/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/{{OWNER}}/{{REPO}}/discussions -- GitHub Issues: https://github.com/{{OWNER}}/{{REPO}}/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/bindings/deno/.github/copilot-instructions.md b/k9-svc/bindings/deno/.github/copilot-instructions.md deleted file mode 100644 index 6b44aec8..00000000 --- a/k9-svc/bindings/deno/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/bindings/deno/.github/dependabot.yml b/k9-svc/bindings/deno/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/bindings/deno/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/bindings/deno/.github/pull_request_template.md b/k9-svc/bindings/deno/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/bindings/deno/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/bindings/deno/.github/workflows/codeql.yml b/k9-svc/bindings/deno/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/bindings/deno/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/bindings/deno/.github/workflows/governance.yml b/k9-svc/bindings/deno/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/bindings/deno/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/bindings/deno/.github/workflows/hypatia-scan.yml b/k9-svc/bindings/deno/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/bindings/deno/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/deno/.github/workflows/jekyll.yml b/k9-svc/bindings/deno/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/bindings/deno/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/bindings/deno/.github/workflows/mirror.yml b/k9-svc/bindings/deno/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/bindings/deno/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/deno/.github/workflows/release.yml b/k9-svc/bindings/deno/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/bindings/deno/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/bindings/deno/.github/workflows/rhodibot.yml b/k9-svc/bindings/deno/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/bindings/deno/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/bindings/deno/.github/workflows/scorecard-enforcer.yml b/k9-svc/bindings/deno/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/bindings/deno/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/bindings/deno/.github/workflows/scorecard.yml b/k9-svc/bindings/deno/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/bindings/deno/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/deno/.github/workflows/secret-scanner.yml b/k9-svc/bindings/deno/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/bindings/deno/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/deno/.github/workflows/static-analysis-gate.yml b/k9-svc/bindings/deno/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/bindings/deno/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/bindings/deno/.gitignore b/k9-svc/bindings/deno/.gitignore deleted file mode 100644 index 130c2b10..00000000 --- a/k9-svc/bindings/deno/.gitignore +++ /dev/null @@ -1,109 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock -src/*.res.mjs - -# Deno -deno.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/bindings/deno/.gitlab-ci.yml b/k9-svc/bindings/deno/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/bindings/deno/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/bindings/deno/.guix-channel b/k9-svc/bindings/deno/.guix-channel deleted file mode 100644 index f9bdf68f..00000000 --- a/k9-svc/bindings/deno/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -;; -;; Guix channel definition for {{PROJECT_NAME}} -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name '{{PROJECT_NAME}}) -;; (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/bindings/deno/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/bindings/deno/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/bindings/deno/.machine_readable/CLADE.a2ml b/k9-svc/bindings/deno/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/bindings/deno/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/bindings/deno/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/bindings/deno/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index 1384822c..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "{{PROJECT_NAME}} Development" -# description = "Panels for {{PROJECT_NAME}} development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/bindings/deno/.machine_readable/README.adoc b/k9-svc/bindings/deno/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/bindings/deno/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/bindings/deno/.machine_readable/ai/.clinerules b/k9-svc/bindings/deno/.machine_readable/ai/.clinerules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/.cursorrules b/k9-svc/bindings/deno/.machine_readable/ai/.cursorrules deleted file mode 100644 index d3b9cee0..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/.windsurfrules b/k9-svc/bindings/deno/.machine_readable/ai/.windsurfrules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/AI.a2ml b/k9-svc/bindings/deno/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/bindings/deno/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index a1382f4f..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .) -sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .) -sed -i 's/{{OWNER}}/my-org/g' $(grep -rl '{{OWNER}}' .) -sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/{{REPO}}/my-project/g' $(grep -rl '{{REPO}}' .) -sed -i 's/{{FORGE}}/github.com/g' $(grep -rl '{{FORGE}}' .) -sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .) -sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `{{REPO}}` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `{{OWNER}}` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `{{FORGE}}` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md | -| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{LICENSE}}` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/bindings/deno/.machine_readable/ai/README.adoc b/k9-svc/bindings/deno/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/bindings/deno/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/bindings/deno/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/bindings/deno/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/bindings/deno/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/bindings/deno/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index 87238998..00000000 --- a/k9-svc/bindings/deno/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "{{OWNER}}/{{REPO}}" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "{{PROJECT_NAME}}" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "{{PROJECT_PURPOSE}}" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/bindings/deno/.machine_readable/anchors/README.adoc b/k9-svc/bindings/deno/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/bindings/deno/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/bindings/deno/.machine_readable/compliance/reuse/dep5 b/k9-svc/bindings/deno/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 3f5b2ef6..00000000 --- a/k9-svc/bindings/deno/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: {{PROJECT_NAME}} -Upstream-Contact: {{AUTHOR}} <{{AUTHOR_EMAIL}}> -Source: https://github.com/{{OWNER}}/{{REPO}} - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/bindings/deno/.machine_readable/compliance/rust/deny.toml b/k9-svc/bindings/deno/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/bindings/deno/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/bindings/deno/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/bindings/deno/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/bindings/deno/.machine_readable/configs/README.adoc b/k9-svc/bindings/deno/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/bindings/deno/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/bindings/deno/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/bindings/deno/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index 5c39b484..00000000 --- a/k9-svc/bindings/deno/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# {{OWNER}} — GitHub organization or username -# {{REPO}} — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/bindings/deno/.machine_readable/contractiles/README.adoc b/k9-svc/bindings/deno/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/bindings/deno/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/bindings/deno/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/deno/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/bindings/deno/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/bindings/deno/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/deno/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/bindings/deno/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/bindings/deno/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/deno/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/bindings/deno/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 4d5db884..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 42a2cd75..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project] -name = "deno" -purpose = "" # TODO: describe project purpose -role = "" # TODO: describe project role # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/META.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index d9b09e68..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -type = "library" # TODO: update type (library|binary|service|website|monorepo) # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 1acf7a30..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index 6408e1c7..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/bindings/deno/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/bindings/deno/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index a76d8dd6..00000000 --- a/k9-svc/bindings/deno/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "rsr-template-repo" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "rsr-template-repo" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/bindings/deno/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/bindings/deno/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/bindings/deno/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index eeffd278..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/deno/.machine_readable/policies/README.adoc b/k9-svc/bindings/deno/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/bindings/deno/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/deno/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/deno/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/forge/README.adoc b/k9-svc/bindings/deno/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/bindings/deno/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/bindings/deno/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/bindings/deno/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/bindings/deno/.machine_readable/scripts/verification/README.adoc b/k9-svc/bindings/deno/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/bindings/deno/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/bindings/deno/.tool-versions b/k9-svc/bindings/deno/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/bindings/deno/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/bindings/deno/.well-known/ai.txt b/k9-svc/bindings/deno/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/bindings/deno/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/bindings/deno/.well-known/humans.txt b/k9-svc/bindings/deno/.well-known/humans.txt deleted file mode 100644 index 8891981a..00000000 --- a/k9-svc/bindings/deno/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: {{AUTHOR}} ({{OWNER}}) -Contact: {{AUTHOR_EMAIL}} -From: United Kingdom - -/* SITE */ -Last update: {{CURRENT_DATE}} -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/bindings/deno/.well-known/security.txt b/k9-svc/bindings/deno/.well-known/security.txt deleted file mode 100644 index 5414d508..00000000 --- a/k9-svc/bindings/deno/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:{{SECURITY_EMAIL}} -Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt -Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md -Hiring: https://{{WEBSITE}}/careers diff --git a/k9-svc/bindings/deno/0-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/0-AI-MANIFEST.a2ml deleted file mode 100644 index 5929fc89..00000000 --- a/k9-svc/bindings/deno/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **k9-deno**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "{{AUTHOR}} <{{AUTHOR_EMAIL}}>" -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -k9-deno/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/bindings/deno/CHANGELOG.adoc b/k9-svc/bindings/deno/CHANGELOG.adoc deleted file mode 100644 index ca1c6528..00000000 --- a/k9-svc/bindings/deno/CHANGELOG.adoc +++ /dev/null @@ -1,9 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [Unreleased] diff --git a/k9-svc/bindings/deno/CONTRIBUTING.adoc b/k9-svc/bindings/deno/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/bindings/deno/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/bindings/deno/Containerfile b/k9-svc/bindings/deno/Containerfile deleted file mode 100644 index d7266bc0..00000000 --- a/k9-svc/bindings/deno/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Containerfile for {{PROJECT_NAME}} -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/bindings/deno/Justfile b/k9-svc/bindings/deno/Justfile deleted file mode 100644 index 9d7a5ff4..00000000 --- a/k9-svc/bindings/deno/Justfile +++ /dev/null @@ -1,910 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "{{PROJECT_NAME}}" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/bindings/deno/LICENSE b/k9-svc/bindings/deno/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/bindings/deno/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/bindings/deno/README.adoc b/k9-svc/bindings/deno/README.adoc deleted file mode 100644 index 0298256f..00000000 --- a/k9-svc/bindings/deno/README.adoc +++ /dev/null @@ -1,159 +0,0 @@ -= k9-deno -:toc: preamble -:icons: font - -== Overview - -**Deno-native parser library for K9 (Self-Validating Components), written in ReScript.** - -K9 is a specification format for self-validating software components with -built-in pedigree metadata, security levels (Kennel/Yard/Hunt), target -platform constraints, lifecycle recipes, and deployment contracts. This -library provides a complete parser and renderer for .k9 specification files, -compiled from ReScript to JavaScript ES modules for use with Deno. - -== Features - -* Parse K9 component specifications from strings or files -* Render AST back to .k9 YAML-like format (round-trip support) -* Security level hierarchy: Kennel (pure data), Yard (controlled), Hunt (full execution) -* Pedigree metadata with provenance tracking -* Target platform constraints (OS, edge, Podman, memory) -* Lifecycle recipes (install, validate, deploy, migrate, custom) -* Self-validation blocks (checksum, pedigree version) -* Format detection (YAML-like .k9 vs Nickel .k9.ncl) -* Zero dependencies beyond ReScript standard library - -== Quick Start - -[source,bash] ----- -# Build ReScript to JS -deno task build - -# Use in your Deno project -deno add jsr:@hyperpolymath/k9 ----- - -[source,javascript] ----- -import { parse, render, parseErrorToString } from "@hyperpolymath/k9"; - -const result = parse(`K9! ---- -metadata: - name: hello-k9 - version: 0.1.0 - description: A simple K9 component -security: - trust_level: 'Kennel - allow_network: false - allow_filesystem_write: false - allow_subprocess: false -`); -// result is Ok(component) or Error(parseError) ----- - -== Module Structure - -[cols="1,3"] -|=== -| Module | Purpose - -| `K9.res` -| Main module — re-exports all public API - -| `K9_Types.res` -| Core data types: component, pedigree, securityLevel, target, recipes, validation, contract - -| `K9_Parser.res` -| Line-oriented parser: .k9 text to typed AST - -| `K9_Renderer.res` -| Renderer: typed AST back to .k9 text -|=== - -== K9 Format Reference - -[source,yaml] ----- -K9! ---- -metadata: - name: my-component - version: 1.0.0 - description: A self-validating component - author: Jonathan D.A. Jewell - license: PMPL-1.0-or-later - -security: - trust_level: 'Yard - allow_network: true - allow_filesystem_write: false - allow_subprocess: false - -target: - os: Linux - is_edge: false - requires_podman: true - memory: 512M - -recipes: - install: deno install - validate: deno task test - deploy: deno task deploy - -validation: - checksum: sha256:abc123... - pedigree_version: 1.0 - hunt_authorized: false - -tags: - - deno - - rescript - - parser ----- - -=== Security Levels - -[cols="1,2,3"] -|=== -| Level | Permissions | Use Case - -| `'Kennel` -| No execution, no network, no filesystem, no subprocess -| Pure data, configuration, static assets - -| `'Yard` -| Controlled execution, network allowed -| Services, APIs, constrained tools - -| `'Hunt` -| Full execution, all permissions -| Build tools, deployment scripts, system administration -|=== - -== Development - -[source,bash] ----- -deno task build # Compile ReScript -deno task clean # Clean build artifacts -deno task test # Run tests ----- - -== Related Libraries - -* link:https://github.com/hyperpolymath/k9-rs[k9-rs] — Rust implementation -* link:https://github.com/hyperpolymath/k9-haskell[k9-haskell] — Haskell implementation -* link:https://github.com/hyperpolymath/k9_gleam[k9_gleam] — Gleam implementation -* link:https://github.com/hyperpolymath/tree-sitter-k9[tree-sitter-k9] — Tree-sitter grammar -* link:https://github.com/hyperpolymath/vscode-k9[vscode-k9] — VS Code extension - -== License - -SPDX-License-Identifier: MPL-2.0 - -Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -See link:LICENSE[LICENSE] for details. diff --git a/k9-svc/bindings/deno/ROADMAP.adoc b/k9-svc/bindings/deno/ROADMAP.adoc deleted file mode 100644 index 4693e6b7..00000000 --- a/k9-svc/bindings/deno/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Deno Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/bindings/deno/SECURITY.adoc b/k9-svc/bindings/deno/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/bindings/deno/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/bindings/deno/container/.gatekeeper.yaml b/k9-svc/bindings/deno/container/.gatekeeper.yaml deleted file mode 120000 index 87731df3..00000000 --- a/k9-svc/bindings/deno/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/k9-svc/bindings/deno/container/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/bindings/deno/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/bindings/deno/container/Containerfile b/k9-svc/bindings/deno/container/Containerfile deleted file mode 100644 index ba85260a..00000000 --- a/k9-svc/bindings/deno/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t {{SERVICE_NAME}}:latest -f container/Containerfile . -# -# Run: -# podman run -p {{PORT}}:{{PORT}} {{SERVICE_NAME}}:latest -# -# Run with persistent volume: -# podman run -p {{PORT}}:{{PORT}} -v {{SERVICE_NAME}}-data:/data {{SERVICE_NAME}}:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/{{SERVICE_NAME}} -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/{{SERVICE_NAME}}/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/{{SERVICE_NAME}} -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ - org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ - org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} -# COPY --from=builder /build/_build/prod/rel/{{SERVICE_NAME}} /app/release/ -# COPY --from=builder /build/zig-out/bin/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT={{PORT}} -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE {{PORT}} - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/deno/container/README.adoc b/k9-svc/bindings/deno/container/README.adoc deleted file mode 100644 index 9f7f7f05..00000000 --- a/k9-svc/bindings/deno/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -= {{PROJECT_NAME}} Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/bindings/deno/container/compose.example.toml b/k9-svc/bindings/deno/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/bindings/deno/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/deno/container/compose.toml b/k9-svc/bindings/deno/container/compose.toml deleted file mode 100644 index a14f8a00..00000000 --- a/k9-svc/bindings/deno/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f {{SERVICE_NAME}} # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.{{SERVICE_NAME}}] -image = "{{REGISTRY}}/{{SERVICE_NAME}}:latest.ctp" -ports = ["{{PORT}}:{{PORT}}"] -environment = { - APP_HOST = "[::]", - APP_PORT = "{{PORT}}", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["{{SERVICE_NAME}}-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:{{PORT}}/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://{{SERVICE_NAME}}:{{PORT}}", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["{{SERVICE_NAME}}"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.{{SERVICE_NAME}}-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/deno/container/ct-build.sh b/k9-svc/bindings/deno/container/ct-build.sh deleted file mode 100755 index a54a5418..00000000 --- a/k9-svc/bindings/deno/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: {{SERVICE_NAME}}-release) -# CT_REGISTRY — OCI registry to push to (default: {{REGISTRY}}) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-{{SERVICE_NAME}}-release}" -CT_REGISTRY="${CT_REGISTRY:-{{REGISTRY}}}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="{{SERVICE_NAME}}" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/bindings/deno/container/deploy.k9.ncl b/k9-svc/bindings/deno/container/deploy.k9.ncl deleted file mode 100644 index 0ad0d04a..00000000 --- a/k9-svc/bindings/deno/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "{{SERVICE_NAME}}-deploy", - version = "{{VERSION}}", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "{{REGISTRY}}/{{SERVICE_NAME}}", - port = {{PORT}}, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for {{SERVICE_NAME}}..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying {{SERVICE_NAME}} to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back {{SERVICE_NAME}} deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/bindings/deno/container/entrypoint.sh b/k9-svc/bindings/deno/container/entrypoint.sh deleted file mode 100755 index a7a03699..00000000 --- a/k9-svc/bindings/deno/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping {{SERVICE_NAME}}..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting {{SERVICE_NAME}}..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-{{PORT}}}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/{{SERVICE_NAME}} -# exec /app/release/bin/{{SERVICE_NAME}} start -# exec /app/{{SERVICE_NAME}} serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/bindings/deno/container/manifest.toml b/k9-svc/bindings/deno/container/manifest.toml deleted file mode 100644 index f55fcb3a..00000000 --- a/k9-svc/bindings/deno/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" -revision = 1 -summary = "{{PROJECT_DESCRIPTION}}" -description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" - -[provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "{{PORT}}" - -[outputs] -primary = "{{SERVICE_NAME}}" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [{{PORT}}] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/deno/container/vordr.toml b/k9-svc/bindings/deno/container/vordr.toml deleted file mode 100644 index af38fc54..00000000 --- a/k9-svc/bindings/deno/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:{{PORT}}/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:{{PORT}}/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/{{SERVICE_NAME}}.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "{{EMAIL}}" -# from = "vordr@{{SERVICE_NAME}}.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/bindings/deno/contractile.just b/k9-svc/bindings/deno/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/bindings/deno/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/bindings/deno/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/bindings/deno/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/bindings/deno/docs/QUICKSTART.adoc b/k9-svc/bindings/deno/docs/QUICKSTART.adoc deleted file mode 100644 index d97c31ec..00000000 --- a/k9-svc/bindings/deno/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/{{OWNER}}/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/bindings/deno/docs/README.adoc b/k9-svc/bindings/deno/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/bindings/deno/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/bindings/deno/docs/RSR_OUTLINE.adoc b/k9-svc/bindings/deno/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/bindings/deno/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/bindings/deno/docs/STATE-VISUALIZER.adoc b/k9-svc/bindings/deno/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/bindings/deno/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/bindings/deno/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/bindings/deno/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/bindings/deno/docs/architecture/THREAT-MODEL.adoc b/k9-svc/bindings/deno/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index df5e0380..00000000 --- a/k9-svc/bindings/deno/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: {{PROJECT_NAME}} - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | {{PROJECT_NAME}} | -| Version | 1.0 | -| Last Reviewed | {{DATE}} | -| Author | {{AUTHOR}} | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of {{PROJECT_NAME}} and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/bindings/deno/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/bindings/deno/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/bindings/deno/docs/attribution/CITATION.cff b/k9-svc/bindings/deno/docs/attribution/CITATION.cff deleted file mode 100644 index 4d562f43..00000000 --- a/k9-svc/bindings/deno/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "{{AUTHOR_LAST}}" - given-names: "{{AUTHOR_FIRST}}" - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "{{PROJECT_NAME}}" -version: 0.1.0 -date-released: {{CURRENT_DATE}} -url: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -repository-code: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/bindings/deno/docs/attribution/CITATIONS.adoc b/k9-svc/bindings/deno/docs/attribution/CITATIONS.adoc deleted file mode 100644 index eeee45fb..00000000 --- a/k9-svc/bindings/deno/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= {{PROJECT_NAME}} - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{{{PROJECT_NAME}}_{{CURRENT_YEAR}}, - author = {{{AUTHOR_LAST}}, {{AUTHOR_FIRST}}}, - title = {{{PROJECT_NAME}}}, - year = {{{CURRENT_YEAR}}}, - url = {https://github.com/{{OWNER}}/{{PROJECT_NAME}}}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}) _{{PROJECT_NAME}}_ [Computer software]. Available at: https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== OSCOLA - -{{AUTHOR}}, '{{PROJECT_NAME}}' ({{CURRENT_YEAR}}) - -== MLA - -{{AUTHOR_LAST}}, {{AUTHOR_FIRST}} "{{PROJECT_NAME}}." {{CURRENT_YEAR}}, github.com/{{OWNER}}/{{PROJECT_NAME}}. - -== APA 7 - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}). _{{PROJECT_NAME}}_ [Computer software]. GitHub. https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/bindings/deno/docs/attribution/CODEOWNERS.adoc b/k9-svc/bindings/deno/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/bindings/deno/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/bindings/deno/docs/attribution/MAINTAINERS.adoc b/k9-svc/bindings/deno/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index d829dd95..00000000 --- a/k9-svc/bindings/deno/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| {{AUTHOR}} -| Lead Maintainer -| https://github.com/{{OWNER}}[@{{OWNER}}] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/bindings/deno/docs/attribution/README.adoc b/k9-svc/bindings/deno/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/bindings/deno/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/bindings/deno/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/bindings/deno/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/bindings/deno/docs/decisions/0000-template.adoc b/k9-svc/bindings/deno/docs/decisions/0000-template.adoc deleted file mode 100644 index 763eab1e..00000000 --- a/k9-svc/bindings/deno/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/bindings/deno/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/bindings/deno/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 85f414be..00000000 --- a/k9-svc/bindings/deno/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/{{OWNER}}/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/bindings/deno/docs/decisions/README.adoc b/k9-svc/bindings/deno/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/bindings/deno/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/bindings/deno/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/bindings/deno/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/bindings/deno/docs/developer/ABI-FFI-README.adoc b/k9-svc/bindings/deno/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index 65d2afe1..00000000 --- a/k9-svc/bindings/deno/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -{{LICENSE}} - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/{{OWNER}}/rhodium-standard-repositories) diff --git a/k9-svc/bindings/deno/docs/developer/README.adoc b/k9-svc/bindings/deno/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/bindings/deno/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/bindings/deno/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/bindings/deno/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.adoc b/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/bindings/deno/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/bindings/deno/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/bindings/deno/docs/governance/README.adoc b/k9-svc/bindings/deno/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/bindings/deno/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/bindings/deno/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/bindings/deno/docs/governance/TSDM.a2ml b/k9-svc/bindings/deno/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/bindings/deno/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/bindings/deno/docs/governance/TSDM.adoc b/k9-svc/bindings/deno/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/bindings/deno/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/bindings/deno/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/bindings/deno/docs/governance/audit/README.adoc b/k9-svc/bindings/deno/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/bindings/deno/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/bindings/deno/docs/governance/audit/compliance/README.adoc b/k9-svc/bindings/deno/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/bindings/deno/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/bindings/deno/docs/governance/audit/effects/README.adoc b/k9-svc/bindings/deno/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/bindings/deno/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/bindings/deno/docs/governance/audit/systems/README.adoc b/k9-svc/bindings/deno/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/bindings/deno/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/README.adoc b/k9-svc/bindings/deno/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/corrective/README.adoc b/k9-svc/bindings/deno/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/bindings/deno/docs/governance/maintenance/perfective/README.adoc b/k9-svc/bindings/deno/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/bindings/deno/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/bindings/deno/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/bindings/deno/docs/governance/planning/README.adoc b/k9-svc/bindings/deno/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/bindings/deno/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/bindings/deno/docs/governance/planning/could/README.adoc b/k9-svc/bindings/deno/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/bindings/deno/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/bindings/deno/docs/governance/planning/must/README.adoc b/k9-svc/bindings/deno/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/bindings/deno/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/bindings/deno/docs/governance/planning/should/README.adoc b/k9-svc/bindings/deno/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/bindings/deno/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/bindings/deno/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/bindings/deno/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/bindings/deno/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/bindings/deno/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/bindings/deno/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/bindings/deno/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/bindings/deno/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/bindings/deno/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/bindings/deno/docs/practice/.gitkeep b/k9-svc/bindings/deno/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/bindings/deno/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/bindings/deno/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/bindings/deno/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index 3d9aa304..00000000 --- a/k9-svc/bindings/deno/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **{{AUTHOR}}** -- Email: **{{AUTHOR_EMAIL}}** -- Copyright: `Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/bindings/deno/docs/practice/README.adoc b/k9-svc/bindings/deno/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/bindings/deno/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/bindings/deno/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/bindings/deno/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index b355b468..00000000 --- a/k9-svc/bindings/deno/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> diff --git a/k9-svc/bindings/deno/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/bindings/deno/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/bindings/deno/docs/reports/README.adoc b/k9-svc/bindings/deno/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/bindings/deno/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/bindings/deno/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/bindings/deno/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/bindings/deno/docs/reports/compliance/README.adoc b/k9-svc/bindings/deno/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/bindings/deno/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/bindings/deno/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/bindings/deno/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/bindings/deno/docs/reports/maintenance/README.adoc b/k9-svc/bindings/deno/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/bindings/deno/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/bindings/deno/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/bindings/deno/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/bindings/deno/docs/reports/performance/README.adoc b/k9-svc/bindings/deno/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/bindings/deno/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/bindings/deno/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/bindings/deno/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/bindings/deno/docs/reports/quality/README.adoc b/k9-svc/bindings/deno/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/bindings/deno/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/bindings/deno/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/bindings/deno/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/bindings/deno/docs/reports/security/README.adoc b/k9-svc/bindings/deno/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/bindings/deno/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/bindings/deno/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/bindings/deno/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/bindings/deno/docs/standards/README.adoc b/k9-svc/bindings/deno/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/bindings/deno/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/bindings/deno/docs/templates/contractiles/README.adoc b/k9-svc/bindings/deno/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/bindings/deno/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/bindings/deno/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/deno/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/bindings/deno/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/bindings/deno/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/bindings/deno/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/bindings/deno/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/bindings/deno/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/deno/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/bindings/deno/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/bindings/deno/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/deno/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/bindings/deno/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/bindings/deno/docs/theory/.gitkeep b/k9-svc/bindings/deno/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/bindings/deno/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/bindings/deno/docs/theory/README.adoc b/k9-svc/bindings/deno/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/bindings/deno/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/bindings/deno/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/bindings/deno/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/bindings/deno/docs/theory/computing/README.adoc b/k9-svc/bindings/deno/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/bindings/deno/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/bindings/deno/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/bindings/deno/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/bindings/deno/docs/theory/formalisms/README.adoc b/k9-svc/bindings/deno/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/bindings/deno/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/bindings/deno/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/bindings/deno/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/bindings/deno/docs/theory/mathematics/README.adoc b/k9-svc/bindings/deno/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/bindings/deno/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/bindings/deno/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/bindings/deno/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/bindings/deno/docs/theory/ontologies/README.adoc b/k9-svc/bindings/deno/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/bindings/deno/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/bindings/deno/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/bindings/deno/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/bindings/deno/docs/theory/other/README.adoc b/k9-svc/bindings/deno/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/bindings/deno/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/bindings/deno/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/bindings/deno/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/bindings/deno/docs/theory/socio-technical/README.adoc b/k9-svc/bindings/deno/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/bindings/deno/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/bindings/deno/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/bindings/deno/docs/whitepapers/README.adoc b/k9-svc/bindings/deno/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/bindings/deno/docs/whitepapers/academic/.gitkeep b/k9-svc/bindings/deno/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/bindings/deno/docs/whitepapers/academic/README.adoc b/k9-svc/bindings/deno/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/bindings/deno/docs/whitepapers/industry/.gitkeep b/k9-svc/bindings/deno/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/bindings/deno/docs/whitepapers/industry/README.adoc b/k9-svc/bindings/deno/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/bindings/deno/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/bindings/deno/docs/whitepapers/outreach/README.adoc b/k9-svc/bindings/deno/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/bindings/deno/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/bindings/deno/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/bindings/deno/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/bindings/deno/docs/wikis/README.adoc b/k9-svc/bindings/deno/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/bindings/deno/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/bindings/deno/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/bindings/deno/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/bindings/deno/examples/README.adoc b/k9-svc/bindings/deno/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/bindings/deno/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/bindings/deno/examples/web-project-deno.json b/k9-svc/bindings/deno/examples/web-project-deno.json deleted file mode 100644 index 028e4f1a..00000000 --- a/k9-svc/bindings/deno/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/{{OWNER}}/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/bindings/deno/features/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/bindings/deno/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/bindings/deno/features/README.adoc b/k9-svc/bindings/deno/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/bindings/deno/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/bindings/deno/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/bindings/deno/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/bindings/deno/features/boj-server/README.adoc b/k9-svc/bindings/deno/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/bindings/deno/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/bindings/deno/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/bindings/deno/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/bindings/deno/features/panic-attacker/README.adoc b/k9-svc/bindings/deno/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/bindings/deno/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/bindings/deno/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/bindings/deno/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/bindings/deno/features/ssg/README.adoc b/k9-svc/bindings/deno/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/bindings/deno/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/bindings/deno/features/ssg/ssg-bootstrap.sh b/k9-svc/bindings/deno/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/bindings/deno/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/bindings/deno/jsr.json b/k9-svc/bindings/deno/jsr.json deleted file mode 100644 index dd64c8da..00000000 --- a/k9-svc/bindings/deno/jsr.json +++ /dev/null @@ -1,18 +0,0 @@ -{ - "name": "@hyperpolymath/k9", - "version": "0.1.0", - "exports": { - ".": "./mod.ts" - }, - "publish": { - "include": [ - "mod.ts", - "src/K9.res.mjs", - "src/K9_Types.res.mjs", - "src/K9_Parser.res.mjs", - "src/K9_Renderer.res.mjs", - "LICENSE", - "README.adoc" - ] - } -} diff --git a/k9-svc/bindings/deno/mod.affine b/k9-svc/bindings/deno/mod.affine deleted file mode 100644 index 3b2c08fa..00000000 --- a/k9-svc/bindings/deno/mod.affine +++ /dev/null @@ -1,53 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine (Semantic pass) - -module mod; - -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// mod.ts — Deno entry point for the @hyperpolymath/k9 library. -// -// Re-exports the compiled ReScript modules for use in Deno projects. -// All types and functions are available through this single entry point. - -// @ts-nocheck — ReScript-generated ES modules do not ship .d.ts files - -{ - parse, - parseFile, - render, - renderSecurityLevel, - detectFormat, - makeComponent, - makePedigree, - defaultSecurityPolicy, - emptyRecipes, - securityLevelFromString, - securityLevelToString, - parseErrorToString, -} from "./src/K9.res.mjs"; - -{ - parseK9, - parseK9File, -} from "./src/K9_Parser.res.mjs"; - -{ - renderK9, - renderSecurityLevel as renderSecurityLevelStr, -} from "./src/K9_Renderer.res.mjs"; - -type { - securityLevel, - pedigree, - securityPolicy, - target, - recipes, - validation, - contractClause, - contract, - component, - parseError, -} from "./src/K9_Types.res.mjs"; - diff --git a/k9-svc/bindings/deno/src/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index c92e124d..00000000 --- a/k9-svc/bindings/deno/src/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary source code directory. Organized by role and architectural - aspect. - -canonical_locations: - core: "core/" - interface: "interface/" - bridges: "bridges/" - contracts: "contracts/" - errors: "errors/" - definitions: "definitions/" - aspects: "aspects/" - -invariants: - - "Core logic MUST reside in core/" - - "Verified seams MUST reside in interface/" - - "Safety constraints MUST reside in contracts/" - - "Failure dictionaries MUST reside in errors/" diff --git a/k9-svc/bindings/deno/src/K9.affine b/k9-svc/bindings/deno/src/K9.affine deleted file mode 100644 index ede4c16c..00000000 --- a/k9-svc/bindings/deno/src/K9.affine +++ /dev/null @@ -1,74 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine (Semantic pass) - -module K9; - -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// K9 — Main module for the K9 (Self-Validating Components) parser library. -// -// Re-exports the core structs, parser, and renderer for convenient access. -// This module serves as the primary entry point for library consumers. -// -// ## Usage -// -// ```rescript -// open K9 -// -// fn result = K9_Parser.parseK9("K9!\n---\nmetadata:\n name: hello\n ...") -// switch result { -// | Ok(component) => Console.log(K9_Renderer.renderK9(component)) -// | Error(err) => Console.error(K9_Types.parseErrorToString(err)) -// } -// ``` - -// Re-export structs for convenience -struct securityLevel { K9_Types.securityLevel -struct pedigree { K9_Types.pedigree -struct securityPolicy { K9_Types.securityPolicy -struct target { K9_Types.target -struct recipes { K9_Types.recipes -struct validation { K9_Types.validation -struct contractClause { K9_Types.contractClause -struct contract { K9_Types.contract -struct component { K9_Types.component -struct parseError { K9_Types.parseError -struct k9Format { K9_Parser.k9Format - -/// Parse a K9 component specification from a string. -fn parse = K9_Parser.parseK9 - -/// Parse a K9 component specification from a file path. -fn parseFile = K9_Parser.parseK9File - -/// Render a K9 component to the .k9 YAML-like format. -fn render = K9_Renderer.renderK9 - -/// Render a security level to its canonical string. -fn renderSecurityLevel = K9_Renderer.renderSecurityLevel - -/// Detect the format of a K9 file (YAML or Nickel). -fn detectFormat = K9_Parser.detectFormat - -/// Create a minimal component. -fn makeComponent = K9_Types.makeComponent - -/// Create a pedigree with minimum required fields. -fn makePedigree = K9_Types.makePedigree - -/// Create a default security policy for a given level. -fn defaultSecurityPolicy = K9_Types.defaultSecurityPolicy - -/// Create an empty recipes collection. -fn emptyRecipes = K9_Types.emptyRecipes - -/// Parse a security level from a string. -fn securityLevelFromString = K9_Types.securityLevelFromString - -/// Convert a security level to its canonical string. -fn securityLevelToString = K9_Types.securityLevelToString - -/// Format a parse error as a diagnostic string. -fn parseErrorToString = K9_Types.parseErrorToString - diff --git a/k9-svc/bindings/deno/src/K9_Parser.affine b/k9-svc/bindings/deno/src/K9_Parser.affine deleted file mode 100644 index c76a9b4c..00000000 --- a/k9-svc/bindings/deno/src/K9_Parser.affine +++ /dev/null @@ -1,411 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine (Semantic pass) - -module K9_Parser; - -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// K9_Parser — Parser for K9 self-validating component specifications. -// -// Parses the YAML-like .k9 format into the structd AST defined in K9_Types. -// The parser is line-oriented and extracts: -// - Magic number (K9!) -// - Pedigree metadata (name, version, description, author, license) -// - Security level (Kennel/Yard/Hunt) with permission flags -// - Target platform constraints -// - Recipes and validation blocks -// - Tags - -open K9_Types - -// --------------------------------------------------------------------------- -// Parsing helpers -// --------------------------------------------------------------------------- - -/// Extract a key-value pair from a " key: value" line. -/// Returns None if the line does not match the expected format. -fn parseKeyValue = (line: string): option<(string, string)> => { - fn trimmed = line->String.trim - fn colonIdx = trimmed->String.indexOf(":") - if colonIdx >= 0 { - fn key = trimmed->String.slice(~start=0, ~end=colonIdx)->String.trim - fn value = trimmed->String.sliceToEnd(~start=colonIdx + 1)->String.trim - Some((key, value)) - } else { - None - } -} - -/// Parse a boolean from a string ("true"/"false"). -fn parseBool = (s: string): bool => { - s->String.trim->String.toLowerCase == "true" -} - -/// Internal state for the line-oriented K9 parser. -struct parserState { { - mutable lineIndex: int, - lines: array, -} - -/// Advance past blank lines and separator lines (---). -fn skipBlanksAndSeparators = (state: parserState): unit => { - fn done = ref(false) - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex)->String.trim - if line->String.length == 0 || line == "---" { - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } -} - -/// Check if the current line matches a section header (e.g., "metadata:"). -fn isSectionHeader = (line: string, section: string): bool => { - line->String.trim == section ++ ":" -} - -// --------------------------------------------------------------------------- -// Section parsers -// --------------------------------------------------------------------------- - -/// Parse the metadata/pedigree section. -/// Reads indented key-value pairs until a non-indented line or new section. -fn parsePedigreeSection = (state: parserState): pedigree => { - // Skip the "metadata:" header line - state.lineIndex = state.lineIndex + 1 - - fn name = ref("") - fn version = ref("") - fn description = ref("") - fn author = ref(None) - fn license = ref(None) - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - // Indented lines belong to this section - if line->String.startsWith(" ") && trimmed->String.length > 0 { - switch parseKeyValue(trimmed) { - | Some(("name", v)) => name := v - | Some(("version", v)) => version := v - | Some(("description", v)) => description := v - | Some(("author", v)) => author := Some(v) - | Some(("license", v)) => license := Some(v) - | _ => () // Ignore unknown fields - } - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - { - name: name.contents, - version: version.contents, - description: description.contents, - author: author.contents, - license: license.contents, - } -} - -/// Parse the security section. -fn parseSecuritySection = (state: parserState): securityPolicy => { - // Skip the "security:" header line - state.lineIndex = state.lineIndex + 1 - - fn level = ref(Kennel) - fn allowNetwork = ref(false) - fn allowFsWrite = ref(false) - fn allowSubprocess = ref(false) - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - if line->String.startsWith(" ") && trimmed->String.length > 0 { - switch parseKeyValue(trimmed) { - | Some(("trust_level", v)) => - switch securityLevelFromString(v) { - | Some(lvl) => level := lvl - | None => () // Keep default - } - | Some(("allow_network", v)) => allowNetwork := parseBool(v) - | Some(("allow_filesystem_write", v)) => allowFsWrite := parseBool(v) - | Some(("allow_subprocess", v)) => allowSubprocess := parseBool(v) - | _ => () - } - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - { - level: level.contents, - allowNetwork: allowNetwork.contents, - allowFsWrite: allowFsWrite.contents, - allowSubprocess: allowSubprocess.contents, - } -} - -/// Parse the target section. -fn parseTargetSection = (state: parserState): target => { - // Skip the "target:" header line - state.lineIndex = state.lineIndex + 1 - - fn os = ref(None) - fn isEdge = ref(false) - fn requiresPodman = ref(false) - fn memory = ref(None) - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - if line->String.startsWith(" ") && trimmed->String.length > 0 { - switch parseKeyValue(trimmed) { - | Some(("os", v)) => os := Some(v) - | Some(("is_edge", v)) => isEdge := parseBool(v) - | Some(("requires_podman", v)) => requiresPodman := parseBool(v) - | Some(("memory", v)) => memory := Some(v) - | _ => () - } - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - { - os: os.contents, - isEdge: isEdge.contents, - requiresPodman: requiresPodman.contents, - memory: memory.contents, - } -} - -/// Parse the recipes section. -fn parseRecipesSection = (state: parserState): recipes => { - // Skip the "recipes:" header line - state.lineIndex = state.lineIndex + 1 - - fn install = ref(None) - fn validate = ref(None) - fn deploy = ref(None) - fn migrate = ref(None) - fn custom = [] - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - if line->String.startsWith(" ") && trimmed->String.length > 0 { - switch parseKeyValue(trimmed) { - | Some(("install", v)) => install := Some(v) - | Some(("validate", v)) => validate := Some(v) - | Some(("deploy", v)) => deploy := Some(v) - | Some(("migrate", v)) => migrate := Some(v) - | Some((k, v)) => custom->Array.push((k, v))->ignore - | None => () - } - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - { - install: install.contents, - validate: validate.contents, - deploy: deploy.contents, - migrate: migrate.contents, - custom, - } -} - -/// Parse the validation section. -fn parseValidationSection = (state: parserState): validation => { - // Skip the "validation:" header line - state.lineIndex = state.lineIndex + 1 - - fn checksum = ref("") - fn pedigreeVersion = ref("") - fn huntAuthorized = ref(false) - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - if line->String.startsWith(" ") && trimmed->String.length > 0 { - switch parseKeyValue(trimmed) { - | Some(("checksum", v)) => checksum := v - | Some(("pedigree_version", v)) => pedigreeVersion := v - | Some(("hunt_authorized", v)) => huntAuthorized := parseBool(v) - | _ => () - } - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - { - checksum: checksum.contents, - pedigreeVersion: pedigreeVersion.contents, - huntAuthorized: huntAuthorized.contents, - } -} - -/// Parse the tags section. -fn parseTagsSection = (state: parserState): array => { - // Skip the "tags:" header line - state.lineIndex = state.lineIndex + 1 - - fn tags = [] - fn done = ref(false) - - while state.lineIndex < state.lines->Array.length && !done.contents { - fn line = state.lines->Array.getUnsafe(state.lineIndex) - fn trimmed = line->String.trim - if trimmed->String.startsWith("- ") { - fn tag = trimmed->String.sliceToEnd(~start=2)->String.trim - tags->Array.push(tag)->ignore - state.lineIndex = state.lineIndex + 1 - } else if line->String.startsWith(" ") && trimmed->String.length > 0 { - // Also handle indented non-dash entries - tags->Array.push(trimmed)->ignore - state.lineIndex = state.lineIndex + 1 - } else { - done := true - } - } - - tags -} - -// --------------------------------------------------------------------------- -// Public API -// --------------------------------------------------------------------------- - -/// Parse a K9 component specification from a string. -/// -/// The input must start with the K9! magic number. -/// Returns either a parseError or the parsed component. -/// -/// ### Example -/// ``` -/// fn result = parseK9("K9!\n---\nmetadata:\n name: hello-k9\n ...") -/// ``` -fn parseK9 = (input: string): result => { - fn trimmed = input->String.trim - if trimmed->String.length == 0 { - Error(EmptyDocument) - } else { - fn lines = input->String.split("\n") - fn state: parserState = {lineIndex: 0, lines} - - // Check for K9! magic number - skipBlanksAndSeparators(state) - if state.lineIndex >= lines->Array.length { - Error(EmptyDocument) - } else { - fn firstLine = lines->Array.getUnsafe(state.lineIndex)->String.trim - if firstLine != "K9!" { - Error(MissingMagicNumber) - } else { - state.lineIndex = state.lineIndex + 1 - skipBlanksAndSeparators(state) - - // Parse sections in order - fn pedigreeRef = ref(makePedigree(~name="", ~version="", ~description="")) - fn securityRef = ref(defaultSecurityPolicy(Kennel)) - fn targetRef = ref(None) - fn recipesRef = ref(None) - fn validationRef = ref(None) - fn tagsRef = ref([]) - fn contentRef = ref([]) - - while state.lineIndex < lines->Array.length { - fn line = lines->Array.getUnsafe(state.lineIndex)->String.trim - - if line->String.length == 0 || line == "---" { - state.lineIndex = state.lineIndex + 1 - } else if isSectionHeader(line, "metadata") { - pedigreeRef := parsePedigreeSection(state) - } else if isSectionHeader(line, "security") { - securityRef := parseSecuritySection(state) - } else if isSectionHeader(line, "target") { - targetRef := Some(parseTargetSection(state)) - } else if isSectionHeader(line, "recipes") { - recipesRef := Some(parseRecipesSection(state)) - } else if isSectionHeader(line, "validation") { - validationRef := Some(parseValidationSection(state)) - } else if isSectionHeader(line, "tags") { - tagsRef := parseTagsSection(state) - } else { - // Unknown key-value pair at root level — store as content - switch parseKeyValue(line) { - | Some((k, v)) => - contentRef.contents->Array.push((k, v))->ignore - | None => () - } - state.lineIndex = state.lineIndex + 1 - } - } - - // Validate required pedigree fields - fn ped = pedigreeRef.contents - if ped.name->String.length == 0 { - Error(MissingPedigree("name")) - } else if ped.version->String.length == 0 { - Error(MissingPedigree("version")) - } else if ped.description->String.length == 0 { - Error(MissingPedigree("description")) - } else { - Ok({ - pedigree: ped, - security: securityRef.contents, - target: targetRef.contents, - recipes: recipesRef.contents, - validation: validationRef.contents, - content: contentRef.contents, - tags: tagsRef.contents, - }) - } - } - } - } -} - -/// Parse a K9 component specification from a file path. -/// Uses Node.js fs.readFileSync for Deno compatibility. -@module("node:fs") -external readFileSync: (string, string) => string = "readFileSync" - -fn parseK9File = (path: string): result => { - fn content = readFileSync(path, "utf-8") - parseK9(content) -} - -// --------------------------------------------------------------------------- -// Format detection -// --------------------------------------------------------------------------- - -/// K9 file format variants. -struct k9Format { - | K9Yaml - | K9Nickel - -/// Detect whether a K9 file is YAML-like (.k9) or Nickel (.k9.ncl). -fn detectFormat = (input: string): k9Format => { - fn trimmed = input->String.trim - if trimmed->String.startsWith("K9!") { - K9Yaml - } else { - K9Nickel - } -} - diff --git a/k9-svc/bindings/deno/src/K9_Renderer.affine b/k9-svc/bindings/deno/src/K9_Renderer.affine deleted file mode 100644 index 56377105..00000000 --- a/k9-svc/bindings/deno/src/K9_Renderer.affine +++ /dev/null @@ -1,171 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine (Semantic pass) - -module K9_Renderer; - -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// K9_Renderer — Render K9 AST back to K9 surface syntax. -// -// Converts the structd AST from K9_Types into the YAML-like .k9 format, -// including the K9! magic number, pedigree, security, target, recipes, -// validation, and tags sections. - -open K9_Types - -// --------------------------------------------------------------------------- -// Helpers -// --------------------------------------------------------------------------- - -/// Render a boolean as lowercase text ("true"/"false"). -fn renderBool = (b: bool): string => { - if b { - "true" - } else { - "false" - } -} - -/// Render an optional field. Returns an array containing one line if -/// the value is Some, or an empty array if None. -fn renderOptional = (key: string, value: option): array => { - switch value { - | Some(v) => [key ++ ": " ++ v] - | None => [] - } -} - -// --------------------------------------------------------------------------- -// Section renderers -// --------------------------------------------------------------------------- - -/// Render the pedigree/metadata section. -fn renderPedigreeSection = (ped: pedigree): array => { - Array.concat( - [ - "metadata:", - " name: " ++ ped.name, - " version: " ++ ped.version, - " description: " ++ ped.description, - ], - Array.concat( - renderOptional(" author", ped.author), - renderOptional(" license", ped.license), - ), - ) -} - -/// Render the security section. -fn renderSecuritySection = (sec: securityPolicy): array => { - [ - "", - "security:", - " trust_level: " ++ securityLevelToString(sec.level), - " allow_network: " ++ renderBool(sec.allowNetwork), - " allow_filesystem_write: " ++ renderBool(sec.allowFsWrite), - " allow_subprocess: " ++ renderBool(sec.allowSubprocess), - ] -} - -/// Render the target section if present. -fn renderTargetSection = (tgt: option): array => { - switch tgt { - | None => [] - | Some(t) => - Array.concat( - Array.concat(["", "target:"], renderOptional(" os", t.os)), - Array.concat( - [ - " is_edge: " ++ renderBool(t.isEdge), - " requires_podman: " ++ renderBool(t.requiresPodman), - ], - renderOptional(" memory", t.memory), - ), - ) - } -} - -/// Render the recipes section if present. -fn renderRecipesSection = (rec_: option): array => { - switch rec_ { - | None => [] - | Some(r) => - fn lines = ["", "recipes:"] - fn standard = Array.concat( - Array.concat( - renderOptional(" install", r.install), - renderOptional(" validate", r.validate), - ), - Array.concat( - renderOptional(" deploy", r.deploy), - renderOptional(" migrate", r.migrate), - ), - ) - fn customLines = r.custom->Array.map(((k, v)) => " " ++ k ++ ": " ++ v) - Array.concat(lines, Array.concat(standard, customLines)) - } -} - -/// Render the validation section if present. -fn renderValidationSection = (val_: option): array => { - switch val_ { - | None => [] - | Some(v) => [ - "", - "validation:", - " checksum: " ++ v.checksum, - " pedigree_version: " ++ v.pedigreeVersion, - " hunt_authorized: " ++ renderBool(v.huntAuthorized), - ] - } -} - -/// Render the tags section if non-empty. -fn renderTagsSection = (tags: array): array => { - if tags->Array.length == 0 { - [] - } else { - fn header = ["", "tags:"] - fn items = tags->Array.map(t => " - " ++ t) - Array.concat(header, items) - } -} - -// --------------------------------------------------------------------------- -// Public API -// --------------------------------------------------------------------------- - -/// Render a complete K9 component to the .k9 YAML-like format. -/// -/// ### Example -/// ``` -/// fn text = renderK9(component) -/// // "K9!\n---\nmetadata:\n name: hello-k9\n ..." -/// ``` -fn renderK9 = (c: component): string => { - fn lines = Array.concat( - ["K9!", "---"], - Array.concat( - renderPedigreeSection(c.pedigree), - Array.concat( - renderSecuritySection(c.security), - Array.concat( - renderTargetSection(c.target), - Array.concat( - renderRecipesSection(c.recipes), - Array.concat(renderValidationSection(c.validation), renderTagsSection(c.tags)), - ), - ), - ), - ), - ) - - // Filter out empty strings that would create unwanted blank lines at the end - fn filtered = lines->Array.filter(l => l->String.length > 0 || l == "") - filtered->Array.join("\n") ++ "\n" -} - -/// Render a security level to its canonical text representation. -fn renderSecurityLevel = securityLevelToString - diff --git a/k9-svc/bindings/deno/src/K9_Types.affine b/k9-svc/bindings/deno/src/K9_Types.affine deleted file mode 100644 index 04b23986..00000000 --- a/k9-svc/bindings/deno/src/K9_Types.affine +++ /dev/null @@ -1,224 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine (Semantic pass) - -module K9_Types; - -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// K9_Types — Core data structs for K9 (Self-Validating Components). -// -// Defines the abstract syntax tree for K9 component specifications, -// including pedigree metadata, security levels (Kennel/Yard/Hunt), -// target platform constraints, lifecycle recipes, validation blocks, -// and contract clauses. - -// --------------------------------------------------------------------------- -// Security levels -// --------------------------------------------------------------------------- - -/// K9 security levels forming a trust hierarchy. -/// -/// - Kennel: Pure data, no execution, safe anywhere. -/// - Yard: Controlled execution, limited permissions. -/// - Hunt: Full execution with explicit authorisation required. -struct securityLevel { - | Kennel - | Yard - | Hunt - -/// Parse a security level from its canonical string representation. -/// Recognised values (case-insensitive): "kennel", "yard", "hunt". -/// Also accepts tick-prefixed forms: "'Kennel", "'Yard", "'Hunt". -fn securityLevelFromString = (s: string): option => { - fn normalized = s->String.trim->String.toLowerCase - // Strip leading tick if present (e.g., "'kennel" -> "kennel") - fn cleaned = if normalized->String.startsWith("'") { - normalized->String.sliceToEnd(~start=1) - } else { - normalized - } - switch cleaned { - | "kennel" => Some(Kennel) - | "yard" => Some(Yard) - | "hunt" => Some(Hunt) - | _ => None - } -} - -/// Return the canonical string representation of a security level. -/// Uses the tick-prefixed form matching the K9 spec (e.g., "'Kennel"). -fn securityLevelToString = (level: securityLevel): string => { - switch level { - | Kennel => "'Kennel" - | Yard => "'Yard" - | Hunt => "'Hunt" - } -} - -// --------------------------------------------------------------------------- -// Pedigree metadata -// --------------------------------------------------------------------------- - -/// Pedigree: identity and provenance metadata for a K9 component. -struct pedigree { { - name: string, - version: string, - description: string, - author: option, - license: option, -} - -/// Create a pedigree with the minimum required fields. -fn makePedigree = ( - ~name: string, - ~version: string, - ~description: string, -): pedigree => { - name, - version, - description, - author: None, - license: None, -} - -// --------------------------------------------------------------------------- -// Security policy -// --------------------------------------------------------------------------- - -/// Security policy combining the level with specific permission flags. -struct securityPolicy { { - level: securityLevel, - allowNetwork: bool, - allowFsWrite: bool, - allowSubprocess: bool, -} - -/// Create a default security policy for the given level. -/// Kennel: all permissions denied. -/// Yard: network allowed, filesystem write and subprocess denied. -/// Hunt: all permissions allowed. -fn defaultSecurityPolicy = (level: securityLevel): securityPolicy => { - switch level { - | Kennel => {level, allowNetwork: false, allowFsWrite: false, allowSubprocess: false} - | Yard => {level, allowNetwork: true, allowFsWrite: false, allowSubprocess: false} - | Hunt => {level, allowNetwork: true, allowFsWrite: true, allowSubprocess: true} - } -} - -// --------------------------------------------------------------------------- -// Target platform -// --------------------------------------------------------------------------- - -/// Target platform constraints for a K9 component. -struct target { { - os: option, - isEdge: bool, - requiresPodman: bool, - memory: option, -} - -// --------------------------------------------------------------------------- -// Recipes -// --------------------------------------------------------------------------- - -/// Collection of standard lifecycle recipes for a K9 component. -struct recipes { { - install: option, - validate: option, - deploy: option, - migrate: option, - custom: array<(string, string)>, -} - -/// Create an empty recipes collection. -fn emptyRecipes = (): recipes => { - install: None, - validate: None, - deploy: None, - migrate: None, - custom: [], -} - -// --------------------------------------------------------------------------- -// Validation -// --------------------------------------------------------------------------- - -/// Self-validation block for a K9 component. -struct validation { { - checksum: string, - pedigreeVersion: string, - huntAuthorized: bool, -} - -// --------------------------------------------------------------------------- -// Contract -// --------------------------------------------------------------------------- - -/// A single clause within a K9 contract. -struct contractClause { { - clauseType: string, - predicate: string, - verified: bool, -} - -/// A contract attached to a K9 component (from the contractile system). -struct contract { { - name: string, - clauses: array, -} - -// --------------------------------------------------------------------------- -// Component (top-level AST node) -// --------------------------------------------------------------------------- - -/// A K9 self-validating component. This is the top-level AST node -/// representing a complete .k9 specification file. -struct component { { - pedigree: pedigree, - security: securityPolicy, - target: option, - recipes: option, - validation: option, - content: array<(string, string)>, - tags: array, -} - -/// Create a minimal component with the given pedigree and security level. -fn makeComponent = ( - ~pedigree: pedigree, - ~securityLevel: securityLevel, -): component => { - pedigree, - security: defaultSecurityPolicy(securityLevel), - target: None, - recipes: None, - validation: None, - content: [], - tags: [], -} - -// --------------------------------------------------------------------------- -// Parse errors -// --------------------------------------------------------------------------- - -/// Errors that can occur during K9 parsing. -struct parseError { - | MissingMagicNumber - | MissingPedigree(string) - | InvalidSecurityLevel(string) - | UnexpectedToken({line: int, token: string}) - | EmptyDocument - -/// Format a parse error as a diagnostic string. -fn parseErrorToString = (err: parseError): string => { - switch err { - | MissingMagicNumber => "error[K9]: missing K9! magic number at start of file" - | MissingPedigree(field) => `error[K9]: missing required pedigree field "${field}"` - | InvalidSecurityLevel(level) => `error[K9]: invalid security level "${level}"` - | UnexpectedToken({line, token}) => - `error[K9]: line ${line->Int.toString}: unexpected token "${token}"` - | EmptyDocument => "error[K9]: document is empty" - } -} - diff --git a/k9-svc/bindings/deno/src/README.adoc b/k9-svc/bindings/deno/src/README.adoc deleted file mode 100644 index 5529f66f..00000000 --- a/k9-svc/bindings/deno/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= src Pillar diff --git a/k9-svc/bindings/deno/src/aspects/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/aspects/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d5b209e..00000000 --- a/k9-svc/bindings/deno/src/aspects/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-aspects" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Cross-cutting concerns and domain-specific aspects (Security, - Observability, Integrity). - -canonical_locations: - security: "security/" - observability: "observability/" - integrity: "integrity/" diff --git a/k9-svc/bindings/deno/src/aspects/README.adoc b/k9-svc/bindings/deno/src/aspects/README.adoc deleted file mode 100644 index 6456f962..00000000 --- a/k9-svc/bindings/deno/src/aspects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Aspects Pillar diff --git a/k9-svc/bindings/deno/src/aspects/integrity/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/aspects/integrity/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f114cbd2..00000000 --- a/k9-svc/bindings/deno/src/aspects/integrity/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-integrity" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the integrity aspect. diff --git a/k9-svc/bindings/deno/src/aspects/integrity/README.adoc b/k9-svc/bindings/deno/src/aspects/integrity/README.adoc deleted file mode 100644 index f15d829d..00000000 --- a/k9-svc/bindings/deno/src/aspects/integrity/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Integrity Aspect diff --git a/k9-svc/bindings/deno/src/aspects/observability/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/aspects/observability/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index e16cbdf9..00000000 --- a/k9-svc/bindings/deno/src/aspects/observability/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-observability" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the observability aspect. diff --git a/k9-svc/bindings/deno/src/aspects/observability/README.adoc b/k9-svc/bindings/deno/src/aspects/observability/README.adoc deleted file mode 100644 index 7852ee64..00000000 --- a/k9-svc/bindings/deno/src/aspects/observability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Observability Aspect diff --git a/k9-svc/bindings/deno/src/aspects/security/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/aspects/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 09965363..00000000 --- a/k9-svc/bindings/deno/src/aspects/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the security aspect. diff --git a/k9-svc/bindings/deno/src/aspects/security/README.adoc b/k9-svc/bindings/deno/src/aspects/security/README.adoc deleted file mode 100644 index 3c3536ec..00000000 --- a/k9-svc/bindings/deno/src/aspects/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Aspect diff --git a/k9-svc/bindings/deno/src/bridges/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/bridges/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d3e27a0..00000000 --- a/k9-svc/bindings/deno/src/bridges/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-bridges" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Integration logic for external systems (API, Database, RPC, etc.). diff --git a/k9-svc/bindings/deno/src/contracts/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/contracts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0bd9198f..00000000 --- a/k9-svc/bindings/deno/src/contracts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-contracts" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Contracts unit for high-rigor source code. diff --git a/k9-svc/bindings/deno/src/contracts/README.adoc b/k9-svc/bindings/deno/src/contracts/README.adoc deleted file mode 100644 index 9cfa2098..00000000 --- a/k9-svc/bindings/deno/src/contracts/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Contracts Unit diff --git a/k9-svc/bindings/deno/src/core/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/core/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 22846c78..00000000 --- a/k9-svc/bindings/deno/src/core/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-core" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary application logic and core domain models. diff --git a/k9-svc/bindings/deno/src/definitions/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/definitions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e54f4dab..00000000 --- a/k9-svc/bindings/deno/src/definitions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-definitions" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Definitions unit for high-rigor source code. diff --git a/k9-svc/bindings/deno/src/definitions/README.adoc b/k9-svc/bindings/deno/src/definitions/README.adoc deleted file mode 100644 index 95483497..00000000 --- a/k9-svc/bindings/deno/src/definitions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Definitions Unit diff --git a/k9-svc/bindings/deno/src/errors/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/errors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index dddcc6c4..00000000 --- a/k9-svc/bindings/deno/src/errors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-errors" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Errors unit for high-rigor source code. diff --git a/k9-svc/bindings/deno/src/errors/README.adoc b/k9-svc/bindings/deno/src/errors/README.adoc deleted file mode 100644 index 460fc1e9..00000000 --- a/k9-svc/bindings/deno/src/errors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Errors Unit diff --git a/k9-svc/bindings/deno/src/interface/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 7f0f471b..00000000 --- a/k9-svc/bindings/deno/src/interface/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "interface-seams-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Consolidated "Verified Interface Seams" unit. This directory unifies the - formal specification (ABI), the bridge implementation (FFI), and the - resulting artifacts (Generated). - -canonical_locations: - abi: "abi/" - ffi: "ffi/" - generated: "generated/" - -invariants: - - "ABI MUST be Idris2 (.idr)" - - "FFI MUST be Zig (.zig)" - - "Generated artifacts MUST be C-compatible" - - "The 'Truth' lives in abi/; the 'Implementation' lives in ffi/" diff --git a/k9-svc/bindings/deno/src/interface/README.adoc b/k9-svc/bindings/deno/src/interface/README.adoc deleted file mode 100644 index 8faf0aad..00000000 --- a/k9-svc/bindings/deno/src/interface/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= interface Unit diff --git a/k9-svc/bindings/deno/src/interface/abi/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/abi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 91cafa01..00000000 --- a/k9-svc/bindings/deno/src/interface/abi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for abi. diff --git a/k9-svc/bindings/deno/src/interface/abi/README.adoc b/k9-svc/bindings/deno/src/interface/abi/README.adoc deleted file mode 100644 index 2330304d..00000000 --- a/k9-svc/bindings/deno/src/interface/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= abi Logic diff --git a/k9-svc/bindings/deno/src/interface/ffi/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/ffi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index bf456ae2..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ffi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for ffi. diff --git a/k9-svc/bindings/deno/src/interface/ffi/README.adoc b/k9-svc/bindings/deno/src/interface/ffi/README.adoc deleted file mode 100644 index 8fe57d34..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= ffi Logic diff --git a/k9-svc/bindings/deno/src/interface/ffi/build.zig b/k9-svc/bindings/deno/src/interface/ffi/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/k9-svc/bindings/deno/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 5b5f1b1e..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "src-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Src logic at level 4. diff --git a/k9-svc/bindings/deno/src/interface/ffi/src/README.adoc b/k9-svc/bindings/deno/src/interface/ffi/src/README.adoc deleted file mode 100644 index a5c0c6d5..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Src Logic diff --git a/k9-svc/bindings/deno/src/interface/ffi/src/main.zig b/k9-svc/bindings/deno/src/interface/ffi/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/k9-svc/bindings/deno/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index e02427f8..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "test-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Test logic at level 4. diff --git a/k9-svc/bindings/deno/src/interface/ffi/test/README.adoc b/k9-svc/bindings/deno/src/interface/ffi/test/README.adoc deleted file mode 100644 index f6f38bf6..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/test/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Test Logic diff --git a/k9-svc/bindings/deno/src/interface/ffi/test/integration_test.zig b/k9-svc/bindings/deno/src/interface/ffi/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/k9-svc/bindings/deno/src/interface/ffi/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/k9-svc/bindings/deno/src/interface/generated/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/generated/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0088b80c..00000000 --- a/k9-svc/bindings/deno/src/interface/generated/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "generated-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for generated. diff --git a/k9-svc/bindings/deno/src/interface/generated/README.adoc b/k9-svc/bindings/deno/src/interface/generated/README.adoc deleted file mode 100644 index 3691b062..00000000 --- a/k9-svc/bindings/deno/src/interface/generated/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= generated Logic diff --git a/k9-svc/bindings/deno/src/interface/generated/abi/.gitkeep b/k9-svc/bindings/deno/src/interface/generated/abi/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/deno/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 4eeb5808..00000000 --- a/k9-svc/bindings/deno/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Abi logic at level 4. diff --git a/k9-svc/bindings/deno/src/interface/generated/abi/README.adoc b/k9-svc/bindings/deno/src/interface/generated/abi/README.adoc deleted file mode 100644 index aff61a99..00000000 --- a/k9-svc/bindings/deno/src/interface/generated/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Abi Logic diff --git a/k9-svc/bindings/deno/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/bindings/deno/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/bindings/deno/verification/README.adoc b/k9-svc/bindings/deno/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/bindings/deno/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/bindings/deno/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/bindings/deno/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/bindings/deno/verification/benchmarks/README.adoc b/k9-svc/bindings/deno/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/bindings/deno/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/bindings/deno/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/bindings/deno/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/deno/verification/coverage/README.adoc b/k9-svc/bindings/deno/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/bindings/deno/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/bindings/deno/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/bindings/deno/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/bindings/deno/verification/fuzzing/README.adoc b/k9-svc/bindings/deno/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/bindings/deno/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/bindings/deno/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/bindings/deno/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/bindings/deno/verification/proofs/README.adoc b/k9-svc/bindings/deno/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/bindings/deno/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/bindings/deno/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/bindings/deno/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/deno/verification/safety_case/README.adoc b/k9-svc/bindings/deno/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/bindings/deno/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/bindings/deno/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/bindings/deno/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/bindings/deno/verification/simulations/README.adoc b/k9-svc/bindings/deno/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/bindings/deno/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/bindings/deno/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/bindings/deno/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/bindings/deno/verification/tests/README.adoc b/k9-svc/bindings/deno/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/bindings/deno/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/bindings/deno/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/deno/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/bindings/deno/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/deno/verification/traceability/README.adoc b/k9-svc/bindings/deno/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/bindings/deno/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/bindings/elixir/.formatter.exs b/k9-svc/bindings/elixir/.formatter.exs deleted file mode 100644 index d2cda26e..00000000 --- a/k9-svc/bindings/elixir/.formatter.exs +++ /dev/null @@ -1,4 +0,0 @@ -# Used by "mix format" -[ - inputs: ["{mix,.formatter}.exs", "{config,lib,test}/**/*.{ex,exs}"] -] diff --git a/k9-svc/bindings/elixir/.gitignore b/k9-svc/bindings/elixir/.gitignore deleted file mode 100644 index 69c8d8ad..00000000 --- a/k9-svc/bindings/elixir/.gitignore +++ /dev/null @@ -1,24 +0,0 @@ -# The directory Mix will write compiled artifacts to. -/_build/ - -# If you run "mix test --cover", coverage assets end up here. -/cover/ - -# The directory Mix downloads your dependencies sources to. -/deps/ - -# Where third-party dependencies like ExDoc output generated docs. -/doc/ - -# Temporary files, for example, from tests. -/tmp/ - -# If the VM crashes, it generates a dump, let's ignore it too. -erl_crash.dump - -# Also ignore archive artifacts (built via "mix archive.build"). -*.ez - -# Ignore package tarball (built via "mix hex.build"). -k9_ex-*.tar - diff --git a/k9-svc/bindings/elixir/LICENSE b/k9-svc/bindings/elixir/LICENSE deleted file mode 100644 index f7a3dc82..00000000 --- a/k9-svc/bindings/elixir/LICENSE +++ /dev/null @@ -1,372 +0,0 @@ -Mozilla Public License Version 2.0 -================================== - -1. Definitions --------------- - -1.1. "Contributor" - means each individual or legal entity that creates, contributes to - the creation of, or owns Covered Software. - -1.2. "Contributor Version" - means the combination of the Contributions of others (if any) used - by a Contributor and that particular Contributor's Contribution. - -1.3. "Contribution" - means Covered Software of a particular Contributor. - -1.4. "Covered Software" - means Source Code Form to which the initial Contributor has attached - the notice in Exhibit A, the Executable Form of such Source Code - Form, and Modifications of such Source Code Form, in each case - including portions thereof. - -1.5. "Incompatible With Secondary Licenses" - means - - (a) that the initial Contributor has attached the notice described - in Exhibit B to the Covered Software; or - - (b) that the Covered Software was made available under the terms of - version 1.1 or earlier of the License, but not also under the - terms of a Secondary License. - -1.6. "Executable Form" - means any form of the work other than Source Code Form. - -1.7. "Larger Work" - means a work that combines Covered Software with other material, in - a separate file or files, that is not Covered Software. - -1.8. "License" - means this document. - -1.9. "Licensable" - means having the right to grant, to the maximum extent possible, - whether at the time of the initial grant or subsequently, any and - all of the rights conveyed by this License. - -1.10. "Modifications" - means any of the following: - - (a) any file in Source Code Form that results from an addition to, - deletion from, or modification of the contents of Covered - Software; or - - (b) any new file in Source Code Form that contains any Covered - Software. - -1.11. "Patent Claims" of a Contributor - means any patent claim(s), including without limitation, method, - process, and apparatus claims, in any patent Licensable by such - Contributor that would be infringed, but for the grant of the - License, by the making, using, selling, offering for sale, having - made, import, or transfer of either its Contributions or its - Contributor Version. - -1.12. "Secondary License" - means either the GNU General Public License, Version 2.0, the GNU - Lesser General Public License, Version 2.1, the GNU Affero General - Public License, Version 3.0, or any later versions of those - licenses. - -1.13. "Source Code Form" - means the form of the work preferred for making modifications. - -1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under this - License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. For - purposes of this definition, "control" means (a) the power, direct - or indirect, to cause the direction or management of such entity, - whether by contract or otherwise, or (b) ownership of more than - fifty percent (50%) of the outstanding shares or beneficial - ownership of such entity. - -2. License Grants and Conditions --------------------------------- - -2.1. Grants - -Each Contributor hereby grants You a world-wide, royalty-free, -non-exclusive license: - -(a) under intellectual property rights (other than patent or trademark) - Licensable by such Contributor to use, reproduce, make available, - modify, display, perform, distribute, and otherwise exploit its - Contributions, either on an unmodified basis, with Modifications, or - as part of a Larger Work; and - -(b) under Patent Claims of such Contributor to make, use, sell, offer - for sale, have made, import, and otherwise transfer either its - Contributions or its Contributor Version. - -2.2. Effective Date - -The licenses granted in Section 2.1 with respect to any Contribution -become effective for each Contribution on the date the Contributor first -distributes such Contribution. - -2.3. Limitations on Grant Scope - -The licenses granted in this Section 2 are the only rights granted under -this License. No additional rights or licenses will be implied from the -distribution or licensing of Covered Software under this License. -Notwithstanding Section 2.1(b) above, no patent license is granted by a -Contributor: - -(a) for any code that a Contributor has removed from Covered Software; - or - -(b) for infringements caused by: (i) Your and any other third party's - modifications of Covered Software, or (ii) the combination of its - Contributions with other software (except as part of its Contributor - Version); or - -(c) under Patent Claims infringed by Covered Software in the absence of - its Contributions. - -This License does not grant any rights in the trademarks, service marks, -or logos of any Contributor (except as may be necessary to comply with -the notice requirements in Section 3.4). - -2.4. Subsequent Licenses - -No Contributor makes additional grants as a result of Your choice to -distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License (if -permitted under the terms of Section 3.3). - -2.5. Representation - -Each Contributor represents that the Contributor believes its -Contributions are its original creation(s) or it has sufficient rights -to grant the rights to its Contributions conveyed by this License. - -2.6. Fair Use - -This License is not intended to limit any rights You have under -applicable copyright doctrines of fair use, fair dealing, or other -equivalents. - -2.7. Conditions - -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted -in Section 2.1. - -3. Responsibilities -------------------- - -3.1. Distribution of Source Form - -All distribution of Covered Software in Source Code Form, including any -Modifications that You create or to which You contribute, must be under -the terms of this License. You must inform recipients that the Source -Code Form of the Covered Software is governed by the terms of this -License, and how they can obtain a copy of this License. You may not -attempt to alter or restrict the recipients' rights in the Source Code -Form. - -3.2. Distribution of Executable Form - -If You distribute Covered Software in Executable Form then: - -(a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients of - the Executable Form how they can obtain a copy of such Source Code - Form by reasonable means in a timely manner, at a charge no more - than the cost of distribution to the recipient; and - -(b) You may distribute such Executable Form under the terms of this - License, or sublicense it under different terms, provided that the - license for the Executable Form does not attempt to limit or alter - the recipients' rights in the Source Code Form under this License. - -3.3. Distribution of a Larger Work - -You may create and distribute a Larger Work under terms of Your choice, -provided that You also comply with the requirements of this License for -the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and the -Covered Software is not Incompatible With Secondary Licenses, this -License permits You to additionally distribute such Covered Software -under the terms of such Secondary License(s), so that the recipient of -the Larger Work may, at their option, further distribute the Covered -Software under the terms of either this License or such Secondary -License(s). - -3.4. Notices - -You may not remove or alter the substance of any license notices -(including copyright notices, patent notices, disclaimers of warranty, -or limitations of liability) contained within the Source Code Form of -the Covered Software, except that You may alter any license notices to -the extent required to remedy known factual inaccuracies. - -3.5. Application of Additional Terms - -You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of Covered -Software. However, You may do so only on Your own behalf, and not on -behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity, or liability obligation is offered by -You alone, and You hereby agree to indemnify every Contributor for any -liability incurred by such Contributor as a result of warranty, support, -indemnity or liability terms You offer. You may include additional -disclaimers of warranty and limitations of liability specific to any -jurisdiction. - -4. Inability to Comply Due to Statute or Regulation ---------------------------------------------------- - -If it is impossible for You to comply with any of the terms of this -License with respect to some or all of the Covered Software due to -statute, judicial order, or regulation then You must: (a) comply with -the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description must -be placed in a text file included with all distributions of the Covered -Software under the name "LEGAL", and must be included in all -distributions of the Covered Software in Source Code Form. - -5. Termination --------------- - -5.1. The rights granted under this License will terminate automatically -if You fail to comply with any of its terms. However, if You become -compliant, then the rights granted under this License from a particular -Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on an -ongoing basis, if such Contributor fails to notify You of the -non-compliance by some reasonable means prior to 60 days after You have -come back into compliance. Moreover, Your grants from a particular -Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is the -first time You have received notice of non-compliance with this License -from such Contributor, and You become compliant prior to 30 days after -Your receipt of the notice. - -5.2. If You initiate litigation against any entity by asserting a patent -infringement claim (excluding declaratory judgment actions, -counter-claims, and cross-claims) alleging that a Contributor Version -directly or indirectly infringes any patent, then the rights granted to -You by any and all Contributors for the Covered Software under Section -2.1 of this License shall terminate. - -5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) which -have been validly granted by You or Your distributors under this License -prior to termination shall survive termination. - -************************************************************************ -* * -* 6. Disclaimer of Warranty * -* ------------------------- * -* * -* Covered Software is provided under this License on an "as is" * -* basis, without warranty of any kind, either expressed, implied, or * -* statutory, including, without limitation, warranties that the * -* Covered Software is free of defects, merchantable, fit for a * -* particular purpose or non-infringing. The entire risk as to the * -* quality and performance of the Covered Software is with You. * -* Should any Covered Software prove defective in any respect, You * -* (not any Contributor) assume the cost of any necessary servicing, * -* repair, or correction. This disclaimer of warranty constitutes an * -* essential part of this License. No use of any Covered Software is * -* authorized under this License except under this disclaimer. * -* * -************************************************************************ - -************************************************************************ -* * -* 7. Limitation of Liability * -* -------------------------- * -* * -* Under no circumstances and under no legal theory, whether tort * -* (including negligence), contract, or otherwise, shall any * -* Contributor, or anyone who distributes Covered Software as * -* permitted above, be liable to You for any direct, indirect, * -* special, incidental, or consequential damages of any character * -* including, without limitation, damages for lost profits, loss of * -* goodwill, work stoppage, computer failure or malfunction, or any * -* and all other commercial damages or losses, even if such party * -* shall have been informed of the possibility of such damages. This * -* limitation of liability shall not apply to liability for death or * -* personal injury resulting from such party's negligence to the * -* extent applicable law prohibits such limitation. Some * -* jurisdictions do not allow the exclusion or limitation of * -* incidental or consequential damages, so this exclusion and * -* limitation may not apply to You. * -* * -************************************************************************ - -8. Litigation -------------- - -Any litigation relating to this License may be brought only in the -courts of a jurisdiction where the defendant maintains its principal -place of business and such litigation shall be governed by laws of that -jurisdiction, without reference to its conflict-of-law provisions. -Nothing in this Section shall prevent a party's ability to bring -cross-claims or counter-claims. - -9. Miscellaneous ----------------- - -This License represents the complete agreement concerning the subject -matter hereof. If any provision of this License is held to be -unenforceable, such provision shall be reformed only to the extent -necessary to make it enforceable. Any law or regulation which provides -that the language of a contract shall be construed against the drafter -shall not be used to construe this License against a Contributor. - -10. Versions of the License ---------------------------- - -10.1. New Versions - -Mozilla Foundation is the license steward. Except as provided in Section -10.3, no one other than the license steward has the right to modify or -publish new versions of this License. Each version will be given a -distinguishing version number. - -10.2. Effect of New Versions - -You may distribute the Covered Software under the terms of the version -of the License under which You originally received the Covered Software, -or under the terms of any subsequent version published by the license -steward. - -10.3. Modified Versions - -If you create software not governed by this License, and you want to -create a new license for such software, you may create and use a -modified version of this License if you rename the license and remove -any references to the name of the license steward (except to note that -such modified license differs from this License). - -10.4. Distributing Source Code Form that is Incompatible With Secondary -Licenses - -If You choose to distribute Source Code Form that is Incompatible With -Secondary Licenses under the terms of this version of the License, the -notice described in Exhibit B of this License must be attached. - -Exhibit A - Source Code Form License Notice -------------------------------------------- - - This Source Code Form is subject to the terms of the Mozilla Public - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at https://mozilla.org/MPL/2.0/. - -If it is not possible or desirable to put the notice in a particular -file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to look -for such a notice. - -You may add additional accurate notices of copyright ownership. - -Exhibit B - "Incompatible With Secondary Licenses" Notice ---------------------------------------------------------- - - This Source Code Form is "Incompatible With Secondary Licenses", as - defined by the Mozilla Public License, v. 2.0. diff --git a/k9-svc/bindings/elixir/README.adoc b/k9-svc/bindings/elixir/README.adoc deleted file mode 100644 index ecf4365c..00000000 --- a/k9-svc/bindings/elixir/README.adoc +++ /dev/null @@ -1,148 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// (MPL-2.0 required for Hex.pm) -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -= k9_ex -:author: Jonathan D.A. Jewell -:revdate: 2026-03-17 -:toc: preamble -:icons: font - -K9 (Self-Validating Components) parser and renderer for -https://elixir-lang.org[Elixir]. Parse and render K9 component specifications -with idiomatic Elixir structs and pattern matching. - -== What It Does - -`k9_ex` provides a typed AST, parser, and renderer for the K9 format -- -a security-tiered configuration language built on Nickel contracts. K9 files -embed pedigree metadata, security levels, build recipes, and validation -checksums directly in the document. - -The library handles both K9 syntax variants: - -* `.k9` -- YAML-like declarative syntax (Kennel level) -* `.k9.ncl` -- Nickel-based programmable syntax (Yard/Hunt level) - -== Installation - -Add `k9_ex` to your dependencies in `mix.exs`: - -[source,elixir] ----- -defp deps do - [ - {:k9_ex, "~> 0.1.0"} - ] -end ----- - -Then fetch: - -[source,sh] ----- -mix deps.get ----- - -Available on https://hex.pm/packages/k9_ex[Hex.pm]. - -== Usage - -[source,elixir] ----- -# Parse a K9 string into a Component struct -{:ok, component} = K9.parse(""" -pedigree: - name: hello-k9 - version: 1.0.0 - description: A greeting - -security: - level: kennel -""") - -# Render the struct back to K9 format -output = K9.render(component) - -# Work with security levels -{:ok, :kennel} = K9.Types.SecurityLevel.from_string("kennel") -K9.Types.SecurityLevel.to_string(:yard) # => "yard" - -# Compare security levels -K9.Types.SecurityLevel.compare(:kennel, :hunt) # => :lt ----- - -== API Overview - -=== Top-Level Module (`K9`) - -`K9.parse(input) :: {:ok, Component.t()} | {:error, term()}`:: - Parse a K9 file string into a `Component` struct. Delegates to `K9.Parser`. - -`K9.render(component) :: String.t()`:: - Render a `Component` struct back to K9 surface syntax. Delegates to `K9.Renderer`. - -=== Modules - -`K9.Types`:: - Core data structures. All types are Elixir structs with `@type` specs. - -`K9.Parser`:: - Parser implementation. Accepts `.k9` and `.k9.ncl` content. - -`K9.Renderer`:: - Renderer that produces K9 surface syntax from the struct AST. - -=== Key Types - -[cols="1,3"] -|=== -| Module | Description - -| `K9.Types.Component` -| Top-level struct. Fields: `pedigree`, `security`, `target`, `recipes`, - `validation`, `content` (map), `tags` (list). - -| `K9.Types.Pedigree` -| Identity metadata: `name`, `version`, `description`, `author`, `license`. - -| `K9.Types.SecurityLevel` -| Trust tier: `:kennel`, `:yard`, or `:hunt`. Provides `from_string/1`, - `to_string/1`, and `compare/2`. - -| `K9.Types.SecurityPolicy` -| Security level plus permission flags: `allow_network`, `allow_fs_write`, - `allow_subprocess`. - -| `K9.Types.Target` -| Platform constraints: `os`, `is_edge`, `requires_podman`, `memory`. - -| `K9.Types.Recipes` -| Lifecycle recipes: `install`, `validate`, `deploy`, `migrate`, plus - `custom` map for additional recipes. - -| `K9.Types.Validation` -| Self-validation block: `checksum`, `pedigree_version`, `hunt_authorized`. - -| `K9.Types.Contract` / `K9.Types.ContractClause` -| Contractile system integration. Clause types: must, trust, dust, intend, k9. -|=== - -== Dependencies - -* Elixir >= 1.14 -* `ex_doc` (dev only) ~> 0.34 - -== Links - -* https://hex.pm/packages/k9_ex[Hex.pm package] -* https://hexdocs.pm/k9_ex[HexDocs API reference] -* https://github.com/hyperpolymath/standards/tree/main/k9-svc/SPEC.adoc[K9 specification] - -== Part of the K9 Ecosystem - -This binding is part of the -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9 Self-Validating Components] -suite within the `standards` monorepo. See -link:../README.adoc[`bindings/README.adoc`] for the full feature matrix across -all five language bindings. diff --git a/k9-svc/bindings/elixir/lib/k9.ex b/k9-svc/bindings/elixir/lib/k9.ex deleted file mode 100644 index 9a985337..00000000 --- a/k9-svc/bindings/elixir/lib/k9.ex +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9 do - @moduledoc """ - K9 (Self-Validating Components) parser and renderer. - - Provides types, parsing, and rendering for K9 component specifications. - K9 is a format for self-validating software components with built-in - security levels (Kennel/Yard/Hunt), pedigree metadata, and lifecycle - recipes. - - ## Quick Start - - iex> {:ok, component} = K9.parse("pedigree:\\n name: hello\\n version: 1.0.0\\n description: Test\\n\\nsecurity:\\n level: kennel") - iex> K9.render(component) - - ## Modules - - - `K9.Types` — Core data structures (Component, Pedigree, SecurityLevel, etc.) - - `K9.Parser` — Parse .k9 text into a Component AST - - `K9.Renderer` — Render a Component AST back to .k9 text - """ - - alias K9.Parser - alias K9.Renderer - - @doc """ - Parse a .k9 file string into a Component. - - Delegates to `K9.Parser.parse/1`. - """ - @spec parse(String.t()) :: {:ok, K9.Types.Component.t()} | {:error, term()} - defdelegate parse(input), to: Parser - - @doc """ - Render a Component back to .k9 format text. - - Delegates to `K9.Renderer.render/1`. - """ - @spec render(K9.Types.Component.t()) :: String.t() - defdelegate render(component), to: Renderer -end diff --git a/k9-svc/bindings/elixir/lib/k9/parser.ex b/k9-svc/bindings/elixir/lib/k9/parser.ex deleted file mode 100644 index 0ca7c166..00000000 --- a/k9-svc/bindings/elixir/lib/k9/parser.ex +++ /dev/null @@ -1,223 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9.Parser do - @moduledoc """ - K9 component specification parser. - - Parses .k9 files (YAML-like at Kennel level) into the Component AST. - K9 files use a simple key-value format with sections denoted by - indentation and section headers ending with a colon. - """ - - alias K9.Types.{ - Component, - Pedigree, - Recipes, - SecurityLevel, - SecurityPolicy, - Target, - Validation - } - - @doc """ - Parse a .k9 file string into a Component. - - Returns `{:ok, component}` on success or `{:error, reason}` on failure. - """ - @spec parse(String.t()) :: {:ok, Component.t()} | {:error, term()} - def parse(input) when is_binary(input) do - trimmed = String.trim(input) - - case trimmed do - "" -> {:error, :empty_input} - _ -> parse_component(trimmed) - end - end - - # --------------------------------------------------------------------------- - # Internal parsing - # --------------------------------------------------------------------------- - - defp parse_component(input) do - lines = String.split(input, "\n") - sections = split_sections(lines) - - with {:ok, pedigree} <- parse_pedigree(find_section(sections, "pedigree")), - {:ok, security} <- parse_security(find_section(sections, "security")) do - target = parse_target(find_section(sections, "target")) - recipes = parse_recipes(find_section(sections, "recipes")) - validation = parse_validation(find_section(sections, "validation")) - - # Extract tags — may appear at top level or within the last section - # because "tags: a, b" is parsed as a field (not a section header). - tags = - sections - |> Enum.flat_map(fn {_name, fields} -> - case Map.get(fields, "tags", "") do - "" -> [] - tag_str -> - tag_str - |> String.split(",") - |> Enum.map(&String.trim/1) - |> Enum.filter(fn t -> t != "" end) - end - end) - - {:ok, - %Component{ - pedigree: pedigree, - security: security, - target: target, - recipes: recipes, - validation: validation, - content: %{}, - tags: tags - }} - end - end - - defp split_sections(lines) do - split_sections(lines, "", %{}, %{}) - end - - defp split_sections([], current_section, current_fields, acc) do - case map_size(current_fields) do - 0 -> acc - _ -> Map.put(acc, current_section, current_fields) - end - end - - defp split_sections([line | rest], current_section, current_fields, acc) do - trimmed = String.trim(line) - - cond do - # Skip blank lines and comments. - trimmed == "" or String.starts_with?(trimmed, "#") -> - split_sections(rest, current_section, current_fields, acc) - - # Section header: non-indented, ends with ":", no internal ":". - section_header?(line, trimmed) -> - section_name = trimmed |> String.slice(0..-2//1) |> String.trim() |> String.downcase() - - acc = - case map_size(current_fields) do - 0 -> acc - _ -> Map.put(acc, current_section, current_fields) - end - - split_sections(rest, section_name, %{}, acc) - - # Field line. - true -> - case String.split(trimmed, ":", parts: 2) do - [key, value] -> - field_key = key |> String.trim() |> String.downcase() - field_value = String.trim(value) - updated = Map.put(current_fields, field_key, field_value) - split_sections(rest, current_section, updated, acc) - - _ -> - split_sections(rest, current_section, current_fields, acc) - end - end - end - - defp section_header?(raw_line, trimmed) do - String.ends_with?(trimmed, ":") and - not String.starts_with?(raw_line, " ") and - not String.starts_with?(raw_line, "\t") and - not String.contains?(String.slice(trimmed, 0..-2//1), ":") - end - - defp find_section(sections, name) do - Map.get(sections, name, %{}) - end - - defp parse_pedigree(fields) do - case Map.get(fields, "name", "") do - "" -> - {:error, {:missing_field, "pedigree.name"}} - - name -> - {:ok, - %Pedigree{ - name: name, - version: Map.get(fields, "version", "0.1.0"), - description: Map.get(fields, "description", ""), - author: Map.get(fields, "author"), - license: Map.get(fields, "license") - }} - end - end - - defp parse_security(fields) do - level_str = Map.get(fields, "level", "kennel") - - case SecurityLevel.from_string(level_str) do - {:ok, level} -> - {:ok, - %SecurityPolicy{ - level: level, - allow_network: parse_bool(Map.get(fields, "allow-network", "false")), - allow_fs_write: parse_bool(Map.get(fields, "allow-fs-write", "false")), - allow_subprocess: parse_bool(Map.get(fields, "allow-subprocess", "false")) - }} - - {:error, _} = err -> - err - end - end - - defp parse_bool(s) when is_binary(s) do - String.downcase(s) in ["true", "yes"] - end - - defp parse_bool(_), do: false - - defp parse_target(fields) when map_size(fields) == 0, do: nil - - defp parse_target(fields) do - %Target{ - os: Map.get(fields, "os"), - is_edge: parse_bool(Map.get(fields, "edge", "false")), - requires_podman: parse_bool(Map.get(fields, "requires-podman", "false")), - memory: Map.get(fields, "memory") - } - end - - defp parse_recipes(fields) when map_size(fields) == 0, do: nil - - defp parse_recipes(fields) do - standard_keys = ["install", "validate", "deploy", "migrate"] - - custom = - fields - |> Enum.reject(fn {k, v} -> k in standard_keys or v == "" end) - |> Map.new() - - %Recipes{ - install: Map.get(fields, "install"), - validate: Map.get(fields, "validate"), - deploy: Map.get(fields, "deploy"), - migrate: Map.get(fields, "migrate"), - custom: custom - } - end - - defp parse_validation(fields) when map_size(fields) == 0, do: nil - - defp parse_validation(fields) do - case Map.get(fields, "checksum", "") do - "" -> - nil - - checksum -> - %Validation{ - checksum: checksum, - pedigree_version: Map.get(fields, "pedigree-version", "1.0"), - hunt_authorized: parse_bool(Map.get(fields, "hunt-authorized", "false")) - } - end - end -end diff --git a/k9-svc/bindings/elixir/lib/k9/renderer.ex b/k9-svc/bindings/elixir/lib/k9/renderer.ex deleted file mode 100644 index cedd6e3c..00000000 --- a/k9-svc/bindings/elixir/lib/k9/renderer.ex +++ /dev/null @@ -1,120 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9.Renderer do - @moduledoc """ - Render a K9 Component AST back to .k9 text. - - Produces K9-formatted output (YAML-like at Kennel level) from a - parsed Component structure. - """ - - alias K9.Types.{Component, Recipes, SecurityLevel, SecurityPolicy, Target, Validation} - - @doc """ - Render a Component to K9-formatted text. - - Produces a complete .k9 file string with pedigree, security, - and optional target/recipes/validation sections. - """ - @spec render(Component.t()) :: String.t() - def render(%Component{} = c) do - parts = render_pedigree(c) - parts = parts ++ ["" | render_security(c.security)] - - parts = - case c.target do - nil -> parts - target -> parts ++ ["" | render_target(target)] - end - - parts = - case c.recipes do - nil -> parts - recipes -> parts ++ ["" | render_recipes(recipes)] - end - - parts = - case c.validation do - nil -> parts - v -> parts ++ ["" | render_validation(v)] - end - - parts = - case c.tags do - [] -> parts - tags -> parts ++ ["", "tags: #{Enum.join(tags, ", ")}"] - end - - Enum.join(parts, "\n") <> "\n" - end - - # --------------------------------------------------------------------------- - # Internal section renderers - # --------------------------------------------------------------------------- - - defp render_pedigree(%Component{pedigree: p}) do - lines = [ - "pedigree:", - " name: #{p.name}", - " version: #{p.version}", - " description: #{p.description}" - ] - - lines = if p.author, do: lines ++ [" author: #{p.author}"], else: lines - lines = if p.license, do: lines ++ [" license: #{p.license}"], else: lines - lines - end - - defp render_security(%SecurityPolicy{} = s) do - [ - "security:", - " level: #{SecurityLevel.to_string(s.level)}", - " allow-network: #{bool_to_string(s.allow_network)}", - " allow-fs-write: #{bool_to_string(s.allow_fs_write)}", - " allow-subprocess: #{bool_to_string(s.allow_subprocess)}" - ] - end - - defp render_target(%Target{} = t) do - lines = ["target:"] - lines = if t.os, do: lines ++ [" os: #{t.os}"], else: lines - - lines = - lines ++ - [ - " edge: #{bool_to_string(t.is_edge)}", - " requires-podman: #{bool_to_string(t.requires_podman)}" - ] - - lines = if t.memory, do: lines ++ [" memory: #{t.memory}"], else: lines - lines - end - - defp render_recipes(%Recipes{} = r) do - lines = ["recipes:"] - lines = if r.install, do: lines ++ [" install: #{r.install}"], else: lines - lines = if r.validate, do: lines ++ [" validate: #{r.validate}"], else: lines - lines = if r.deploy, do: lines ++ [" deploy: #{r.deploy}"], else: lines - lines = if r.migrate, do: lines ++ [" migrate: #{r.migrate}"], else: lines - - lines = - Enum.reduce(r.custom, lines, fn {k, v}, acc -> - acc ++ [" #{k}: #{v}"] - end) - - lines - end - - defp render_validation(%Validation{} = v) do - [ - "validation:", - " checksum: #{v.checksum}", - " pedigree-version: #{v.pedigree_version}", - " hunt-authorized: #{bool_to_string(v.hunt_authorized)}" - ] - end - - defp bool_to_string(true), do: "true" - defp bool_to_string(false), do: "false" -end diff --git a/k9-svc/bindings/elixir/lib/k9/types.ex b/k9-svc/bindings/elixir/lib/k9/types.ex deleted file mode 100644 index 0ae3e81d..00000000 --- a/k9-svc/bindings/elixir/lib/k9/types.ex +++ /dev/null @@ -1,218 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9.Types do - @moduledoc """ - Core data types for K9 (Self-Validating Components). - - Defines the structures for K9 component specifications, including - pedigree metadata, security levels, target platforms, recipes, and contracts. - """ -end - -defmodule K9.Types.Component do - @moduledoc """ - A K9 self-validating component. This is the top-level AST node. - """ - - @type t :: %__MODULE__{ - pedigree: K9.Types.Pedigree.t(), - security: K9.Types.SecurityPolicy.t(), - target: K9.Types.Target.t() | nil, - recipes: K9.Types.Recipes.t() | nil, - validation: K9.Types.Validation.t() | nil, - content: %{String.t() => String.t()}, - tags: [String.t()] - } - - defstruct pedigree: nil, - security: nil, - target: nil, - recipes: nil, - validation: nil, - content: %{}, - tags: [] -end - -defmodule K9.Types.Pedigree do - @moduledoc """ - Pedigree: identity and provenance metadata for a K9 component. - """ - - @type t :: %__MODULE__{ - name: String.t(), - version: String.t(), - description: String.t(), - author: String.t() | nil, - license: String.t() | nil - } - - defstruct name: "", - version: "0.1.0", - description: "", - author: nil, - license: nil -end - -defmodule K9.Types.SecurityLevel do - @moduledoc """ - K9 security levels forming a trust hierarchy. - - - `:kennel` — Pure data, no execution, safe anywhere. - - `:yard` — Controlled execution, limited permissions. - - `:hunt` — Full execution with explicit authorisation required. - """ - - @type t :: :kennel | :yard | :hunt - - @doc """ - Parse a security level from its canonical string representation. - """ - @spec from_string(String.t()) :: {:ok, t()} | {:error, :unknown_security_level} - def from_string(s) do - case String.downcase(String.trim(s)) do - "kennel" -> {:ok, :kennel} - "yard" -> {:ok, :yard} - "hunt" -> {:ok, :hunt} - _ -> {:error, :unknown_security_level} - end - end - - @doc """ - Return the canonical string representation of a security level. - """ - @spec to_string(t()) :: String.t() - def to_string(:kennel), do: "kennel" - def to_string(:yard), do: "yard" - def to_string(:hunt), do: "hunt" - - @doc """ - Compare two security levels. Returns `:lt`, `:eq`, or `:gt`. - """ - @spec compare(t(), t()) :: :lt | :eq | :gt - def compare(a, b), do: compare_int(level_to_int(a), level_to_int(b)) - - defp level_to_int(:kennel), do: 0 - defp level_to_int(:yard), do: 1 - defp level_to_int(:hunt), do: 2 - - defp compare_int(a, b) when a < b, do: :lt - defp compare_int(a, b) when a > b, do: :gt - defp compare_int(_, _), do: :eq -end - -defmodule K9.Types.SecurityPolicy do - @moduledoc """ - Security policy combining the level with specific permission flags. - """ - - @type t :: %__MODULE__{ - level: K9.Types.SecurityLevel.t(), - allow_network: boolean(), - allow_fs_write: boolean(), - allow_subprocess: boolean() - } - - defstruct level: :kennel, - allow_network: false, - allow_fs_write: false, - allow_subprocess: false -end - -defmodule K9.Types.Target do - @moduledoc """ - Target platform constraints. - """ - - @type t :: %__MODULE__{ - os: String.t() | nil, - is_edge: boolean(), - requires_podman: boolean(), - memory: String.t() | nil - } - - defstruct os: nil, - is_edge: false, - requires_podman: false, - memory: nil -end - -defmodule K9.Types.Recipe do - @moduledoc """ - Named recipe for lifecycle operations. - """ - - @type t :: %__MODULE__{ - name: String.t(), - command: String.t() - } - - defstruct name: "", - command: "" -end - -defmodule K9.Types.Recipes do - @moduledoc """ - Collection of standard lifecycle recipes. - """ - - @type t :: %__MODULE__{ - install: String.t() | nil, - validate: String.t() | nil, - deploy: String.t() | nil, - migrate: String.t() | nil, - custom: %{String.t() => String.t()} - } - - defstruct install: nil, - validate: nil, - deploy: nil, - migrate: nil, - custom: %{} -end - -defmodule K9.Types.Validation do - @moduledoc """ - Self-validation block. - """ - - @type t :: %__MODULE__{ - checksum: String.t(), - pedigree_version: String.t(), - hunt_authorized: boolean() - } - - defstruct checksum: "", - pedigree_version: "1.0", - hunt_authorized: false -end - -defmodule K9.Types.Contract do - @moduledoc """ - A contract attached to a K9 component (from the contractile system). - """ - - @type t :: %__MODULE__{ - name: String.t(), - clauses: [K9.Types.ContractClause.t()] - } - - defstruct name: "", - clauses: [] -end - -defmodule K9.Types.ContractClause do - @moduledoc """ - A single clause within a K9 contract. - """ - - @type t :: %__MODULE__{ - clause_type: String.t(), - predicate: String.t(), - verified: boolean() - } - - defstruct clause_type: "", - predicate: "", - verified: false -end diff --git a/k9-svc/bindings/elixir/mix.exs b/k9-svc/bindings/elixir/mix.exs deleted file mode 100644 index 59f85198..00000000 --- a/k9-svc/bindings/elixir/mix.exs +++ /dev/null @@ -1,49 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9.MixProject do - use Mix.Project - - @version "0.1.0" - @source_url "https://github.com/hyperpolymath/k9_ex" - - def project do - [ - app: :k9_ex, - version: @version, - elixir: "~> 1.14", - start_permanent: Mix.env() == :prod, - deps: deps(), - description: description(), - package: package(), - source_url: @source_url - ] - end - - def application do - [ - extra_applications: [:logger] - ] - end - - defp description do - "K9 (Self-Validating Components) parser and renderer for Elixir." - end - - defp package do - [ - name: "k9_ex", - licenses: ["MPL-2.0"], - links: %{ - "GitHub" => @source_url, - "K9 Specification" => "https://github.com/hyperpolymath/k9-showcase" - } - ] - end - - defp deps do - [ - {:ex_doc, "~> 0.34", only: :dev, runtime: false} - ] - end -end diff --git a/k9-svc/bindings/elixir/test/k9_test.exs b/k9-svc/bindings/elixir/test/k9_test.exs deleted file mode 100644 index ecb1beeb..00000000 --- a/k9-svc/bindings/elixir/test/k9_test.exs +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for Hex.pm) - -defmodule K9Test do - use ExUnit.Case, async: true - - alias K9.Types.{Component, Pedigree, SecurityLevel, SecurityPolicy} - - # --------------------------------------------------------------------------- - # Parser tests - # --------------------------------------------------------------------------- - - test "parse empty input returns error" do - assert K9.parse("") == {:error, :empty_input} - assert K9.parse(" ") == {:error, :empty_input} - end - - test "parse minimal component" do - input = - "pedigree:\n name: hello-k9\n version: 1.0.0\n description: A greeting\n\nsecurity:\n level: kennel" - - assert {:ok, %Component{} = c} = K9.parse(input) - assert c.pedigree.name == "hello-k9" - assert c.pedigree.version == "1.0.0" - assert c.security.level == :kennel - assert c.security.allow_network == false - end - - test "parse security levels" do - assert {:ok, :kennel} = SecurityLevel.from_string("kennel") - assert {:ok, :yard} = SecurityLevel.from_string("Yard") - assert {:ok, :hunt} = SecurityLevel.from_string("HUNT") - assert {:error, :unknown_security_level} = SecurityLevel.from_string("invalid") - end - - test "parse full component" do - input = """ - pedigree: - name: my-component - version: 2.0.0 - description: A full component - author: Jonathan D.A. Jewell - license: MPL-2.0 - - security: - level: yard - allow-network: true - allow-fs-write: false - allow-subprocess: false - - target: - os: Linux - edge: false - requires-podman: true - memory: 512M - - recipes: - install: just install - validate: just check - - tags: parser, k9, elixir - """ - - assert {:ok, %Component{} = c} = K9.parse(input) - assert c.pedigree.name == "my-component" - assert c.pedigree.author == "Jonathan D.A. Jewell" - assert c.pedigree.license == "MPL-2.0" - assert c.security.level == :yard - assert c.security.allow_network == true - assert c.target.os == "Linux" - assert c.target.requires_podman == true - assert c.target.memory == "512M" - assert c.recipes.install == "just install" - assert c.recipes.validate == "just check" - assert c.tags == ["parser", "k9", "elixir"] - end - - test "parse missing pedigree name" do - input = "pedigree:\n version: 1.0.0\n\nsecurity:\n level: kennel" - assert {:error, {:missing_field, "pedigree.name"}} = K9.parse(input) - end - - # --------------------------------------------------------------------------- - # Renderer tests - # --------------------------------------------------------------------------- - - test "render security level strings" do - assert SecurityLevel.to_string(:kennel) == "kennel" - assert SecurityLevel.to_string(:yard) == "yard" - assert SecurityLevel.to_string(:hunt) == "hunt" - end - - test "render minimal component" do - component = %Component{ - pedigree: %Pedigree{ - name: "test-k9", - version: "0.1.0", - description: "Test component" - }, - security: %SecurityPolicy{ - level: :kennel, - allow_network: false, - allow_fs_write: false, - allow_subprocess: false - } - } - - output = K9.render(component) - assert output =~ "pedigree:" - assert output =~ "name: test-k9" - assert output =~ "level: kennel" - end - - test "render roundtrip" do - input = - "pedigree:\n name: roundtrip\n version: 1.0.0\n description: Roundtrip test\n\nsecurity:\n level: yard\n allow-network: true\n allow-fs-write: false\n allow-subprocess: false" - - assert {:ok, c1} = K9.parse(input) - output = K9.render(c1) - assert {:ok, c2} = K9.parse(output) - assert c1.pedigree.name == c2.pedigree.name - assert c1.security.level == c2.security.level - assert c1.security.allow_network == c2.security.allow_network - end - - # --------------------------------------------------------------------------- - # Security level comparison - # --------------------------------------------------------------------------- - - test "security level comparison" do - assert SecurityLevel.compare(:kennel, :hunt) == :lt - assert SecurityLevel.compare(:hunt, :kennel) == :gt - assert SecurityLevel.compare(:yard, :yard) == :eq - end -end diff --git a/k9-svc/bindings/elixir/test/test_helper.exs b/k9-svc/bindings/elixir/test/test_helper.exs deleted file mode 100644 index 869559e7..00000000 --- a/k9-svc/bindings/elixir/test/test_helper.exs +++ /dev/null @@ -1 +0,0 @@ -ExUnit.start() diff --git a/k9-svc/bindings/gleam/.github/workflows/test.yml b/k9-svc/bindings/gleam/.github/workflows/test.yml deleted file mode 100644 index 209358c9..00000000 --- a/k9-svc/bindings/gleam/.github/workflows/test.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: test - -on: - push: - branches: - - master - - main - pull_request: - -jobs: - test: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: erlef/setup-beam@v1 - with: - otp-version: "28" - gleam-version: "1.14.0" - rebar3-version: "3" - # elixir-version: "1" - - run: gleam deps download - - run: gleam test - - run: gleam format --check src test diff --git a/k9-svc/bindings/gleam/.gitignore b/k9-svc/bindings/gleam/.gitignore deleted file mode 100644 index 599be4eb..00000000 --- a/k9-svc/bindings/gleam/.gitignore +++ /dev/null @@ -1,4 +0,0 @@ -*.beam -*.ez -/build -erl_crash.dump diff --git a/k9-svc/bindings/gleam/LICENSE b/k9-svc/bindings/gleam/LICENSE deleted file mode 100644 index f7a3dc82..00000000 --- a/k9-svc/bindings/gleam/LICENSE +++ /dev/null @@ -1,372 +0,0 @@ -Mozilla Public License Version 2.0 -================================== - -1. Definitions --------------- - -1.1. "Contributor" - means each individual or legal entity that creates, contributes to - the creation of, or owns Covered Software. - -1.2. "Contributor Version" - means the combination of the Contributions of others (if any) used - by a Contributor and that particular Contributor's Contribution. - -1.3. "Contribution" - means Covered Software of a particular Contributor. - -1.4. "Covered Software" - means Source Code Form to which the initial Contributor has attached - the notice in Exhibit A, the Executable Form of such Source Code - Form, and Modifications of such Source Code Form, in each case - including portions thereof. - -1.5. "Incompatible With Secondary Licenses" - means - - (a) that the initial Contributor has attached the notice described - in Exhibit B to the Covered Software; or - - (b) that the Covered Software was made available under the terms of - version 1.1 or earlier of the License, but not also under the - terms of a Secondary License. - -1.6. "Executable Form" - means any form of the work other than Source Code Form. - -1.7. "Larger Work" - means a work that combines Covered Software with other material, in - a separate file or files, that is not Covered Software. - -1.8. "License" - means this document. - -1.9. "Licensable" - means having the right to grant, to the maximum extent possible, - whether at the time of the initial grant or subsequently, any and - all of the rights conveyed by this License. - -1.10. "Modifications" - means any of the following: - - (a) any file in Source Code Form that results from an addition to, - deletion from, or modification of the contents of Covered - Software; or - - (b) any new file in Source Code Form that contains any Covered - Software. - -1.11. "Patent Claims" of a Contributor - means any patent claim(s), including without limitation, method, - process, and apparatus claims, in any patent Licensable by such - Contributor that would be infringed, but for the grant of the - License, by the making, using, selling, offering for sale, having - made, import, or transfer of either its Contributions or its - Contributor Version. - -1.12. "Secondary License" - means either the GNU General Public License, Version 2.0, the GNU - Lesser General Public License, Version 2.1, the GNU Affero General - Public License, Version 3.0, or any later versions of those - licenses. - -1.13. "Source Code Form" - means the form of the work preferred for making modifications. - -1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under this - License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. For - purposes of this definition, "control" means (a) the power, direct - or indirect, to cause the direction or management of such entity, - whether by contract or otherwise, or (b) ownership of more than - fifty percent (50%) of the outstanding shares or beneficial - ownership of such entity. - -2. License Grants and Conditions --------------------------------- - -2.1. Grants - -Each Contributor hereby grants You a world-wide, royalty-free, -non-exclusive license: - -(a) under intellectual property rights (other than patent or trademark) - Licensable by such Contributor to use, reproduce, make available, - modify, display, perform, distribute, and otherwise exploit its - Contributions, either on an unmodified basis, with Modifications, or - as part of a Larger Work; and - -(b) under Patent Claims of such Contributor to make, use, sell, offer - for sale, have made, import, and otherwise transfer either its - Contributions or its Contributor Version. - -2.2. Effective Date - -The licenses granted in Section 2.1 with respect to any Contribution -become effective for each Contribution on the date the Contributor first -distributes such Contribution. - -2.3. Limitations on Grant Scope - -The licenses granted in this Section 2 are the only rights granted under -this License. No additional rights or licenses will be implied from the -distribution or licensing of Covered Software under this License. -Notwithstanding Section 2.1(b) above, no patent license is granted by a -Contributor: - -(a) for any code that a Contributor has removed from Covered Software; - or - -(b) for infringements caused by: (i) Your and any other third party's - modifications of Covered Software, or (ii) the combination of its - Contributions with other software (except as part of its Contributor - Version); or - -(c) under Patent Claims infringed by Covered Software in the absence of - its Contributions. - -This License does not grant any rights in the trademarks, service marks, -or logos of any Contributor (except as may be necessary to comply with -the notice requirements in Section 3.4). - -2.4. Subsequent Licenses - -No Contributor makes additional grants as a result of Your choice to -distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License (if -permitted under the terms of Section 3.3). - -2.5. Representation - -Each Contributor represents that the Contributor believes its -Contributions are its original creation(s) or it has sufficient rights -to grant the rights to its Contributions conveyed by this License. - -2.6. Fair Use - -This License is not intended to limit any rights You have under -applicable copyright doctrines of fair use, fair dealing, or other -equivalents. - -2.7. Conditions - -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted -in Section 2.1. - -3. Responsibilities -------------------- - -3.1. Distribution of Source Form - -All distribution of Covered Software in Source Code Form, including any -Modifications that You create or to which You contribute, must be under -the terms of this License. You must inform recipients that the Source -Code Form of the Covered Software is governed by the terms of this -License, and how they can obtain a copy of this License. You may not -attempt to alter or restrict the recipients' rights in the Source Code -Form. - -3.2. Distribution of Executable Form - -If You distribute Covered Software in Executable Form then: - -(a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients of - the Executable Form how they can obtain a copy of such Source Code - Form by reasonable means in a timely manner, at a charge no more - than the cost of distribution to the recipient; and - -(b) You may distribute such Executable Form under the terms of this - License, or sublicense it under different terms, provided that the - license for the Executable Form does not attempt to limit or alter - the recipients' rights in the Source Code Form under this License. - -3.3. Distribution of a Larger Work - -You may create and distribute a Larger Work under terms of Your choice, -provided that You also comply with the requirements of this License for -the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and the -Covered Software is not Incompatible With Secondary Licenses, this -License permits You to additionally distribute such Covered Software -under the terms of such Secondary License(s), so that the recipient of -the Larger Work may, at their option, further distribute the Covered -Software under the terms of either this License or such Secondary -License(s). - -3.4. Notices - -You may not remove or alter the substance of any license notices -(including copyright notices, patent notices, disclaimers of warranty, -or limitations of liability) contained within the Source Code Form of -the Covered Software, except that You may alter any license notices to -the extent required to remedy known factual inaccuracies. - -3.5. Application of Additional Terms - -You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of Covered -Software. However, You may do so only on Your own behalf, and not on -behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity, or liability obligation is offered by -You alone, and You hereby agree to indemnify every Contributor for any -liability incurred by such Contributor as a result of warranty, support, -indemnity or liability terms You offer. You may include additional -disclaimers of warranty and limitations of liability specific to any -jurisdiction. - -4. Inability to Comply Due to Statute or Regulation ---------------------------------------------------- - -If it is impossible for You to comply with any of the terms of this -License with respect to some or all of the Covered Software due to -statute, judicial order, or regulation then You must: (a) comply with -the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description must -be placed in a text file included with all distributions of the Covered -Software under the name "LEGAL", and must be included in all -distributions of the Covered Software in Source Code Form. - -5. Termination --------------- - -5.1. The rights granted under this License will terminate automatically -if You fail to comply with any of its terms. However, if You become -compliant, then the rights granted under this License from a particular -Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on an -ongoing basis, if such Contributor fails to notify You of the -non-compliance by some reasonable means prior to 60 days after You have -come back into compliance. Moreover, Your grants from a particular -Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is the -first time You have received notice of non-compliance with this License -from such Contributor, and You become compliant prior to 30 days after -Your receipt of the notice. - -5.2. If You initiate litigation against any entity by asserting a patent -infringement claim (excluding declaratory judgment actions, -counter-claims, and cross-claims) alleging that a Contributor Version -directly or indirectly infringes any patent, then the rights granted to -You by any and all Contributors for the Covered Software under Section -2.1 of this License shall terminate. - -5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) which -have been validly granted by You or Your distributors under this License -prior to termination shall survive termination. - -************************************************************************ -* * -* 6. Disclaimer of Warranty * -* ------------------------- * -* * -* Covered Software is provided under this License on an "as is" * -* basis, without warranty of any kind, either expressed, implied, or * -* statutory, including, without limitation, warranties that the * -* Covered Software is free of defects, merchantable, fit for a * -* particular purpose or non-infringing. The entire risk as to the * -* quality and performance of the Covered Software is with You. * -* Should any Covered Software prove defective in any respect, You * -* (not any Contributor) assume the cost of any necessary servicing, * -* repair, or correction. This disclaimer of warranty constitutes an * -* essential part of this License. No use of any Covered Software is * -* authorized under this License except under this disclaimer. * -* * -************************************************************************ - -************************************************************************ -* * -* 7. Limitation of Liability * -* -------------------------- * -* * -* Under no circumstances and under no legal theory, whether tort * -* (including negligence), contract, or otherwise, shall any * -* Contributor, or anyone who distributes Covered Software as * -* permitted above, be liable to You for any direct, indirect, * -* special, incidental, or consequential damages of any character * -* including, without limitation, damages for lost profits, loss of * -* goodwill, work stoppage, computer failure or malfunction, or any * -* and all other commercial damages or losses, even if such party * -* shall have been informed of the possibility of such damages. This * -* limitation of liability shall not apply to liability for death or * -* personal injury resulting from such party's negligence to the * -* extent applicable law prohibits such limitation. Some * -* jurisdictions do not allow the exclusion or limitation of * -* incidental or consequential damages, so this exclusion and * -* limitation may not apply to You. * -* * -************************************************************************ - -8. Litigation -------------- - -Any litigation relating to this License may be brought only in the -courts of a jurisdiction where the defendant maintains its principal -place of business and such litigation shall be governed by laws of that -jurisdiction, without reference to its conflict-of-law provisions. -Nothing in this Section shall prevent a party's ability to bring -cross-claims or counter-claims. - -9. Miscellaneous ----------------- - -This License represents the complete agreement concerning the subject -matter hereof. If any provision of this License is held to be -unenforceable, such provision shall be reformed only to the extent -necessary to make it enforceable. Any law or regulation which provides -that the language of a contract shall be construed against the drafter -shall not be used to construe this License against a Contributor. - -10. Versions of the License ---------------------------- - -10.1. New Versions - -Mozilla Foundation is the license steward. Except as provided in Section -10.3, no one other than the license steward has the right to modify or -publish new versions of this License. Each version will be given a -distinguishing version number. - -10.2. Effect of New Versions - -You may distribute the Covered Software under the terms of the version -of the License under which You originally received the Covered Software, -or under the terms of any subsequent version published by the license -steward. - -10.3. Modified Versions - -If you create software not governed by this License, and you want to -create a new license for such software, you may create and use a -modified version of this License if you rename the license and remove -any references to the name of the license steward (except to note that -such modified license differs from this License). - -10.4. Distributing Source Code Form that is Incompatible With Secondary -Licenses - -If You choose to distribute Source Code Form that is Incompatible With -Secondary Licenses under the terms of this version of the License, the -notice described in Exhibit B of this License must be attached. - -Exhibit A - Source Code Form License Notice -------------------------------------------- - - This Source Code Form is subject to the terms of the Mozilla Public - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at https://mozilla.org/MPL/2.0/. - -If it is not possible or desirable to put the notice in a particular -file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to look -for such a notice. - -You may add additional accurate notices of copyright ownership. - -Exhibit B - "Incompatible With Secondary Licenses" Notice ---------------------------------------------------------- - - This Source Code Form is "Incompatible With Secondary Licenses", as - defined by the Mozilla Public License, v. 2.0. diff --git a/k9-svc/bindings/gleam/README.adoc b/k9-svc/bindings/gleam/README.adoc deleted file mode 100644 index ad988bff..00000000 --- a/k9-svc/bindings/gleam/README.adoc +++ /dev/null @@ -1,127 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// (MPL-2.0 required for Hex.pm) -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -= k9_gleam -:author: Jonathan D.A. Jewell -:revdate: 2026-03-17 -:toc: preamble -:icons: font - -K9 (Self-Validating Components) parser and renderer for -https://gleam.run[Gleam]. Parse and render K9 component specifications with -full type safety on the BEAM or JavaScript targets. - -== What It Does - -`k9_gleam` provides a typed AST, parser, and renderer for the K9 format -- -a security-tiered configuration language built on Nickel contracts. K9 files -embed pedigree metadata, security levels, build recipes, and validation -checksums directly in the document. - -The library handles both K9 syntax variants: - -* `.k9` -- YAML-like declarative syntax (Kennel level) -* `.k9.ncl` -- Nickel-based programmable syntax (Yard/Hunt level) - -== Installation - -[source,sh] ----- -gleam add k9_gleam ----- - -This adds `k9_gleam` to your `gleam.toml` dependencies from -https://hex.pm/packages/k9_gleam[Hex.pm]. - -== Usage - -[source,gleam] ----- -import k9_gleam -import k9_gleam/parser -import k9_gleam/renderer - -pub fn main() { - let input = - "pedigree:\n name: hello-k9\n version: 1.0.0\n description: A greeting\n\nsecurity:\n level: kennel" - - // Parse a K9 string into a Component AST - let assert Ok(component) = k9_gleam.parse(input) - - // Render the AST back to K9 format - let output = k9_gleam.render(component) -} ----- - -== API Overview - -=== Top-Level Convenience Functions - -`k9_gleam.parse(input: String) -> Result(Component, ParseError)`:: - Parse a K9 file string into a `Component`. Delegates to `parser.parse`. - -`k9_gleam.render(component: Component) -> String`:: - Render a `Component` back to K9 surface syntax. Delegates to `renderer.render`. - -=== Modules - -`k9_gleam/types`:: - Core data types for the K9 AST. - -`k9_gleam/parser`:: - Parser implementation. Accepts `.k9` and `.k9.ncl` content. - -`k9_gleam/renderer`:: - Renderer that produces K9 surface syntax from the AST. - -=== Key Types - -[cols="1,3"] -|=== -| Type | Description - -| `Component` -| Top-level AST node. Contains pedigree, security, target, recipes, - validation, content map, and tags. - -| `Pedigree` -| Identity metadata: name, version, description, author, license. - -| `SecurityLevel` -| Trust tier enum: `Kennel`, `Yard`, or `Hunt`. - -| `SecurityPolicy` -| Security level plus permission flags (network, filesystem write, subprocess). - -| `Target` -| Platform constraints: OS, edge mode, Podman requirement, memory. - -| `Recipes` -| Lifecycle recipes: install, validate, deploy, migrate, plus custom recipes. - -| `Validation` -| Self-validation block: checksum, pedigree version, hunt authorisation. - -| `Contract` / `ContractClause` -| Contractile system integration (must/trust/dust/intend/k9 clauses). -|=== - -== Dependencies - -* `gleam_stdlib` >= 0.44.0 -* `gleeunit` (dev only) >= 1.0.0 - -== Links - -* https://hex.pm/packages/k9_gleam[Hex.pm package] -* https://hexdocs.pm/k9_gleam[HexDocs API reference] -* https://github.com/hyperpolymath/standards/tree/main/k9-svc/SPEC.adoc[K9 specification] - -== Part of the K9 Ecosystem - -This binding is part of the -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9 Self-Validating Components] -suite within the `standards` monorepo. See -link:../README.adoc[`bindings/README.adoc`] for the full feature matrix across -all five language bindings. diff --git a/k9-svc/bindings/gleam/gleam.toml b/k9-svc/bindings/gleam/gleam.toml deleted file mode 100644 index 4bcaf339..00000000 --- a/k9-svc/bindings/gleam/gleam.toml +++ /dev/null @@ -1,12 +0,0 @@ -name = "k9_gleam" -version = "0.1.0" -description = "K9 (Self-Validating Components) parser and renderer for Gleam" -licences = ["MPL-2.0"] -repository = { type = "github", user = "hyperpolymath", repo = "k9_gleam" } -links = [{ title = "K9 Specification", href = "https://github.com/hyperpolymath/k9-showcase" }] - -[dependencies] -gleam_stdlib = ">= 0.44.0 and < 2.0.0" - -[dev-dependencies] -gleeunit = ">= 1.0.0 and < 2.0.0" diff --git a/k9-svc/bindings/gleam/manifest.toml b/k9-svc/bindings/gleam/manifest.toml deleted file mode 100644 index c79796d0..00000000 --- a/k9-svc/bindings/gleam/manifest.toml +++ /dev/null @@ -1,11 +0,0 @@ -# This file was generated by Gleam -# You typically do not need to edit this file - -packages = [ - { name = "gleam_stdlib", version = "0.70.0", build_tools = ["gleam"], requirements = [], otp_app = "gleam_stdlib", source = "hex", outer_checksum = "86949BF5D1F0E4AC0AB5B06F235D8A5CC11A2DFC33BF22F752156ED61CA7D0FF" }, - { name = "gleeunit", version = "1.9.0", build_tools = ["gleam"], requirements = ["gleam_stdlib"], otp_app = "gleeunit", source = "hex", outer_checksum = "DA9553CE58B67924B3C631F96FE3370C49EB6D6DC6B384EC4862CC4AAA718F3C" }, -] - -[requirements] -gleam_stdlib = { version = ">= 0.44.0 and < 2.0.0" } -gleeunit = { version = ">= 1.0.0 and < 2.0.0" } diff --git a/k9-svc/bindings/gleam/src/k9_gleam.gleam b/k9-svc/bindings/gleam/src/k9_gleam.gleam deleted file mode 100644 index 8f3abf53..00000000 --- a/k9-svc/bindings/gleam/src/k9_gleam.gleam +++ /dev/null @@ -1,39 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for Hex.pm) -// -// k9_gleam — K9 (Self-Validating Components) parser and renderer. -// -// Provides types, parsing, and rendering for K9 component specifications. -// K9 is a format for self-validating software components with built-in -// security levels (Kennel/Yard/Hunt), pedigree metadata, and lifecycle -// recipes. -// -// ## Example -// -// ```gleam -// import k9_gleam -// import k9_gleam/parser -// import k9_gleam/renderer -// -// let input = "pedigree:\n name: hello-k9\n version: 1.0.0\n description: A greeting\n\nsecurity:\n level: kennel" -// let assert Ok(component) = parser.parse(input) -// let output = renderer.render(component) -// ``` - -import k9_gleam/parser -import k9_gleam/renderer -import k9_gleam/types.{type Component} - -/// Parse a .k9 file string into a Component. -/// -/// Re-exports `parser.parse` for convenience. -pub fn parse(input: String) -> Result(Component, parser.ParseError) { - parser.parse(input) -} - -/// Render a Component back to .k9 format text. -/// -/// Re-exports `renderer.render` for convenience. -pub fn render(component: Component) -> String { - renderer.render(component) -} diff --git a/k9-svc/bindings/gleam/src/k9_gleam/parser.gleam b/k9-svc/bindings/gleam/src/k9_gleam/parser.gleam deleted file mode 100644 index 0671387d..00000000 --- a/k9-svc/bindings/gleam/src/k9_gleam/parser.gleam +++ /dev/null @@ -1,368 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for Hex.pm) -// -// k9_gleam/parser — K9 component specification parser. -// -// Parses .k9 files (YAML-like at Kennel level) into the Component AST. -// K9 files use a simple key-value format with sections denoted by -// indentation and section headers ending with a colon. - -import gleam/dict -import gleam/list -import gleam/result -import gleam/string - -import k9_gleam/types.{ - type Component, type Pedigree, type Recipes, type SecurityLevel, - type SecurityPolicy, type Target, type Validation, Component, Hunt, Kennel, - Pedigree, Recipes, SecurityPolicy, Target, Validation, Yard, -} - -/// Error type for parse failures. -pub type ParseError { - /// The input was empty or contained only whitespace. - EmptyInput - /// A syntax error was encountered at the given line number. - SyntaxError(line: Int, message: String) - /// An unknown security level string was encountered. - UnknownSecurityLevel(value: String) - /// A required field is missing. - MissingField(field: String) -} - -/// Parse a .k9 file string into a Component. -/// -/// Returns `Ok(Component)` on success or `Error(ParseError)` on failure. -pub fn parse(input: String) -> Result(Component, ParseError) { - let trimmed = string.trim(input) - case trimmed { - "" -> Error(EmptyInput) - _ -> parse_component(trimmed) - } -} - -/// Parse a security level from its canonical string representation. -/// -/// Recognised values (case-insensitive): "kennel", "yard", "hunt". -pub fn parse_security_level(input: String) -> Result(SecurityLevel, ParseError) { - case string.lowercase(string.trim(input)) { - "kennel" -> Ok(Kennel) - "yard" -> Ok(Yard) - "hunt" -> Ok(Hunt) - other -> Error(UnknownSecurityLevel(other)) - } -} - -// --------------------------------------------------------------------------- -// Internal parsing -// --------------------------------------------------------------------------- - -/// Parse a complete component from non-empty trimmed input. -fn parse_component(input: String) -> Result(Component, ParseError) { - let lines = string.split(input, "\n") - let sections = split_sections(lines) - - // Extract the pedigree section (required). - let pedigree_fields = find_section(sections, "pedigree") - use pedigree <- result.try(parse_pedigree(pedigree_fields)) - - // Extract security section (required). - let security_fields = find_section(sections, "security") - use security <- result.try(parse_security(security_fields)) - - // Extract optional sections. - let target = parse_target(find_section(sections, "target")) - let recipes = parse_recipes(find_section(sections, "recipes")) - let validation = parse_validation(find_section(sections, "validation")) - - // Extract tags — may appear at top level or within the last section - // because "tags: a, b" is parsed as a field (not a section header). - let tags = - sections - |> list.flat_map(fn(section) { - case find_field(section.1, "tags") { - "" -> [] - tag_str -> - tag_str - |> string.split(",") - |> list.map(string.trim) - |> list.filter(fn(t) { t != "" }) - } - }) - - Ok(Component( - pedigree: pedigree, - security: security, - target: target, - recipes: recipes, - validation: validation, - content: dict.new(), - tags: tags, - )) -} - -/// Split input lines into named sections. -/// Each section is a tuple of (section_name, field_lines). -fn split_sections( - lines: List(String), -) -> List(#(String, List(#(String, String)))) { - split_sections_acc(lines, "", [], []) -} - -fn split_sections_acc( - lines: List(String), - current_section: String, - current_fields: List(#(String, String)), - acc: List(#(String, List(#(String, String)))), -) -> List(#(String, List(#(String, String)))) { - case lines { - [] -> { - // Flush remaining section. - let acc = case current_fields { - [] -> acc - _ -> [#(current_section, list.reverse(current_fields)), ..acc] - } - list.reverse(acc) - } - [line, ..rest] -> { - let trimmed = string.trim(line) - case trimmed { - // Skip blank lines and comments. - "" -> split_sections_acc(rest, current_section, current_fields, acc) - _ -> - case string.starts_with(trimmed, "#") { - True -> - split_sections_acc(rest, current_section, current_fields, acc) - False -> - case is_section_header(line, trimmed) { - // New section header (non-indented, ends with ":"). - True -> { - let section_name = - string.lowercase( - string.trim(string.drop_end(trimmed, 1)), - ) - // Flush previous section. - let acc = case current_fields { - [] -> acc - _ -> [ - #(current_section, list.reverse(current_fields)), - ..acc - ] - } - split_sections_acc(rest, section_name, [], acc) - } - // Field line (indented key: value). - False -> { - case string.split_once(trimmed, ":") { - Ok(#(key, value)) -> { - let field = #( - string.lowercase(string.trim(key)), - string.trim(value), - ) - split_sections_acc( - rest, - current_section, - [field, ..current_fields], - acc, - ) - } - Error(_) -> - split_sections_acc( - rest, - current_section, - current_fields, - acc, - ) - } - } - } - } - } - } - } -} - -/// Check if a line is a section header (not indented, ends with ":"). -fn is_section_header(raw_line: String, trimmed: String) -> Bool { - case string.ends_with(trimmed, ":") { - False -> False - True -> { - // Must not be indented. - case - string.starts_with(raw_line, " ") - || string.starts_with(raw_line, "\t") - { - True -> False - False -> { - // Must not contain ":" in the middle (i.e., it's just "word:"). - let without_colon = string.drop_end(trimmed, 1) - case string.contains(without_colon, ":") { - True -> False - False -> True - } - } - } - } - } -} - -/// Find a section by name, returning its fields or an empty list. -fn find_section( - sections: List(#(String, List(#(String, String)))), - name: String, -) -> List(#(String, String)) { - sections - |> list.find(fn(s) { s.0 == name }) - |> result.map(fn(s) { s.1 }) - |> result.unwrap([]) -} - -/// Find a field value by key in a list of fields. -fn find_field(fields: List(#(String, String)), key: String) -> String { - fields - |> list.find(fn(pair) { pair.0 == key }) - |> result.map(fn(pair) { pair.1 }) - |> result.unwrap("") -} - -/// Parse the pedigree section into a Pedigree. -fn parse_pedigree( - fields: List(#(String, String)), -) -> Result(Pedigree, ParseError) { - let name = find_field(fields, "name") - case name { - "" -> Error(MissingField("pedigree.name")) - _ -> { - let version = case find_field(fields, "version") { - "" -> "0.1.0" - v -> v - } - let description = find_field(fields, "description") - let author = case find_field(fields, "author") { - "" -> Error(Nil) - a -> Ok(a) - } - let license = case find_field(fields, "license") { - "" -> Error(Nil) - l -> Ok(l) - } - Ok(Pedigree( - name: name, - version: version, - description: description, - author: author, - license: license, - )) - } - } -} - -/// Parse the security section into a SecurityPolicy. -fn parse_security( - fields: List(#(String, String)), -) -> Result(SecurityPolicy, ParseError) { - let level_str = find_field(fields, "level") - use level <- result.try(case level_str { - "" -> Ok(Kennel) - s -> parse_security_level(s) - }) - - let allow_network = parse_bool_field(fields, "allow-network") - let allow_fs_write = parse_bool_field(fields, "allow-fs-write") - let allow_subprocess = parse_bool_field(fields, "allow-subprocess") - - Ok(SecurityPolicy( - level: level, - allow_network: allow_network, - allow_fs_write: allow_fs_write, - allow_subprocess: allow_subprocess, - )) -} - -/// Parse a boolean field, defaulting to False. -fn parse_bool_field(fields: List(#(String, String)), key: String) -> Bool { - case string.lowercase(find_field(fields, key)) { - "true" | "yes" -> True - _ -> False - } -} - -/// Parse the optional target section. -fn parse_target(fields: List(#(String, String))) -> Result(Target, Nil) { - case fields { - [] -> Error(Nil) - _ -> - Ok(Target( - os: case find_field(fields, "os") { - "" -> Error(Nil) - o -> Ok(o) - }, - is_edge: parse_bool_field(fields, "edge"), - requires_podman: parse_bool_field(fields, "requires-podman"), - memory: case find_field(fields, "memory") { - "" -> Error(Nil) - m -> Ok(m) - }, - )) - } -} - -/// Parse the optional recipes section. -fn parse_recipes(fields: List(#(String, String))) -> Result(Recipes, Nil) { - case fields { - [] -> Error(Nil) - _ -> { - let standard_keys = ["install", "validate", "deploy", "migrate"] - let custom = - fields - |> list.filter(fn(pair) { - !list.contains(standard_keys, pair.0) && pair.1 != "" - }) - |> dict.from_list - - Ok(Recipes( - install: case find_field(fields, "install") { - "" -> Error(Nil) - c -> Ok(c) - }, - validate: case find_field(fields, "validate") { - "" -> Error(Nil) - c -> Ok(c) - }, - deploy: case find_field(fields, "deploy") { - "" -> Error(Nil) - c -> Ok(c) - }, - migrate: case find_field(fields, "migrate") { - "" -> Error(Nil) - c -> Ok(c) - }, - custom: custom, - )) - } - } -} - -/// Parse the optional validation section. -fn parse_validation( - fields: List(#(String, String)), -) -> Result(Validation, Nil) { - case fields { - [] -> Error(Nil) - _ -> { - let checksum = find_field(fields, "checksum") - case checksum { - "" -> Error(Nil) - _ -> - Ok(Validation( - checksum: checksum, - pedigree_version: case find_field(fields, "pedigree-version") { - "" -> "1.0" - v -> v - }, - hunt_authorized: parse_bool_field(fields, "hunt-authorized"), - )) - } - } - } -} diff --git a/k9-svc/bindings/gleam/src/k9_gleam/renderer.gleam b/k9-svc/bindings/gleam/src/k9_gleam/renderer.gleam deleted file mode 100644 index d61896ca..00000000 --- a/k9-svc/bindings/gleam/src/k9_gleam/renderer.gleam +++ /dev/null @@ -1,178 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for Hex.pm) -// -// k9_gleam/renderer — Render a K9 Component AST back to .k9 text. -// -// Produces K9-formatted output (YAML-like at Kennel level) from a -// parsed Component structure. - -import gleam/dict -import gleam/list -import gleam/string - -import k9_gleam/types.{ - type Component, type SecurityLevel, type SecurityPolicy, Hunt, Kennel, Yard, -} - -/// Render a Component to K9-formatted text. -/// -/// Produces a complete .k9 file string with pedigree, security, -/// and optional target/recipes/validation sections. -pub fn render(component: Component) -> String { - let parts = [] - - // Pedigree section. - let parts = list.append(parts, render_pedigree(component)) - - // Security section. - let parts = list.append(parts, ["", ..render_security(component.security)]) - - // Target section (optional). - let parts = case component.target { - Ok(target) -> list.append(parts, ["", ..render_target(target)]) - Error(_) -> parts - } - - // Recipes section (optional). - let parts = case component.recipes { - Ok(recipes) -> list.append(parts, ["", ..render_recipes(recipes)]) - Error(_) -> parts - } - - // Validation section (optional). - let parts = case component.validation { - Ok(v) -> list.append(parts, ["", ..render_validation(v)]) - Error(_) -> parts - } - - // Tags (top-level). - let parts = case component.tags { - [] -> parts - tags -> - list.append(parts, ["", "tags: " <> string.join(tags, ", ")]) - } - - string.join(parts, "\n") <> "\n" -} - -/// Render a SecurityLevel to its canonical string representation. -pub fn render_security_level(level: SecurityLevel) -> String { - case level { - Kennel -> "kennel" - Yard -> "yard" - Hunt -> "hunt" - } -} - -// --------------------------------------------------------------------------- -// Internal section renderers -// --------------------------------------------------------------------------- - -/// Render the pedigree section. -fn render_pedigree(component: Component) -> List(String) { - let p = component.pedigree - let lines = [ - "pedigree:", - " name: " <> p.name, - " version: " <> p.version, - " description: " <> p.description, - ] - - let lines = case p.author { - Ok(a) -> list.append(lines, [" author: " <> a]) - Error(_) -> lines - } - - let lines = case p.license { - Ok(l) -> list.append(lines, [" license: " <> l]) - Error(_) -> lines - } - - lines -} - -/// Render the security section. -fn render_security(security: SecurityPolicy) -> List(String) { - [ - "security:", - " level: " <> render_security_level(security.level), - " allow-network: " <> bool_to_string(security.allow_network), - " allow-fs-write: " <> bool_to_string(security.allow_fs_write), - " allow-subprocess: " <> bool_to_string(security.allow_subprocess), - ] -} - -/// Render the target section. -fn render_target(target: types.Target) -> List(String) { - let lines = ["target:"] - - let lines = case target.os { - Ok(os) -> list.append(lines, [" os: " <> os]) - Error(_) -> lines - } - - let lines = - list.append(lines, [ - " edge: " <> bool_to_string(target.is_edge), - " requires-podman: " <> bool_to_string(target.requires_podman), - ]) - - let lines = case target.memory { - Ok(m) -> list.append(lines, [" memory: " <> m]) - Error(_) -> lines - } - - lines -} - -/// Render the recipes section. -fn render_recipes(recipes: types.Recipes) -> List(String) { - let lines = ["recipes:"] - - let lines = case recipes.install { - Ok(c) -> list.append(lines, [" install: " <> c]) - Error(_) -> lines - } - - let lines = case recipes.validate { - Ok(c) -> list.append(lines, [" validate: " <> c]) - Error(_) -> lines - } - - let lines = case recipes.deploy { - Ok(c) -> list.append(lines, [" deploy: " <> c]) - Error(_) -> lines - } - - let lines = case recipes.migrate { - Ok(c) -> list.append(lines, [" migrate: " <> c]) - Error(_) -> lines - } - - // Custom recipes. - let custom_entries = dict.to_list(recipes.custom) - let lines = - list.fold(custom_entries, lines, fn(acc, entry) { - list.append(acc, [" " <> entry.0 <> ": " <> entry.1]) - }) - - lines -} - -/// Render the validation section. -fn render_validation(v: types.Validation) -> List(String) { - [ - "validation:", - " checksum: " <> v.checksum, - " pedigree-version: " <> v.pedigree_version, - " hunt-authorized: " <> bool_to_string(v.hunt_authorized), - ] -} - -/// Convert a Bool to a lowercase string. -fn bool_to_string(b: Bool) -> String { - case b { - True -> "true" - False -> "false" - } -} diff --git a/k9-svc/bindings/gleam/src/k9_gleam/types.gleam b/k9-svc/bindings/gleam/src/k9_gleam/types.gleam deleted file mode 100644 index 445b38a0..00000000 --- a/k9-svc/bindings/gleam/src/k9_gleam/types.gleam +++ /dev/null @@ -1,147 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for Hex.pm) -// -// k9_gleam/types — Core data types for K9 (Self-Validating Components). -// -// Defines the abstract syntax tree for K9 component specifications, including -// pedigree metadata, security levels, target platforms, recipes, and contracts. - -import gleam/dict.{type Dict} - -/// A K9 self-validating component. This is the top-level AST node. -pub type Component { - Component( - /// Identity and provenance metadata. - pedigree: Pedigree, - /// Security level and permission flags. - security: SecurityPolicy, - /// Optional target platform constraints. - target: Result(Target, Nil), - /// Optional build/deploy/validate recipes. - recipes: Result(Recipes, Nil), - /// Optional self-validation block (checksum, pedigree version). - validation: Result(Validation, Nil), - /// Additional content key-value pairs. - content: Dict(String, String), - /// Tags for categorisation. - tags: List(String), - ) -} - -/// Pedigree: identity and provenance metadata for a K9 component. -pub type Pedigree { - Pedigree( - /// Component name (e.g., "hello-k9"). - name: String, - /// Semantic version string. - version: String, - /// Human-readable description. - description: String, - /// Author identity. - author: Result(String, Nil), - /// SPDX license identifier. - license: Result(String, Nil), - ) -} - -/// K9 security levels forming a trust hierarchy. -/// -/// - `Kennel` — Pure data, no execution, safe anywhere. -/// - `Yard` — Controlled execution, limited permissions. -/// - `Hunt` — Full execution with explicit authorisation required. -pub type SecurityLevel { - /// Pure data only. No code execution. Safe to open anywhere. - Kennel - /// Controlled execution with limited permissions. - Yard - /// Full execution. Requires explicit authorisation. - Hunt -} - -/// Security policy combining the level with specific permission flags. -pub type SecurityPolicy { - SecurityPolicy( - /// The trust level. - level: SecurityLevel, - /// Whether the component may access the network. - allow_network: Bool, - /// Whether the component may write to the filesystem. - allow_fs_write: Bool, - /// Whether the component may spawn subprocesses. - allow_subprocess: Bool, - ) -} - -/// Target platform constraints. -pub type Target { - Target( - /// Target operating system (e.g., "Linux", "Darwin"). - os: Result(String, Nil), - /// Whether this targets edge/embedded environments. - is_edge: Bool, - /// Whether Podman container runtime is required. - requires_podman: Bool, - /// Memory constraint (e.g., "512M", "2G"). - memory: Result(String, Nil), - ) -} - -/// Collection of standard lifecycle recipes. -pub type Recipes { - Recipes( - /// Installation command. - install: Result(String, Nil), - /// Validation / typecheck command. - validate: Result(String, Nil), - /// Deployment command. - deploy: Result(String, Nil), - /// Migration command. - migrate: Result(String, Nil), - /// Additional named recipes. - custom: Dict(String, String), - ) -} - -/// Named recipe for lifecycle operations. -pub type Recipe { - Recipe( - /// Recipe identifier (e.g., "install", "validate"). - name: String, - /// Shell command to execute. - command: String, - ) -} - -/// Self-validation block. -pub type Validation { - Validation( - /// SHA-256 (or other) checksum of the component. - checksum: String, - /// Version of the pedigree schema used. - pedigree_version: String, - /// Whether Hunt-level execution has been explicitly authorised. - hunt_authorized: Bool, - ) -} - -/// A contract attached to a K9 component (from the contractile system). -pub type Contract { - Contract( - /// Contract identifier. - name: String, - /// Individual clauses in the contract. - clauses: List(ContractClause), - ) -} - -/// A single clause within a K9 contract. -pub type ContractClause { - ContractClause( - /// Clause type: "must", "trust", "dust", "intend", "k9". - clause_type: String, - /// The predicate or assertion text. - predicate: String, - /// Whether this clause has been verified. - verified: Bool, - ) -} diff --git a/k9-svc/bindings/gleam/test/k9_gleam_test.gleam b/k9-svc/bindings/gleam/test/k9_gleam_test.gleam deleted file mode 100644 index 306db3bd..00000000 --- a/k9-svc/bindings/gleam/test/k9_gleam_test.gleam +++ /dev/null @@ -1,147 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for Hex.pm) - -import gleam/dict -import k9_gleam/parser -import k9_gleam/renderer -import k9_gleam/types.{ - Component, Hunt, Kennel, Pedigree, SecurityPolicy, Yard, -} -import gleeunit - -pub fn main() -> Nil { - gleeunit.main() -} - -// --------------------------------------------------------------------------- -// Parser tests -// --------------------------------------------------------------------------- - -pub fn parse_empty_input_test() { - let result = parser.parse("") - assert result == Error(parser.EmptyInput) -} - -pub fn parse_minimal_component_test() { - let input = - "pedigree:\n name: hello-k9\n version: 1.0.0\n description: A greeting\n\nsecurity:\n level: kennel" - let assert Ok(component) = parser.parse(input) - assert component.pedigree.name == "hello-k9" - assert component.pedigree.version == "1.0.0" - assert component.security.level == Kennel - assert component.security.allow_network == False -} - -pub fn parse_security_levels_test() { - let assert Ok(Kennel) = parser.parse_security_level("kennel") - let assert Ok(Yard) = parser.parse_security_level("Yard") - let assert Ok(Hunt) = parser.parse_security_level("HUNT") - let assert Error(parser.UnknownSecurityLevel("invalid")) = - parser.parse_security_level("invalid") -} - -pub fn parse_full_component_test() { - let input = - "pedigree: - name: my-component - version: 2.0.0 - description: A full component - author: Jonathan D.A. Jewell - license: MPL-2.0 - -security: - level: yard - allow-network: true - allow-fs-write: false - allow-subprocess: false - -target: - os: Linux - edge: false - requires-podman: true - memory: 512M - -recipes: - install: just install - validate: just check - -tags: parser, k9, gleam" - - let assert Ok(component) = parser.parse(input) - assert component.pedigree.name == "my-component" - assert component.pedigree.author == Ok("Jonathan D.A. Jewell") - assert component.pedigree.license == Ok("MPL-2.0") - assert component.security.level == Yard - assert component.security.allow_network == True - let assert Ok(target) = component.target - assert target.os == Ok("Linux") - assert target.requires_podman == True - assert target.memory == Ok("512M") - let assert Ok(recipes) = component.recipes - assert recipes.install == Ok("just install") - assert recipes.validate == Ok("just check") -} - -pub fn parse_missing_pedigree_name_test() { - let input = "pedigree:\n version: 1.0.0\n\nsecurity:\n level: kennel" - let assert Error(parser.MissingField("pedigree.name")) = parser.parse(input) -} - -// --------------------------------------------------------------------------- -// Renderer tests -// --------------------------------------------------------------------------- - -pub fn render_security_level_test() { - assert renderer.render_security_level(Kennel) == "kennel" - assert renderer.render_security_level(Yard) == "yard" - assert renderer.render_security_level(Hunt) == "hunt" -} - -pub fn render_minimal_component_test() { - let component = - Component( - pedigree: Pedigree( - name: "test-k9", - version: "0.1.0", - description: "Test component", - author: Error(Nil), - license: Error(Nil), - ), - security: SecurityPolicy( - level: Kennel, - allow_network: False, - allow_fs_write: False, - allow_subprocess: False, - ), - target: Error(Nil), - recipes: Error(Nil), - validation: Error(Nil), - content: dict.new(), - tags: [], - ) - let output = renderer.render(component) - let assert True = output |> contains("pedigree:") - let assert True = output |> contains("name: test-k9") - let assert True = output |> contains("level: kennel") -} - -pub fn render_roundtrip_test() { - let input = - "pedigree:\n name: roundtrip\n version: 1.0.0\n description: Roundtrip test\n\nsecurity:\n level: yard\n allow-network: true\n allow-fs-write: false\n allow-subprocess: false" - let assert Ok(component) = parser.parse(input) - let output = renderer.render(component) - let assert Ok(component2) = parser.parse(output) - assert component.pedigree.name == component2.pedigree.name - assert component.security.level == component2.security.level - assert component.security.allow_network == component2.security.allow_network -} - -// --------------------------------------------------------------------------- -// Helpers -// --------------------------------------------------------------------------- - -import gleam/string - -fn contains(haystack: String, needle: String) -> Bool { - string.contains(haystack, needle) -} diff --git a/k9-svc/bindings/haskell/.devcontainer/Containerfile b/k9-svc/bindings/haskell/.devcontainer/Containerfile deleted file mode 100644 index b0a6fd1b..00000000 --- a/k9-svc/bindings/haskell/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Dev Container image for {{PROJECT_NAME}} -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/{{PROJECT_NAME}} - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/bindings/haskell/.devcontainer/README.adoc b/k9-svc/bindings/haskell/.devcontainer/README.adoc deleted file mode 100644 index 3bfb50e5..00000000 --- a/k9-svc/bindings/haskell/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}> - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/bindings/haskell/.devcontainer/devcontainer.json b/k9-svc/bindings/haskell/.devcontainer/devcontainer.json deleted file mode 100644 index a4b33e0a..00000000 --- a/k9-svc/bindings/haskell/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -// -// Dev Container configuration for {{PROJECT_NAME}} -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "{{PROJECT_NAME}}", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/bindings/haskell/.editorconfig b/k9-svc/bindings/haskell/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/bindings/haskell/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/bindings/haskell/.envrc b/k9-svc/bindings/haskell/.envrc deleted file mode 100644 index 4ca685b4..00000000 --- a/k9-svc/bindings/haskell/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/bindings/haskell/.gitattributes b/k9-svc/bindings/haskell/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/bindings/haskell/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/bindings/haskell/.github/.mailmap b/k9-svc/bindings/haskell/.github/.mailmap deleted file mode 100644 index 0ada9de5..00000000 --- a/k9-svc/bindings/haskell/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}> diff --git a/k9-svc/bindings/haskell/.github/.nojekyll b/k9-svc/bindings/haskell/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/bindings/haskell/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/bindings/haskell/.github/CODEOWNERS b/k9-svc/bindings/haskell/.github/CODEOWNERS deleted file mode 100644 index 611b5a84..00000000 --- a/k9-svc/bindings/haskell/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace {{OWNER}} with your GitHub username or team - -# Default owners for everything -* @{{OWNER}} - -# Security-sensitive files require explicit review -SECURITY.md @{{OWNER}} -.github/workflows/ @{{OWNER}} -Trustfile.a2ml @{{OWNER}} -.machine_readable/ @{{OWNER}} diff --git a/k9-svc/bindings/haskell/.github/CODE_OF_CONDUCT.md b/k9-svc/bindings/haskell/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index 2777a724..00000000 --- a/k9-svc/bindings/haskell/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in {{PROJECT_NAME}} a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://{{FORGE}}/{{OWNER}}/{{REPO}}/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: {{CURRENT_YEAR}} · Based on Contributor Covenant 2.1 diff --git a/k9-svc/bindings/haskell/.github/CONTRIBUTING.md b/k9-svc/bindings/haskell/.github/CONTRIBUTING.md deleted file mode 100644 index 02758c67..00000000 --- a/k9-svc/bindings/haskell/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://{{FORGE}}/{{OWNER}}/{{REPO}}.git -cd {{REPO}} - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create {{REPO}}-dev -toolbox enter {{REPO}}-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -{{REPO}}/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `{{MAIN_BRANCH}}` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/help%20wanted) — Community help needed -- [`documentation`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/documentation) — Docs improvements -- [`perimeter-3`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/bindings/haskell/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/bindings/haskell/.github/FUNDING.yml b/k9-svc/bindings/haskell/.github/FUNDING.yml deleted file mode 100644 index c078261e..00000000 --- a/k9-svc/bindings/haskell/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for {{OWNER}} projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: {{OWNER}} -ko_fi: {{OWNER}} -liberapay: {{OWNER}} diff --git a/k9-svc/bindings/haskell/.github/GOVERNANCE.md b/k9-svc/bindings/haskell/.github/GOVERNANCE.md deleted file mode 100644 index fcbcec0c..00000000 --- a/k9-svc/bindings/haskell/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **{{PROJECT_NAME}}**. - ---- - -## Project Governance Model - -{{PROJECT_NAME}} follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) {{CURRENT_YEAR}} {{OWNER}}. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index ec2aa283..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for {{OWNER}}/{{REPO}} -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index cb7a33cb..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for {{OWNER}}/{{REPO}} -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/{{OWNER}}/{{REPO}}/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 6aa9e631..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for {{OWNER}}/{{REPO}} -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 88e07205..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for {{OWNER}}/{{REPO}} -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 6d88090c..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for {{OWNER}}/{{REPO}} -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index 48bb574e..00000000 --- a/k9-svc/bindings/haskell/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for {{OWNER}}/{{REPO}} -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/bindings/haskell/.github/MAINTAINERS b/k9-svc/bindings/haskell/.github/MAINTAINERS deleted file mode 100644 index 145c4e96..00000000 --- a/k9-svc/bindings/haskell/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -{{AUTHOR}} <{{AUTHOR_EMAIL}}> (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/bindings/haskell/.github/README.adoc b/k9-svc/bindings/haskell/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/bindings/haskell/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/bindings/haskell/.github/SECURITY.md b/k9-svc/bindings/haskell/.github/SECURITY.md deleted file mode 100644 index 7dd7b29e..00000000 --- a/k9-svc/bindings/haskell/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`{{OWNER}}/{{REPO}}`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using {{PROJECT_NAME}}, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ - ---- - -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 diff --git a/k9-svc/bindings/haskell/.github/SUPPORT b/k9-svc/bindings/haskell/.github/SUPPORT deleted file mode 100644 index b06c59a3..00000000 --- a/k9-svc/bindings/haskell/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/{{OWNER}}/{{REPO}}/discussions -- GitHub Issues: https://github.com/{{OWNER}}/{{REPO}}/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/bindings/haskell/.github/copilot-instructions.md b/k9-svc/bindings/haskell/.github/copilot-instructions.md deleted file mode 100644 index 6b44aec8..00000000 --- a/k9-svc/bindings/haskell/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/bindings/haskell/.github/dependabot.yml b/k9-svc/bindings/haskell/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/bindings/haskell/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/bindings/haskell/.github/pull_request_template.md b/k9-svc/bindings/haskell/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/bindings/haskell/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/bindings/haskell/.github/workflows/codeql.yml b/k9-svc/bindings/haskell/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/bindings/haskell/.github/workflows/governance.yml b/k9-svc/bindings/haskell/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/bindings/haskell/.github/workflows/hypatia-scan.yml b/k9-svc/bindings/haskell/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/haskell/.github/workflows/jekyll.yml b/k9-svc/bindings/haskell/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/bindings/haskell/.github/workflows/mirror.yml b/k9-svc/bindings/haskell/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/haskell/.github/workflows/release.yml b/k9-svc/bindings/haskell/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/bindings/haskell/.github/workflows/rhodibot.yml b/k9-svc/bindings/haskell/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/bindings/haskell/.github/workflows/scorecard-enforcer.yml b/k9-svc/bindings/haskell/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/bindings/haskell/.github/workflows/scorecard.yml b/k9-svc/bindings/haskell/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/haskell/.github/workflows/secret-scanner.yml b/k9-svc/bindings/haskell/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/haskell/.github/workflows/static-analysis-gate.yml b/k9-svc/bindings/haskell/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/bindings/haskell/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/bindings/haskell/.gitignore b/k9-svc/bindings/haskell/.gitignore deleted file mode 100644 index 037efd36..00000000 --- a/k9-svc/bindings/haskell/.gitignore +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/bindings/haskell/.gitlab-ci.yml b/k9-svc/bindings/haskell/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/bindings/haskell/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/bindings/haskell/.guix-channel b/k9-svc/bindings/haskell/.guix-channel deleted file mode 100644 index f9bdf68f..00000000 --- a/k9-svc/bindings/haskell/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -;; -;; Guix channel definition for {{PROJECT_NAME}} -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name '{{PROJECT_NAME}}) -;; (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/bindings/haskell/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/bindings/haskell/.machine_readable/CLADE.a2ml b/k9-svc/bindings/haskell/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/bindings/haskell/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/bindings/haskell/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index 1384822c..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "{{PROJECT_NAME}} Development" -# description = "Panels for {{PROJECT_NAME}} development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/bindings/haskell/.machine_readable/README.adoc b/k9-svc/bindings/haskell/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/.clinerules b/k9-svc/bindings/haskell/.machine_readable/ai/.clinerules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/.cursorrules b/k9-svc/bindings/haskell/.machine_readable/ai/.cursorrules deleted file mode 100644 index d3b9cee0..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/.windsurfrules b/k9-svc/bindings/haskell/.machine_readable/ai/.windsurfrules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/AI.a2ml b/k9-svc/bindings/haskell/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/bindings/haskell/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index a1382f4f..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .) -sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .) -sed -i 's/{{OWNER}}/my-org/g' $(grep -rl '{{OWNER}}' .) -sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/{{REPO}}/my-project/g' $(grep -rl '{{REPO}}' .) -sed -i 's/{{FORGE}}/github.com/g' $(grep -rl '{{FORGE}}' .) -sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .) -sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `{{REPO}}` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `{{OWNER}}` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `{{FORGE}}` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md | -| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{LICENSE}}` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/bindings/haskell/.machine_readable/ai/README.adoc b/k9-svc/bindings/haskell/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/bindings/haskell/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/bindings/haskell/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/bindings/haskell/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index 87238998..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "{{OWNER}}/{{REPO}}" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "{{PROJECT_NAME}}" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "{{PROJECT_PURPOSE}}" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/bindings/haskell/.machine_readable/anchors/README.adoc b/k9-svc/bindings/haskell/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/bindings/haskell/.machine_readable/compliance/reuse/dep5 b/k9-svc/bindings/haskell/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 3f5b2ef6..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: {{PROJECT_NAME}} -Upstream-Contact: {{AUTHOR}} <{{AUTHOR_EMAIL}}> -Source: https://github.com/{{OWNER}}/{{REPO}} - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/bindings/haskell/.machine_readable/compliance/rust/deny.toml b/k9-svc/bindings/haskell/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/bindings/haskell/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/bindings/haskell/.machine_readable/configs/README.adoc b/k9-svc/bindings/haskell/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/bindings/haskell/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/bindings/haskell/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index 5c39b484..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# {{OWNER}} — GitHub organization or username -# {{REPO}} — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/bindings/haskell/.machine_readable/contractiles/README.adoc b/k9-svc/bindings/haskell/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/bindings/haskell/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/haskell/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/bindings/haskell/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/haskell/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/bindings/haskell/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/haskell/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 4d5db884..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 5076e0cd..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project] -name = "haskell" -purpose = "" # TODO: describe project purpose -role = "" # TODO: describe project role # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/META.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index d9b09e68..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -type = "library" # TODO: update type (library|binary|service|website|monorepo) # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 1acf7a30..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index 6408e1c7..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/bindings/haskell/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/bindings/haskell/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index a76d8dd6..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "rsr-template-repo" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "rsr-template-repo" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/bindings/haskell/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index eeffd278..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/README.adoc b/k9-svc/bindings/haskell/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/bindings/haskell/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/haskell/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/README.adoc b/k9-svc/bindings/haskell/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/bindings/haskell/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/bindings/haskell/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/bindings/haskell/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/bindings/haskell/.machine_readable/scripts/verification/README.adoc b/k9-svc/bindings/haskell/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/bindings/haskell/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/bindings/haskell/.tool-versions b/k9-svc/bindings/haskell/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/bindings/haskell/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/bindings/haskell/.well-known/ai.txt b/k9-svc/bindings/haskell/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/bindings/haskell/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/bindings/haskell/.well-known/humans.txt b/k9-svc/bindings/haskell/.well-known/humans.txt deleted file mode 100644 index 8891981a..00000000 --- a/k9-svc/bindings/haskell/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: {{AUTHOR}} ({{OWNER}}) -Contact: {{AUTHOR_EMAIL}} -From: United Kingdom - -/* SITE */ -Last update: {{CURRENT_DATE}} -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/bindings/haskell/.well-known/security.txt b/k9-svc/bindings/haskell/.well-known/security.txt deleted file mode 100644 index 5414d508..00000000 --- a/k9-svc/bindings/haskell/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:{{SECURITY_EMAIL}} -Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt -Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md -Hiring: https://{{WEBSITE}}/careers diff --git a/k9-svc/bindings/haskell/0-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/0-AI-MANIFEST.a2ml deleted file mode 100644 index dc12c575..00000000 --- a/k9-svc/bindings/haskell/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **[YOUR-REPO-NAME]**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "{{AUTHOR}} <{{AUTHOR_EMAIL}}>" -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -[YOUR-REPO-NAME]/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/bindings/haskell/CHANGELOG.adoc b/k9-svc/bindings/haskell/CHANGELOG.adoc deleted file mode 100644 index e309b5b5..00000000 --- a/k9-svc/bindings/haskell/CHANGELOG.adoc +++ /dev/null @@ -1,19 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [0.1.0.0] - 2026-03-16 - -==== Added - -* Initial release. -* `+Data.K9.Types+` — Core AST types (Component, Pedigree, -SecurityLevel, SecurityPolicy, Target, Recipes, Validation, Contract). -* `+Data.K9.Parser+` — Parse `+.k9+` (YAML-like) files into the typed -AST. Nickel `+.k9.ncl+` support planned. -* `+Data.K9.Renderer+` — Render the AST back to K9 surface syntax. -* `+Data.K9+` — Convenience re-export module. diff --git a/k9-svc/bindings/haskell/CONTRIBUTING.adoc b/k9-svc/bindings/haskell/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/bindings/haskell/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/bindings/haskell/Containerfile b/k9-svc/bindings/haskell/Containerfile deleted file mode 100644 index d7266bc0..00000000 --- a/k9-svc/bindings/haskell/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Containerfile for {{PROJECT_NAME}} -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/bindings/haskell/Justfile b/k9-svc/bindings/haskell/Justfile deleted file mode 100644 index 9d7a5ff4..00000000 --- a/k9-svc/bindings/haskell/Justfile +++ /dev/null @@ -1,910 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "{{PROJECT_NAME}}" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/bindings/haskell/LICENSE b/k9-svc/bindings/haskell/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/bindings/haskell/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/bindings/haskell/LICENSE-MPL-2.0 b/k9-svc/bindings/haskell/LICENSE-MPL-2.0 deleted file mode 100644 index 14e2f777..00000000 --- a/k9-svc/bindings/haskell/LICENSE-MPL-2.0 +++ /dev/null @@ -1,373 +0,0 @@ -Mozilla Public License Version 2.0 -================================== - -1. Definitions --------------- - -1.1. "Contributor" - means each individual or legal entity that creates, contributes to - the creation of, or owns Covered Software. - -1.2. "Contributor Version" - means the combination of the Contributions of others (if any) used - by a Contributor and that particular Contributor's Contribution. - -1.3. "Contribution" - means Covered Software of a particular Contributor. - -1.4. "Covered Software" - means Source Code Form to which the initial Contributor has attached - the notice in Exhibit A, the Executable Form of such Source Code - Form, and Modifications of such Source Code Form, in each case - including portions thereof. - -1.5. "Incompatible With Secondary Licenses" - means - - (a) that the initial Contributor has attached the notice described - in Exhibit B to the Covered Software; or - - (b) that the Covered Software was made available under the terms of - version 1.1 or earlier of the License, but not also under the - terms of a Secondary License. - -1.6. "Executable Form" - means any form of the work other than Source Code Form. - -1.7. "Larger Work" - means a work that combines Covered Software with other material, in - a separate file or files, that is not Covered Software. - -1.8. "License" - means this document. - -1.9. "Licensable" - means having the right to grant, to the maximum extent possible, - whether at the time of the initial grant or subsequently, any and - all of the rights conveyed by this License. - -1.10. "Modifications" - means any of the following: - - (a) any file in Source Code Form that results from an addition to, - deletion from, or modification of the contents of Covered - Software; or - - (b) any new file in Source Code Form that contains any Covered - Software. - -1.11. "Patent Claims" of a Contributor - means any patent claim(s), including without limitation, method, - process, and apparatus claims, in any patent Licensable by such - Contributor that would be infringed, but for the grant of the - License, by the making, using, selling, offering for sale, having - made, import, or transfer of either its Contributions or its - Contributor Version. - -1.12. "Secondary License" - means either the GNU General Public License, Version 2.0, the GNU - Lesser General Public License, Version 2.1, the GNU Affero General - Public License, Version 3.0, or any later versions of those - licenses. - -1.13. "Source Code Form" - means the form of the work preferred for making modifications. - -1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under this - License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. For - purposes of this definition, "control" means (a) the power, direct - or indirect, to cause the direction or management of such entity, - whether by contract or otherwise, or (b) ownership of more than - fifty percent (50%) of the outstanding shares or beneficial - ownership of such entity. - -2. License Grants and Conditions --------------------------------- - -2.1. Grants - -Each Contributor hereby grants You a world-wide, royalty-free, -non-exclusive license: - -(a) under intellectual property rights (other than patent or trademark) - Licensable by such Contributor to use, reproduce, make available, - modify, display, perform, distribute, and otherwise exploit its - Contributions, either on an unmodified basis, with Modifications, or - as part of a Larger Work; and - -(b) under Patent Claims of such Contributor to make, use, sell, offer - for sale, have made, import, and otherwise transfer either its - Contributions or its Contributor Version. - -2.2. Effective Date - -The licenses granted in Section 2.1 with respect to any Contribution -become effective for each Contribution on the date the Contributor first -distributes such Contribution. - -2.3. Limitations on Grant Scope - -The licenses granted in this Section 2 are the only rights granted under -this License. No additional rights or licenses will be implied from the -distribution or licensing of Covered Software under this License. -Notwithstanding Section 2.1(b) above, no patent license is granted by a -Contributor: - -(a) for any code that a Contributor has removed from Covered Software; - or - -(b) for infringements caused by: (i) Your and any other third party's - modifications of Covered Software, or (ii) the combination of its - Contributions with other software (except as part of its Contributor - Version); or - -(c) under Patent Claims infringed by Covered Software in the absence of - its Contributions. - -This License does not grant any rights in the trademarks, service marks, -or logos of any Contributor (except as may be necessary to comply with -the notice requirements in Section 3.4). - -2.4. Subsequent Licenses - -No Contributor makes additional grants as a result of Your choice to -distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License (if -permitted under the terms of Section 3.3). - -2.5. Representation - -Each Contributor represents that the Contributor believes its -Contributions are its original creation(s) or it has sufficient rights -to grant the rights to its Contributions conveyed by this License. - -2.6. Fair Use - -This License is not intended to limit any rights You have under -applicable copyright doctrines of fair use, fair dealing, or other -equivalents. - -2.7. Conditions - -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted -in Section 2.1. - -3. Responsibilities -------------------- - -3.1. Distribution of Source Form - -All distribution of Covered Software in Source Code Form, including any -Modifications that You create or to which You contribute, must be under -the terms of this License. You must inform recipients that the Source -Code Form of the Covered Software is governed by the terms of this -License, and how they can obtain a copy of this License. You may not -attempt to alter or restrict the recipients' rights in the Source Code -Form. - -3.2. Distribution of Executable Form - -If You distribute Covered Software in Executable Form then: - -(a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients of - the Executable Form how they can obtain a copy of such Source Code - Form by reasonable means in a timely manner, at a charge no more - than the cost of distribution to the recipient; and - -(b) You may distribute such Executable Form under the terms of this - License, or sublicense it under different terms, provided that the - license for the Executable Form does not attempt to limit or alter - the recipients' rights in the Source Code Form under this License. - -3.3. Distribution of a Larger Work - -You may create and distribute a Larger Work under terms of Your choice, -provided that You also comply with the requirements of this License for -the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and the -Covered Software is not Incompatible With Secondary Licenses, this -License permits You to additionally distribute such Covered Software -under the terms of such Secondary License(s), so that the recipient of -the Larger Work may, at their option, further distribute the Covered -Software under the terms of either this License or such Secondary -License(s). - -3.4. Notices - -You may not remove or alter the substance of any license notices -(including copyright notices, patent notices, disclaimers of warranty, -or limitations of liability) contained within the Source Code Form of -the Covered Software, except that You may alter any license notices to -the extent required to remedy known factual inaccuracies. - -3.5. Application of Additional Terms - -You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of Covered -Software. However, You may do so only on Your own behalf, and not on -behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity, or liability obligation is offered by -You alone, and You hereby agree to indemnify every Contributor for any -liability incurred by such Contributor as a result of warranty, support, -indemnity or liability terms You offer. You may include additional -disclaimers of warranty and limitations of liability specific to any -jurisdiction. - -4. Inability to Comply Due to Statute or Regulation ---------------------------------------------------- - -If it is impossible for You to comply with any of the terms of this -License with respect to some or all of the Covered Software due to -statute, judicial order, or regulation then You must: (a) comply with -the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description must -be placed in a text file included with all distributions of the Covered -Software under this License. Except to the extent prohibited by statute -or regulation, such description must be sufficiently detailed for a -recipient of ordinary skill to be able to understand it. - -5. Termination --------------- - -5.1. The rights granted under this License will terminate automatically -if You fail to comply with any of its terms. However, if You become -compliant, then the rights granted under this License from a particular -Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on an -ongoing basis, if such Contributor fails to notify You of the -non-compliance by some reasonable means prior to 60 days after You have -come back into compliance. Moreover, Your grants from a particular -Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is the -first time You have received notice of non-compliance with this License -from such Contributor, and You become compliant prior to 30 days after -Your receipt of the notice. - -5.2. If You initiate litigation against any entity by asserting a patent -infringement claim (excluding declaratory judgment actions, -counter-claims, and cross-claims) alleging that a Contributor Version -directly or indirectly infringes any patent, then the rights granted to -You by any and all Contributors for the Covered Software under Section -2.1 of this License shall terminate. - -5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) which -have been validly granted by You or Your distributors under this License -prior to termination shall survive termination. - -************************************************************************ -* * -* 6. Disclaimer of Warranty * -* ------------------------- * -* * -* Covered Software is provided under this License on an "as is" * -* basis, without warranty of any kind, either expressed, implied, or * -* statutory, including, without limitation, warranties that the * -* Covered Software is free of defects, merchantable, fit for a * -* particular purpose or non-infringing. The entire risk as to the * -* quality and performance of the Covered Software is with You. * -* Should any Covered Software prove defective in any respect, You * -* (not any Contributor) assume the cost of any necessary servicing, * -* repair, or correction. This disclaimer of warranty constitutes an * -* essential part of this License. No use of any Covered Software is * -* authorized under this License except under this disclaimer. * -* * -************************************************************************ - -************************************************************************ -* * -* 7. Limitation of Liability * -* -------------------------- * -* * -* Under no circumstances and under no legal theory, whether tort * -* (including negligence), contract, or otherwise, shall any * -* Contributor, or anyone who distributes Covered Software as * -* permitted above, be liable to You for any direct, indirect, * -* special, incidental, or consequential damages of any character * -* including, without limitation, damages for lost profits, loss of * -* goodwill, work stoppage, computer failure or malfunction, or any * -* and all other commercial damages or losses, even if such party * -* shall have been informed of the possibility of such damages. This * -* limitation of liability shall not apply to liability for death or * -* personal injury resulting from such party's negligence to the * -* extent applicable law prohibits such limitation. Some * -* jurisdictions do not allow the exclusion or limitation of * -* incidental or consequential damages, so this exclusion and * -* limitation may not apply to You. * -* * -************************************************************************ - -8. Litigation -------------- - -Any litigation relating to this License may be brought only in the -courts of a jurisdiction where the defendant maintains its principal -place of business and such litigation shall be governed by laws of that -jurisdiction, without reference to its conflict-of-law provisions. -Nothing in this Section shall prevent a party's ability to bring -cross-claims or counter-claims. - -9. Miscellaneous ----------------- - -This License represents the complete agreement concerning the subject -matter hereof. If any provision of this License is held to be -unenforceable, such provision shall be reformed only to the extent -necessary to make it enforceable. Any law or regulation which provides -that the language of a contract shall be construed against the drafter -shall not be used to construe this License against a Contributor. - -10. Versions of the License ---------------------------- - -10.1. New Versions - -Mozilla Foundation is the license steward. Except as provided in Section -10.3, no one other than the license steward has the right to modify or -publish new versions of this License. Each version will be given a -distinguishing version number. - -10.2. Effect of New Versions - -You may distribute the Covered Software under the terms of the version -of the License under which You originally received the Covered Software, -or under the terms of any subsequent version published by the license -steward. - -10.3. Modified Versions - -If you create software not governed by this License, and you want to -create a new license for such software, you may create and use a -modified version of this License if you rename the license and remove -any references to the name of the license steward (except to note that -such modified license differs from this License). - -10.4. Distributing Source Code Form that is Incompatible With Secondary -Licenses - -If You choose to distribute Source Code Form that is Incompatible With -Secondary Licenses under the terms of this version of the License, the -notice described in Exhibit B of this License must be attached. - -Exhibit A - Source Code Form License Notice -------------------------------------------- - - This Source Code Form is subject to the terms of the Mozilla Public - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. - -If it is not possible or desirable to put the notice in a particular -file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to look -for such a notice. - -You may add additional accurate notices of copyright ownership. - -Exhibit B - "Incompatible With Secondary Licenses" Notice ---------------------------------------------------------- - - This Source Code Form is "Incompatible With Secondary Licenses", as - defined by the Mozilla Public License, v. 2.0. diff --git a/k9-svc/bindings/haskell/README.adoc b/k9-svc/bindings/haskell/README.adoc deleted file mode 100644 index 34c0095c..00000000 --- a/k9-svc/bindings/haskell/README.adoc +++ /dev/null @@ -1,165 +0,0 @@ -= RSR Template Repository -:toc: preamble -:icons: font - -[TIP] -==== -**AI-Assisted Install:** Just tell any AI assistant: + -`Set up {{PROJECT_NAME}} from https://{{FORGE}}/{{OWNER}}/{{REPO}}` + -The AI reads the manifest, asks you a few questions, and handles everything. -==== - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This project follows a **Dual-Track** architecture: -* **Root:** High-level orientation and rich documentation for humans. -* **Sub-directories:** Machine-readable metadata and technical implementation. - -== ABI/FFI Standard (Verified Interface Seams) - -All projects with foreign function interfaces MUST follow this consolidated standard: - -* **ABI (Idris2):** `src/interface/abi/*.idr` (The Specification) -* **FFI (Zig):** `src/interface/ffi/src/*.zig` (The Implementation) -* **Generated:** `src/interface/generated/*.h` (The Artifacts) - -This unification ensures that the "Truth," the "Bridge," and the "Result" are managed as a single architectural unit. - -== AI Gatekeeper Protocol - -All projects MUST include a root `0-AI-MANIFEST.a2ml`. This is the mandatory entry point for all AI agents. It prevents duplicate file errors and preserves architectural invariants across sessions. - -== Repository Structure - -[cols="1,3"] -|=== -|Directory |Purpose - -|`.github/` -|Forge-specific metadata (CODEOWNERS, SECURITY.md, workflows). - -|`.machine_readable/` -|Canonical project state (6 a2ml files), bot directives, and AI guides. - -|`container/` -|Stapeln container ecosystem (selur-compose, vordr, rokur). - -|`docs/` -|Technical documentation sorted by tracks (Theory, Practice, Architecture). - -|`docs/legal/` -|Consolidated legal exhibits and full license texts. - -|`src/interface/` -|Unified ABI/FFI/Generated interface unit. -|=== - -== Container Ecosystem (Stapeln) - -This template includes a complete `container/` directory for the **Stapeln Six** tools: -1. **selur** (Orchestration) -2. **cerro-torre** (Verified Packaging) -3. **svalinn** (Edge Gateway) -4. **vordr** (Monitoring) -5. **rokur** (Secrets) -6. **k9-svc** (Deployment Contracts) - -== Quick Start - -[source,bash] ----- -just init # Interactive bootstrap -just build # Unified build -just test # Unified test -just container-build # Build verified OCI image ----- - -== Contractile System - -This template includes five **contractile files** in `.machine_readable/contractiles/` that make your repository's rules executable: - -[cols="1,2,3"] -|=== -| Tool | File | Purpose - -| `must check` -| `Mustfile.a2ml` -| Physical state invariants (files exist, code compiles, no secrets) - -| `trust verify` -| `Trustfile.a2ml` -| Integrity verification (hashes valid, signatures correct, provenance traceable) - -| `dust status` -| `Dustfile.a2ml` -| Cleanup tasks (stale files, build artifacts, expired tokens) - -| `intend list` -| `Intentfile.a2ml` -| Design intent and roadmap tracking - -| `k9 eval` -| `*.k9.ncl` -| Nickel-based deployment validation -|=== - -=== Installation - -[source,bash] ----- -cargo install contractile - -# Create symlinks for individual commands -for cmd in must trust dust intend k9; do - ln -sf $(which contractile) ~/.local/bin/$cmd -done ----- - -=== Usage - -[source,bash] ----- -# Symlink contractiles to project root (CLI searches ./contractiles/) -ln -sf .machine_readable/contractiles contractiles - -# Run checks -must check # Verify physical state (23 checks in typical RSR project) -trust verify # Verify integrity and provenance -dust status # Show cleanup items -intend list # Show design intents and roadmap - -# Generate Just recipes from contractile files -contractile gen-just # Creates contractile.just (already imported by Justfile) - -# Then use via Just: -just must-check -just trust-verify ----- - -=== Writing Checks - -Contractile files use A2ML format — simple, line-oriented: - -[source] ----- -### check-name -- description: Human-readable description -- run: shell command (exit 0 = pass, non-zero = fail) -- severity: critical | warning | info ----- - -See link:https://github.com/hyperpolymath/contractiles[contractiles documentation] for the full specification. - -== Documentation - -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:GOVERNANCE.adoc[Governance Model] -* link:docs/attribution/MAINTAINERS.adoc[Maintainers & Citations] -* link:SECURITY.adoc[Security Policy] - -== License - -SPDX-License-Identifier: MPL-2.0 -See link:LICENSE[LICENSE] and link:docs/legal/[docs/legal/] for details. diff --git a/k9-svc/bindings/haskell/ROADMAP.adoc b/k9-svc/bindings/haskell/ROADMAP.adoc deleted file mode 100644 index ca34ac8c..00000000 --- a/k9-svc/bindings/haskell/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Haskell Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/bindings/haskell/SECURITY.adoc b/k9-svc/bindings/haskell/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/bindings/haskell/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/bindings/haskell/Setup.hs b/k9-svc/bindings/haskell/Setup.hs deleted file mode 100644 index bce760aa..00000000 --- a/k9-svc/bindings/haskell/Setup.hs +++ /dev/null @@ -1,3 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 -import Distribution.Simple -main = defaultMain diff --git a/k9-svc/bindings/haskell/container/.gatekeeper.yaml b/k9-svc/bindings/haskell/container/.gatekeeper.yaml deleted file mode 120000 index 87731df3..00000000 --- a/k9-svc/bindings/haskell/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/k9-svc/bindings/haskell/container/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/bindings/haskell/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/bindings/haskell/container/Containerfile b/k9-svc/bindings/haskell/container/Containerfile deleted file mode 100644 index ba85260a..00000000 --- a/k9-svc/bindings/haskell/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t {{SERVICE_NAME}}:latest -f container/Containerfile . -# -# Run: -# podman run -p {{PORT}}:{{PORT}} {{SERVICE_NAME}}:latest -# -# Run with persistent volume: -# podman run -p {{PORT}}:{{PORT}} -v {{SERVICE_NAME}}-data:/data {{SERVICE_NAME}}:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/{{SERVICE_NAME}} -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/{{SERVICE_NAME}}/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/{{SERVICE_NAME}} -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ - org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ - org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} -# COPY --from=builder /build/_build/prod/rel/{{SERVICE_NAME}} /app/release/ -# COPY --from=builder /build/zig-out/bin/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT={{PORT}} -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE {{PORT}} - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/haskell/container/README.adoc b/k9-svc/bindings/haskell/container/README.adoc deleted file mode 100644 index 9f7f7f05..00000000 --- a/k9-svc/bindings/haskell/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -= {{PROJECT_NAME}} Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/bindings/haskell/container/compose.example.toml b/k9-svc/bindings/haskell/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/bindings/haskell/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/haskell/container/compose.toml b/k9-svc/bindings/haskell/container/compose.toml deleted file mode 100644 index a14f8a00..00000000 --- a/k9-svc/bindings/haskell/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f {{SERVICE_NAME}} # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.{{SERVICE_NAME}}] -image = "{{REGISTRY}}/{{SERVICE_NAME}}:latest.ctp" -ports = ["{{PORT}}:{{PORT}}"] -environment = { - APP_HOST = "[::]", - APP_PORT = "{{PORT}}", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["{{SERVICE_NAME}}-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:{{PORT}}/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://{{SERVICE_NAME}}:{{PORT}}", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["{{SERVICE_NAME}}"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.{{SERVICE_NAME}}-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/haskell/container/ct-build.sh b/k9-svc/bindings/haskell/container/ct-build.sh deleted file mode 100755 index a54a5418..00000000 --- a/k9-svc/bindings/haskell/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: {{SERVICE_NAME}}-release) -# CT_REGISTRY — OCI registry to push to (default: {{REGISTRY}}) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-{{SERVICE_NAME}}-release}" -CT_REGISTRY="${CT_REGISTRY:-{{REGISTRY}}}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="{{SERVICE_NAME}}" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/bindings/haskell/container/deploy.k9.ncl b/k9-svc/bindings/haskell/container/deploy.k9.ncl deleted file mode 100644 index 0ad0d04a..00000000 --- a/k9-svc/bindings/haskell/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "{{SERVICE_NAME}}-deploy", - version = "{{VERSION}}", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "{{REGISTRY}}/{{SERVICE_NAME}}", - port = {{PORT}}, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for {{SERVICE_NAME}}..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying {{SERVICE_NAME}} to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back {{SERVICE_NAME}} deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/bindings/haskell/container/entrypoint.sh b/k9-svc/bindings/haskell/container/entrypoint.sh deleted file mode 100755 index a7a03699..00000000 --- a/k9-svc/bindings/haskell/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping {{SERVICE_NAME}}..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting {{SERVICE_NAME}}..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-{{PORT}}}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/{{SERVICE_NAME}} -# exec /app/release/bin/{{SERVICE_NAME}} start -# exec /app/{{SERVICE_NAME}} serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/bindings/haskell/container/manifest.toml b/k9-svc/bindings/haskell/container/manifest.toml deleted file mode 100644 index f55fcb3a..00000000 --- a/k9-svc/bindings/haskell/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" -revision = 1 -summary = "{{PROJECT_DESCRIPTION}}" -description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" - -[provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "{{PORT}}" - -[outputs] -primary = "{{SERVICE_NAME}}" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [{{PORT}}] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/haskell/container/vordr.toml b/k9-svc/bindings/haskell/container/vordr.toml deleted file mode 100644 index af38fc54..00000000 --- a/k9-svc/bindings/haskell/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:{{PORT}}/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:{{PORT}}/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/{{SERVICE_NAME}}.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "{{EMAIL}}" -# from = "vordr@{{SERVICE_NAME}}.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/bindings/haskell/contractile.just b/k9-svc/bindings/haskell/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/bindings/haskell/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/bindings/haskell/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/bindings/haskell/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/bindings/haskell/docs/QUICKSTART.adoc b/k9-svc/bindings/haskell/docs/QUICKSTART.adoc deleted file mode 100644 index d97c31ec..00000000 --- a/k9-svc/bindings/haskell/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/{{OWNER}}/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/bindings/haskell/docs/README.adoc b/k9-svc/bindings/haskell/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/bindings/haskell/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/bindings/haskell/docs/RSR_OUTLINE.adoc b/k9-svc/bindings/haskell/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/bindings/haskell/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/bindings/haskell/docs/STATE-VISUALIZER.adoc b/k9-svc/bindings/haskell/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/bindings/haskell/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/bindings/haskell/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/bindings/haskell/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/bindings/haskell/docs/architecture/THREAT-MODEL.adoc b/k9-svc/bindings/haskell/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index df5e0380..00000000 --- a/k9-svc/bindings/haskell/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: {{PROJECT_NAME}} - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | {{PROJECT_NAME}} | -| Version | 1.0 | -| Last Reviewed | {{DATE}} | -| Author | {{AUTHOR}} | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of {{PROJECT_NAME}} and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/bindings/haskell/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/bindings/haskell/docs/attribution/CITATION.cff b/k9-svc/bindings/haskell/docs/attribution/CITATION.cff deleted file mode 100644 index 4d562f43..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "{{AUTHOR_LAST}}" - given-names: "{{AUTHOR_FIRST}}" - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "{{PROJECT_NAME}}" -version: 0.1.0 -date-released: {{CURRENT_DATE}} -url: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -repository-code: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/bindings/haskell/docs/attribution/CITATIONS.adoc b/k9-svc/bindings/haskell/docs/attribution/CITATIONS.adoc deleted file mode 100644 index eeee45fb..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= {{PROJECT_NAME}} - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{{{PROJECT_NAME}}_{{CURRENT_YEAR}}, - author = {{{AUTHOR_LAST}}, {{AUTHOR_FIRST}}}, - title = {{{PROJECT_NAME}}}, - year = {{{CURRENT_YEAR}}}, - url = {https://github.com/{{OWNER}}/{{PROJECT_NAME}}}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}) _{{PROJECT_NAME}}_ [Computer software]. Available at: https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== OSCOLA - -{{AUTHOR}}, '{{PROJECT_NAME}}' ({{CURRENT_YEAR}}) - -== MLA - -{{AUTHOR_LAST}}, {{AUTHOR_FIRST}} "{{PROJECT_NAME}}." {{CURRENT_YEAR}}, github.com/{{OWNER}}/{{PROJECT_NAME}}. - -== APA 7 - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}). _{{PROJECT_NAME}}_ [Computer software]. GitHub. https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/bindings/haskell/docs/attribution/CODEOWNERS.adoc b/k9-svc/bindings/haskell/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/bindings/haskell/docs/attribution/MAINTAINERS.adoc b/k9-svc/bindings/haskell/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index d829dd95..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| {{AUTHOR}} -| Lead Maintainer -| https://github.com/{{OWNER}}[@{{OWNER}}] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/bindings/haskell/docs/attribution/README.adoc b/k9-svc/bindings/haskell/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/bindings/haskell/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/bindings/haskell/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/bindings/haskell/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/bindings/haskell/docs/decisions/0000-template.adoc b/k9-svc/bindings/haskell/docs/decisions/0000-template.adoc deleted file mode 100644 index 763eab1e..00000000 --- a/k9-svc/bindings/haskell/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/bindings/haskell/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/bindings/haskell/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 85f414be..00000000 --- a/k9-svc/bindings/haskell/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/{{OWNER}}/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/bindings/haskell/docs/decisions/README.adoc b/k9-svc/bindings/haskell/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/bindings/haskell/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/bindings/haskell/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/bindings/haskell/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/bindings/haskell/docs/developer/ABI-FFI-README.adoc b/k9-svc/bindings/haskell/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index 65d2afe1..00000000 --- a/k9-svc/bindings/haskell/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -{{LICENSE}} - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/{{OWNER}}/rhodium-standard-repositories) diff --git a/k9-svc/bindings/haskell/docs/developer/README.adoc b/k9-svc/bindings/haskell/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/bindings/haskell/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/bindings/haskell/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/bindings/haskell/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.adoc b/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/bindings/haskell/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/bindings/haskell/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/bindings/haskell/docs/governance/README.adoc b/k9-svc/bindings/haskell/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/bindings/haskell/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/bindings/haskell/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/bindings/haskell/docs/governance/TSDM.a2ml b/k9-svc/bindings/haskell/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/bindings/haskell/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/bindings/haskell/docs/governance/TSDM.adoc b/k9-svc/bindings/haskell/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/bindings/haskell/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/bindings/haskell/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/bindings/haskell/docs/governance/audit/README.adoc b/k9-svc/bindings/haskell/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/bindings/haskell/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/bindings/haskell/docs/governance/audit/compliance/README.adoc b/k9-svc/bindings/haskell/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/bindings/haskell/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/bindings/haskell/docs/governance/audit/effects/README.adoc b/k9-svc/bindings/haskell/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/bindings/haskell/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/bindings/haskell/docs/governance/audit/systems/README.adoc b/k9-svc/bindings/haskell/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/bindings/haskell/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/README.adoc b/k9-svc/bindings/haskell/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/README.adoc b/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/README.adoc b/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/bindings/haskell/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/bindings/haskell/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/bindings/haskell/docs/governance/planning/README.adoc b/k9-svc/bindings/haskell/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/bindings/haskell/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/bindings/haskell/docs/governance/planning/could/README.adoc b/k9-svc/bindings/haskell/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/bindings/haskell/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/bindings/haskell/docs/governance/planning/must/README.adoc b/k9-svc/bindings/haskell/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/bindings/haskell/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/bindings/haskell/docs/governance/planning/should/README.adoc b/k9-svc/bindings/haskell/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/bindings/haskell/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/bindings/haskell/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/bindings/haskell/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/bindings/haskell/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/bindings/haskell/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/bindings/haskell/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/bindings/haskell/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/bindings/haskell/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/bindings/haskell/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/bindings/haskell/docs/practice/.gitkeep b/k9-svc/bindings/haskell/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/bindings/haskell/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/bindings/haskell/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/bindings/haskell/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index 3d9aa304..00000000 --- a/k9-svc/bindings/haskell/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **{{AUTHOR}}** -- Email: **{{AUTHOR_EMAIL}}** -- Copyright: `Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/bindings/haskell/docs/practice/README.adoc b/k9-svc/bindings/haskell/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/bindings/haskell/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/bindings/haskell/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/bindings/haskell/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index b355b468..00000000 --- a/k9-svc/bindings/haskell/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> diff --git a/k9-svc/bindings/haskell/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/bindings/haskell/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/bindings/haskell/docs/reports/README.adoc b/k9-svc/bindings/haskell/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/bindings/haskell/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/bindings/haskell/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/bindings/haskell/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/bindings/haskell/docs/reports/compliance/README.adoc b/k9-svc/bindings/haskell/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/bindings/haskell/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/bindings/haskell/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/bindings/haskell/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/bindings/haskell/docs/reports/maintenance/README.adoc b/k9-svc/bindings/haskell/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/bindings/haskell/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/bindings/haskell/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/bindings/haskell/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/bindings/haskell/docs/reports/performance/README.adoc b/k9-svc/bindings/haskell/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/bindings/haskell/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/bindings/haskell/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/bindings/haskell/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/bindings/haskell/docs/reports/quality/README.adoc b/k9-svc/bindings/haskell/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/bindings/haskell/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/bindings/haskell/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/bindings/haskell/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/bindings/haskell/docs/reports/security/README.adoc b/k9-svc/bindings/haskell/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/bindings/haskell/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/bindings/haskell/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/bindings/haskell/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/bindings/haskell/docs/standards/README.adoc b/k9-svc/bindings/haskell/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/bindings/haskell/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/bindings/haskell/docs/templates/contractiles/README.adoc b/k9-svc/bindings/haskell/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/bindings/haskell/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/bindings/haskell/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/haskell/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/bindings/haskell/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/bindings/haskell/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/bindings/haskell/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/bindings/haskell/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/bindings/haskell/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/haskell/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/bindings/haskell/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/bindings/haskell/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/haskell/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/bindings/haskell/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/bindings/haskell/docs/theory/.gitkeep b/k9-svc/bindings/haskell/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/bindings/haskell/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/bindings/haskell/docs/theory/README.adoc b/k9-svc/bindings/haskell/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/bindings/haskell/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/bindings/haskell/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/bindings/haskell/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/bindings/haskell/docs/theory/computing/README.adoc b/k9-svc/bindings/haskell/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/bindings/haskell/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/bindings/haskell/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/bindings/haskell/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/bindings/haskell/docs/theory/formalisms/README.adoc b/k9-svc/bindings/haskell/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/bindings/haskell/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/bindings/haskell/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/bindings/haskell/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/bindings/haskell/docs/theory/mathematics/README.adoc b/k9-svc/bindings/haskell/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/bindings/haskell/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/bindings/haskell/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/bindings/haskell/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/bindings/haskell/docs/theory/ontologies/README.adoc b/k9-svc/bindings/haskell/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/bindings/haskell/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/bindings/haskell/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/bindings/haskell/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/bindings/haskell/docs/theory/other/README.adoc b/k9-svc/bindings/haskell/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/bindings/haskell/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/bindings/haskell/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/bindings/haskell/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/bindings/haskell/docs/theory/socio-technical/README.adoc b/k9-svc/bindings/haskell/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/bindings/haskell/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/bindings/haskell/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/bindings/haskell/docs/whitepapers/README.adoc b/k9-svc/bindings/haskell/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/bindings/haskell/docs/whitepapers/academic/.gitkeep b/k9-svc/bindings/haskell/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/bindings/haskell/docs/whitepapers/academic/README.adoc b/k9-svc/bindings/haskell/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/bindings/haskell/docs/whitepapers/industry/.gitkeep b/k9-svc/bindings/haskell/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/bindings/haskell/docs/whitepapers/industry/README.adoc b/k9-svc/bindings/haskell/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/bindings/haskell/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/bindings/haskell/docs/whitepapers/outreach/README.adoc b/k9-svc/bindings/haskell/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/bindings/haskell/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/bindings/haskell/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/bindings/haskell/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/bindings/haskell/docs/wikis/README.adoc b/k9-svc/bindings/haskell/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/bindings/haskell/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/bindings/haskell/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/bindings/haskell/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/bindings/haskell/examples/README.adoc b/k9-svc/bindings/haskell/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/bindings/haskell/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/bindings/haskell/examples/web-project-deno.json b/k9-svc/bindings/haskell/examples/web-project-deno.json deleted file mode 100644 index 028e4f1a..00000000 --- a/k9-svc/bindings/haskell/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/{{OWNER}}/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/bindings/haskell/features/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/bindings/haskell/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/bindings/haskell/features/README.adoc b/k9-svc/bindings/haskell/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/bindings/haskell/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/bindings/haskell/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/bindings/haskell/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/bindings/haskell/features/boj-server/README.adoc b/k9-svc/bindings/haskell/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/bindings/haskell/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/bindings/haskell/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/bindings/haskell/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/bindings/haskell/features/panic-attacker/README.adoc b/k9-svc/bindings/haskell/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/bindings/haskell/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/bindings/haskell/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/bindings/haskell/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/bindings/haskell/features/ssg/README.adoc b/k9-svc/bindings/haskell/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/bindings/haskell/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/bindings/haskell/features/ssg/ssg-bootstrap.sh b/k9-svc/bindings/haskell/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/bindings/haskell/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/bindings/haskell/k9-haskell.cabal b/k9-svc/bindings/haskell/k9-haskell.cabal deleted file mode 100644 index ba5cdb0f..00000000 --- a/k9-svc/bindings/haskell/k9-haskell.cabal +++ /dev/null @@ -1,53 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MPL-2.0 required for Hackage OSI-approved policy) --- --- k9-haskell.cabal — Cabal package description for the k9 library. - -cabal-version: 2.4 -name: k9 -version: 0.1.0.0 -synopsis: Parser and renderer for K9 (Self-Validating Components) -description: - A Haskell library for parsing and rendering K9 self-validating component - specifications. K9 is a format that embeds security levels, pedigree - metadata, build recipes, and validation checksums directly in the document. - . - Features: - . - * Parse @.k9@ (YAML-like) and @.k9.ncl@ (Nickel) files into a typed AST - * Render the AST back to K9 surface syntax - * Data types for components, pedigrees, security levels (Kennel\/Yard\/Hunt), - recipes, and contracts - * Round-trip fidelity for the YAML-like variant - -license: MPL-2.0 -license-file: LICENSE-MPL-2.0 -author: Jonathan D.A. Jewell -maintainer: j.d.a.jewell@open.ac.uk -copyright: Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -category: Text, Data, Security -build-type: Simple -homepage: https://github.com/hyperpolymath/k9-haskell -bug-reports: https://github.com/hyperpolymath/k9-haskell/issues -extra-doc-files: CHANGELOG.md -extra-source-files: README.adoc - -source-repository head - type: git - location: https://github.com/hyperpolymath/k9-haskell.git - -library - exposed-modules: - Data.K9 - Data.K9.Types - Data.K9.Parser - Data.K9.Renderer - build-depends: - base >= 4.14 && < 5, - text >= 1.2 && < 2.2, - containers >= 0.6 && < 0.8, - bytestring >= 0.10 && < 0.13 - hs-source-dirs: src - default-language: Haskell2010 - ghc-options: -Wall -Wcompat -Widentities -Wincomplete-record-updates - -Wincomplete-uni-patterns -Wredundant-constraints diff --git a/k9-svc/bindings/haskell/src/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index c92e124d..00000000 --- a/k9-svc/bindings/haskell/src/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary source code directory. Organized by role and architectural - aspect. - -canonical_locations: - core: "core/" - interface: "interface/" - bridges: "bridges/" - contracts: "contracts/" - errors: "errors/" - definitions: "definitions/" - aspects: "aspects/" - -invariants: - - "Core logic MUST reside in core/" - - "Verified seams MUST reside in interface/" - - "Safety constraints MUST reside in contracts/" - - "Failure dictionaries MUST reside in errors/" diff --git a/k9-svc/bindings/haskell/src/Data/K9.hs b/k9-svc/bindings/haskell/src/Data/K9.hs deleted file mode 100644 index a1580a05..00000000 --- a/k9-svc/bindings/haskell/src/Data/K9.hs +++ /dev/null @@ -1,32 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MPL-2.0 required for Hackage OSI-approved policy) --- --- Data.K9 — Top-level re-export module for the K9 library. --- --- Provides a convenient single import for working with K9 components: --- --- @ --- import Data.K9 --- --- main :: IO () --- main = do --- result <- parseK9File "component.k9" --- case result of --- Left err -> print err --- Right c -> putStrLn (renderK9 c) --- @ - -module Data.K9 - ( -- * Component types - module Data.K9.Types - - -- * Parsing - , module Data.K9.Parser - - -- * Rendering - , module Data.K9.Renderer - ) where - -import Data.K9.Parser -import Data.K9.Renderer -import Data.K9.Types diff --git a/k9-svc/bindings/haskell/src/Data/K9/Parser.hs b/k9-svc/bindings/haskell/src/Data/K9/Parser.hs deleted file mode 100644 index e8d2a56e..00000000 --- a/k9-svc/bindings/haskell/src/Data/K9/Parser.hs +++ /dev/null @@ -1,234 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MPL-2.0 required for Hackage OSI-approved policy) --- --- Data.K9.Parser — Parser for K9 self-validating component specifications. --- --- Parses both .k9 (YAML-like) and .k9.ncl (Nickel) variants into the typed --- AST defined in Data.K9.Types. The parser is line-oriented and extracts: --- - Magic number (K9!) --- - Pedigree metadata (name, version, description, author) --- - Security level (Kennel/Yard/Hunt) with permission flags --- - Target platform constraints --- - Recipes and validation blocks - -module Data.K9.Parser - ( -- * Parsing - parseK9 - , parseK9File - , parseK9Nickel - - -- * Errors - , ParseError (..) - - -- * Format detection - , K9Format (..) - , detectFormat - ) where - -import Data.K9.Types - -import qualified Data.Map.Strict as Map -import Data.Text (Text) -import qualified Data.Text as T -import qualified Data.Text.IO as TIO - --- | K9 file format variants. -data K9Format - = K9Yaml - -- ^ YAML-like .k9 format (starts with K9! magic number). - | K9Nickel - -- ^ Nickel .k9.ncl format (starts with let/import). - deriving (Show, Eq) - --- | Errors that can occur during K9 parsing. -data ParseError - = MissingMagicNumber - -- ^ The .k9 file does not start with the K9! magic number. - | MissingPedigree Text - -- ^ A required pedigree field is missing. - | InvalidSecurityLevel Text - -- ^ An unrecognised security level string was encountered. - | MalformedYaml Int Text - -- ^ Malformed YAML-like syntax at the given line. - | NickelNotSupported - -- ^ Nickel parsing is not yet implemented (placeholder). - | EmptyInput - -- ^ The input was empty. - deriving (Show, Eq) - --- | Detect the format of a K9 file from its content. -detectFormat :: Text -> K9Format -detectFormat input = - let firstLine = T.strip (head (T.lines input)) - in if firstLine == "K9!" then K9Yaml else K9Nickel - --- | Parse a K9 component from text (auto-detects format). --- --- For .k9 files, expects the K9! magic number on the first line. --- For .k9.ncl files, currently returns 'NickelNotSupported'. --- --- ==== Examples --- --- >>> parseK9 "K9!\n---\nmetadata:\n name: test\n version: 1.0.0\n description: A test\n" --- Right (Component { ... }) -parseK9 :: Text -> Either ParseError Component -parseK9 input - | T.null (T.strip input) = Left EmptyInput - | otherwise = - case detectFormat input of - K9Yaml -> parseK9Yaml input - K9Nickel -> parseK9Nickel input - --- | Parse a K9 component from a file path (auto-detects format). -parseK9File :: FilePath -> IO (Either ParseError Component) -parseK9File path = parseK9 <$> TIO.readFile path - --- | Parse a K9 Nickel (.k9.ncl) file. --- --- Currently a placeholder that returns 'NickelNotSupported'. Full Nickel --- parsing requires a Nickel evaluator binding. -parseK9Nickel :: Text -> Either ParseError Component -parseK9Nickel _ = Left NickelNotSupported - --- --------------------------------------------------------------------------- --- Internal: YAML-like K9 parser --- --------------------------------------------------------------------------- - --- | Parse the YAML-like .k9 format. -parseK9Yaml :: Text -> Either ParseError Component -parseK9Yaml input = do - let ls = T.lines input - case ls of - [] -> Left EmptyInput - (first : rest) - | T.strip first /= "K9!" -> Left MissingMagicNumber - | otherwise -> do - let kvs = parseYamlLines rest - buildComponent kvs - --- | Simple key-value extraction from YAML-like lines. --- Supports single-level nesting via indentation. -parseYamlLines :: [Text] -> Map.Map Text Text -parseYamlLines = go "" Map.empty - where - go _ acc [] = acc - go section acc (l:ls) - | T.null (T.strip l) || T.isPrefixOf "#" (T.strip l) || T.strip l == "---" = - go section acc ls - | not (T.isPrefixOf " " l) && T.isSuffixOf ":" (T.strip l) = - -- New section header (e.g., "metadata:") - let sectionName = T.stripEnd (T.dropEnd 1 (T.strip l)) - in go sectionName acc ls - | T.isPrefixOf " " l = - -- Indented key-value under current section - let stripped = T.strip l - in case T.breakOn ": " stripped of - (key, val) - | not (T.null val) -> - let fullKey = if T.null section - then key - else section <> "." <> key - value = T.strip (T.drop 2 val) - -- Strip surrounding quotes if present - cleanVal = stripQuotes value - in go section (Map.insert fullKey cleanVal acc) ls - _ -> - -- Possibly a list item (- item) or multiline value - go section acc ls - | otherwise = - -- Top-level key-value - case T.breakOn ": " (T.strip l) of - (key, val) | not (T.null val) -> - go section (Map.insert key (stripQuotes (T.strip (T.drop 2 val))) acc) ls - _ -> go section acc ls - --- | Strip surrounding double or single quotes from a text value. -stripQuotes :: Text -> Text -stripQuotes t - | T.length t >= 2 && T.head t == '"' && T.last t == '"' = T.init (T.tail t) - | T.length t >= 2 && T.head t == '\'' && T.last t == '\'' = T.init (T.tail t) - | otherwise = t - --- | Build a Component from extracted key-value pairs. -buildComponent :: Map.Map Text Text -> Either ParseError Component -buildComponent kvs = do - name <- requireField "metadata.name" kvs - version <- requireField "metadata.version" kvs - description <- requireField "metadata.description" kvs - let pedigree = Pedigree - { pedigreeName = name - , pedigreeVersion = version - , pedigreeDescription = description - , pedigreeAuthor = Map.lookup "metadata.author" kvs - , pedigreeLicense = Map.lookup "metadata.license" kvs - } - let secLevel = case Map.lookup "security.trust_level" kvs of - Just l -> parseSecurityLevel l - Nothing -> Right Kennel - level <- secLevel - let security = SecurityPolicy - { securityLevel = level - , securityAllowNetwork = lookupBool "security.allow_network" kvs - , securityAllowFsWrite = lookupBool "security.allow_filesystem_write" kvs - , securityAllowSubprocess = lookupBool "security.allow_subprocess" kvs - } - let target = case Map.lookup "target.os" kvs of - Nothing -> Nothing - Just os -> Just Target - { targetOS = Just os - , targetIsEdge = lookupBool "target.is_edge" kvs - , targetRequiresPodman = lookupBool "target.requires_podman" kvs - , targetMemory = Map.lookup "target.memory" kvs - } - let recipes = case Map.lookup "recipes.install" kvs of - Nothing -> Nothing - Just _ -> Just Recipes - { recipeInstall = Map.lookup "recipes.install" kvs - , recipeValidate = Map.lookup "recipes.validate" kvs - , recipeDeploy = Map.lookup "recipes.deploy" kvs - , recipeMigrate = Map.lookup "recipes.migrate" kvs - , recipeCustom = Map.empty - } - let validation = case Map.lookup "validation.checksum" kvs of - Nothing -> Nothing - Just cs -> Just Validation - { validationChecksum = cs - , validationPedigreeVersion = maybe "" id (Map.lookup "validation.pedigree_version" kvs) - , validationHuntAuthorized = lookupBool "validation.hunt_authorized" kvs - } - Right Component - { componentPedigree = pedigree - , componentSecurity = security - , componentTarget = target - , componentRecipes = recipes - , componentValidation = validation - , componentContent = Map.empty - , componentTags = [] - } - --- | Require a field, returning ParseError if missing. -requireField :: Text -> Map.Map Text Text -> Either ParseError Text -requireField key kvs = - case Map.lookup key kvs of - Nothing -> Left (MissingPedigree key) - Just v -> Right v - --- | Parse a security level string. -parseSecurityLevel :: Text -> Either ParseError SecurityLevel -parseSecurityLevel t = case T.toLower (T.strip t) of - "kennel" -> Right Kennel - "'kennel" -> Right Kennel - "yard" -> Right Yard - "'yard" -> Right Yard - "hunt" -> Right Hunt - "'hunt" -> Right Hunt - other -> Left (InvalidSecurityLevel other) - --- | Look up a boolean value (default False). -lookupBool :: Text -> Map.Map Text Text -> Bool -lookupBool key kvs = - case Map.lookup key kvs of - Just "true" -> True - Just "True" -> True - Just "yes" -> True - _ -> False diff --git a/k9-svc/bindings/haskell/src/Data/K9/Renderer.hs b/k9-svc/bindings/haskell/src/Data/K9/Renderer.hs deleted file mode 100644 index 8c2163b4..00000000 --- a/k9-svc/bindings/haskell/src/Data/K9/Renderer.hs +++ /dev/null @@ -1,113 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MPL-2.0 required for Hackage OSI-approved policy) --- --- Data.K9.Renderer — Render K9 AST back to K9 surface syntax. --- --- Converts the typed AST from Data.K9.Types into the YAML-like .k9 format, --- including the K9! magic number, pedigree, security, target, and recipes. - -module Data.K9.Renderer - ( -- * Rendering - renderK9 - , renderComponent - , renderSecurityLevel - ) where - -import Data.K9.Types - -import qualified Data.Map.Strict as Map -import Data.Text (Text) -import qualified Data.Text as T - --- | Render a complete K9 'Component' to the .k9 YAML-like format. --- --- ==== Examples --- --- >>> renderK9 component --- "K9!\n---\nmetadata:\n name: hello-k9\n ..." -renderK9 :: Component -> Text -renderK9 = renderComponent - --- | Render a K9 component to text. -renderComponent :: Component -> Text -renderComponent c = T.intercalate "\n" $ filter (not . T.null) $ - [ "K9!" - , "---" - , "metadata:" - , " name: " <> pedigreeName (componentPedigree c) - , " version: " <> pedigreeVersion (componentPedigree c) - , " description: " <> pedigreeDescription (componentPedigree c) - ] - ++ renderOptional " author" (pedigreeAuthor (componentPedigree c)) - ++ renderOptional " license" (pedigreeLicense (componentPedigree c)) - ++ - [ "" - , "security:" - , " trust_level: " <> renderSecurityLevel (securityLevel (componentSecurity c)) - , " allow_network: " <> renderBool (securityAllowNetwork (componentSecurity c)) - , " allow_filesystem_write: " <> renderBool (securityAllowFsWrite (componentSecurity c)) - , " allow_subprocess: " <> renderBool (securityAllowSubprocess (componentSecurity c)) - ] - ++ renderTargetSection (componentTarget c) - ++ renderRecipesSection (componentRecipes c) - ++ renderValidationSection (componentValidation c) - ++ renderTagsSection (componentTags c) - ++ [""] - --- | Render a security level to its canonical text representation. -renderSecurityLevel :: SecurityLevel -> Text -renderSecurityLevel Kennel = "'Kennel" -renderSecurityLevel Yard = "'Yard" -renderSecurityLevel Hunt = "'Hunt" - --- | Render a boolean as lowercase text. -renderBool :: Bool -> Text -renderBool True = "true" -renderBool False = "false" - --- | Render an optional field. -renderOptional :: Text -> Maybe Text -> [Text] -renderOptional key (Just val) = [key <> ": " <> val] -renderOptional _ Nothing = [] - --- | Render the target section if present. -renderTargetSection :: Maybe Target -> [Text] -renderTargetSection Nothing = [] -renderTargetSection (Just t) = - [ "" - , "target:" - ] - ++ renderOptional " os" (targetOS t) - ++ - [ " is_edge: " <> renderBool (targetIsEdge t) - , " requires_podman: " <> renderBool (targetRequiresPodman t) - ] - ++ renderOptional " memory" (targetMemory t) - --- | Render the recipes section if present. -renderRecipesSection :: Maybe Recipes -> [Text] -renderRecipesSection Nothing = [] -renderRecipesSection (Just r) = - ["", "recipes:"] - ++ renderOptional " install" (recipeInstall r) - ++ renderOptional " validate" (recipeValidate r) - ++ renderOptional " deploy" (recipeDeploy r) - ++ renderOptional " migrate" (recipeMigrate r) - ++ concatMap (\(k, v) -> [" " <> k <> ": " <> v]) (Map.toList (recipeCustom r)) - --- | Render the validation section if present. -renderValidationSection :: Maybe Validation -> [Text] -renderValidationSection Nothing = [] -renderValidationSection (Just v) = - [ "" - , "validation:" - , " checksum: " <> validationChecksum v - , " pedigree_version: " <> validationPedigreeVersion v - , " hunt_authorized: " <> renderBool (validationHuntAuthorized v) - ] - --- | Render the tags section if non-empty. -renderTagsSection :: [Text] -> [Text] -renderTagsSection [] = [] -renderTagsSection tags = - ["", "tags:"] ++ map (\t -> " - " <> t) tags diff --git a/k9-svc/bindings/haskell/src/Data/K9/Types.hs b/k9-svc/bindings/haskell/src/Data/K9/Types.hs deleted file mode 100644 index b415a277..00000000 --- a/k9-svc/bindings/haskell/src/Data/K9/Types.hs +++ /dev/null @@ -1,156 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MPL-2.0 required for Hackage OSI-approved policy) --- --- Data.K9.Types — Core data types for K9 (Self-Validating Components). --- --- Defines the abstract syntax tree for K9 component specifications, including --- pedigree metadata, security levels, target platforms, recipes, and contracts. - -module Data.K9.Types - ( -- * Component - Component (..) - - -- * Pedigree metadata - , Pedigree (..) - - -- * Security - , SecurityLevel (..) - , SecurityPolicy (..) - - -- * Target platform - , Target (..) - - -- * Recipes - , Recipe (..) - , Recipes (..) - - -- * Validation - , Validation (..) - - -- * Contract - , Contract (..) - , ContractClause (..) - ) where - -import Data.Map.Strict (Map) -import Data.Text (Text) - --- | A K9 self-validating component. This is the top-level AST node. -data Component = Component - { componentPedigree :: Pedigree - -- ^ Identity and provenance metadata. - , componentSecurity :: SecurityPolicy - -- ^ Security level and permission flags. - , componentTarget :: Maybe Target - -- ^ Optional target platform constraints. - , componentRecipes :: Maybe Recipes - -- ^ Optional build/deploy/validate recipes. - , componentValidation :: Maybe Validation - -- ^ Optional self-validation block (checksum, pedigree version). - , componentContent :: Map Text Text - -- ^ Additional content key-value pairs. - , componentTags :: [Text] - -- ^ Tags for categorisation. - } deriving (Show, Eq) - --- | Pedigree: identity and provenance metadata for a K9 component. -data Pedigree = Pedigree - { pedigreeName :: Text - -- ^ Component name (e.g., "hello-k9"). - , pedigreeVersion :: Text - -- ^ Semantic version string. - , pedigreeDescription :: Text - -- ^ Human-readable description. - , pedigreeAuthor :: Maybe Text - -- ^ Author identity. - , pedigreeLicense :: Maybe Text - -- ^ SPDX license identifier. - } deriving (Show, Eq) - --- | K9 security levels forming a trust hierarchy. --- --- * 'Kennel' — Pure data, no execution, safe anywhere. --- * 'Yard' — Controlled execution, limited permissions. --- * 'Hunt' — Full execution with explicit authorisation required. -data SecurityLevel - = Kennel - -- ^ Pure data only. No code execution. Safe to open anywhere. - | Yard - -- ^ Controlled execution with limited permissions. - | Hunt - -- ^ Full execution. Requires explicit authorisation. - deriving (Show, Eq, Ord, Enum, Bounded) - --- | Security policy combining the level with specific permission flags. -data SecurityPolicy = SecurityPolicy - { securityLevel :: SecurityLevel - -- ^ The trust level. - , securityAllowNetwork :: Bool - -- ^ Whether the component may access the network. - , securityAllowFsWrite :: Bool - -- ^ Whether the component may write to the filesystem. - , securityAllowSubprocess :: Bool - -- ^ Whether the component may spawn subprocesses. - } deriving (Show, Eq) - --- | Target platform constraints. -data Target = Target - { targetOS :: Maybe Text - -- ^ Target operating system (e.g., "Linux", "Darwin"). - , targetIsEdge :: Bool - -- ^ Whether this targets edge/embedded environments. - , targetRequiresPodman :: Bool - -- ^ Whether Podman container runtime is required. - , targetMemory :: Maybe Text - -- ^ Memory constraint (e.g., "512M", "2G"). - } deriving (Show, Eq) - --- | Named recipes for lifecycle operations. -data Recipe = Recipe - { recipeName :: Text - -- ^ Recipe identifier (e.g., "install", "validate"). - , recipeCommand :: Text - -- ^ Shell command to execute. - } deriving (Show, Eq) - --- | Collection of standard lifecycle recipes. -data Recipes = Recipes - { recipeInstall :: Maybe Text - -- ^ Installation command. - , recipeValidate :: Maybe Text - -- ^ Validation / typecheck command. - , recipeDeploy :: Maybe Text - -- ^ Deployment command. - , recipeMigrate :: Maybe Text - -- ^ Migration command. - , recipeCustom :: Map Text Text - -- ^ Additional named recipes. - } deriving (Show, Eq) - --- | Self-validation block. -data Validation = Validation - { validationChecksum :: Text - -- ^ SHA-256 (or other) checksum of the component. - , validationPedigreeVersion :: Text - -- ^ Version of the pedigree schema used. - , validationHuntAuthorized :: Bool - -- ^ Whether Hunt-level execution has been explicitly authorised. - } deriving (Show, Eq) - --- | A contract attached to a K9 component (from the contractile system). -data Contract = Contract - { contractName :: Text - -- ^ Contract identifier. - , contractClauses :: [ContractClause] - -- ^ Individual clauses in the contract. - } deriving (Show, Eq) - --- | A single clause within a K9 contract. -data ContractClause = ContractClause - { clauseType :: Text - -- ^ Clause type: "must", "trust", "dust", "intend", "k9". - , clausePredicate :: Text - -- ^ The predicate or assertion text. - , clauseVerified :: Bool - -- ^ Whether this clause has been verified. - } deriving (Show, Eq) diff --git a/k9-svc/bindings/haskell/src/README.adoc b/k9-svc/bindings/haskell/src/README.adoc deleted file mode 100644 index 5529f66f..00000000 --- a/k9-svc/bindings/haskell/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= src Pillar diff --git a/k9-svc/bindings/haskell/src/aspects/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/aspects/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d5b209e..00000000 --- a/k9-svc/bindings/haskell/src/aspects/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-aspects" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Cross-cutting concerns and domain-specific aspects (Security, - Observability, Integrity). - -canonical_locations: - security: "security/" - observability: "observability/" - integrity: "integrity/" diff --git a/k9-svc/bindings/haskell/src/aspects/README.adoc b/k9-svc/bindings/haskell/src/aspects/README.adoc deleted file mode 100644 index 6456f962..00000000 --- a/k9-svc/bindings/haskell/src/aspects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Aspects Pillar diff --git a/k9-svc/bindings/haskell/src/aspects/integrity/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/aspects/integrity/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f114cbd2..00000000 --- a/k9-svc/bindings/haskell/src/aspects/integrity/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-integrity" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the integrity aspect. diff --git a/k9-svc/bindings/haskell/src/aspects/integrity/README.adoc b/k9-svc/bindings/haskell/src/aspects/integrity/README.adoc deleted file mode 100644 index f15d829d..00000000 --- a/k9-svc/bindings/haskell/src/aspects/integrity/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Integrity Aspect diff --git a/k9-svc/bindings/haskell/src/aspects/observability/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/aspects/observability/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index e16cbdf9..00000000 --- a/k9-svc/bindings/haskell/src/aspects/observability/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-observability" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the observability aspect. diff --git a/k9-svc/bindings/haskell/src/aspects/observability/README.adoc b/k9-svc/bindings/haskell/src/aspects/observability/README.adoc deleted file mode 100644 index 7852ee64..00000000 --- a/k9-svc/bindings/haskell/src/aspects/observability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Observability Aspect diff --git a/k9-svc/bindings/haskell/src/aspects/security/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/aspects/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 09965363..00000000 --- a/k9-svc/bindings/haskell/src/aspects/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the security aspect. diff --git a/k9-svc/bindings/haskell/src/aspects/security/README.adoc b/k9-svc/bindings/haskell/src/aspects/security/README.adoc deleted file mode 100644 index 3c3536ec..00000000 --- a/k9-svc/bindings/haskell/src/aspects/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Aspect diff --git a/k9-svc/bindings/haskell/src/bridges/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/bridges/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d3e27a0..00000000 --- a/k9-svc/bindings/haskell/src/bridges/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-bridges" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Integration logic for external systems (API, Database, RPC, etc.). diff --git a/k9-svc/bindings/haskell/src/contracts/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/contracts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0bd9198f..00000000 --- a/k9-svc/bindings/haskell/src/contracts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-contracts" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Contracts unit for high-rigor source code. diff --git a/k9-svc/bindings/haskell/src/contracts/README.adoc b/k9-svc/bindings/haskell/src/contracts/README.adoc deleted file mode 100644 index 9cfa2098..00000000 --- a/k9-svc/bindings/haskell/src/contracts/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Contracts Unit diff --git a/k9-svc/bindings/haskell/src/core/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/core/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 22846c78..00000000 --- a/k9-svc/bindings/haskell/src/core/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-core" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary application logic and core domain models. diff --git a/k9-svc/bindings/haskell/src/definitions/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/definitions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e54f4dab..00000000 --- a/k9-svc/bindings/haskell/src/definitions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-definitions" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Definitions unit for high-rigor source code. diff --git a/k9-svc/bindings/haskell/src/definitions/README.adoc b/k9-svc/bindings/haskell/src/definitions/README.adoc deleted file mode 100644 index 95483497..00000000 --- a/k9-svc/bindings/haskell/src/definitions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Definitions Unit diff --git a/k9-svc/bindings/haskell/src/errors/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/errors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index dddcc6c4..00000000 --- a/k9-svc/bindings/haskell/src/errors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-errors" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Errors unit for high-rigor source code. diff --git a/k9-svc/bindings/haskell/src/errors/README.adoc b/k9-svc/bindings/haskell/src/errors/README.adoc deleted file mode 100644 index 460fc1e9..00000000 --- a/k9-svc/bindings/haskell/src/errors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Errors Unit diff --git a/k9-svc/bindings/haskell/src/interface/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 7f0f471b..00000000 --- a/k9-svc/bindings/haskell/src/interface/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "interface-seams-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Consolidated "Verified Interface Seams" unit. This directory unifies the - formal specification (ABI), the bridge implementation (FFI), and the - resulting artifacts (Generated). - -canonical_locations: - abi: "abi/" - ffi: "ffi/" - generated: "generated/" - -invariants: - - "ABI MUST be Idris2 (.idr)" - - "FFI MUST be Zig (.zig)" - - "Generated artifacts MUST be C-compatible" - - "The 'Truth' lives in abi/; the 'Implementation' lives in ffi/" diff --git a/k9-svc/bindings/haskell/src/interface/README.adoc b/k9-svc/bindings/haskell/src/interface/README.adoc deleted file mode 100644 index 8faf0aad..00000000 --- a/k9-svc/bindings/haskell/src/interface/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= interface Unit diff --git a/k9-svc/bindings/haskell/src/interface/abi/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/abi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 91cafa01..00000000 --- a/k9-svc/bindings/haskell/src/interface/abi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for abi. diff --git a/k9-svc/bindings/haskell/src/interface/abi/README.adoc b/k9-svc/bindings/haskell/src/interface/abi/README.adoc deleted file mode 100644 index 2330304d..00000000 --- a/k9-svc/bindings/haskell/src/interface/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= abi Logic diff --git a/k9-svc/bindings/haskell/src/interface/ffi/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/ffi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index bf456ae2..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ffi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for ffi. diff --git a/k9-svc/bindings/haskell/src/interface/ffi/README.adoc b/k9-svc/bindings/haskell/src/interface/ffi/README.adoc deleted file mode 100644 index 8fe57d34..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= ffi Logic diff --git a/k9-svc/bindings/haskell/src/interface/ffi/build.zig b/k9-svc/bindings/haskell/src/interface/ffi/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/k9-svc/bindings/haskell/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 5b5f1b1e..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "src-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Src logic at level 4. diff --git a/k9-svc/bindings/haskell/src/interface/ffi/src/README.adoc b/k9-svc/bindings/haskell/src/interface/ffi/src/README.adoc deleted file mode 100644 index a5c0c6d5..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Src Logic diff --git a/k9-svc/bindings/haskell/src/interface/ffi/src/main.zig b/k9-svc/bindings/haskell/src/interface/ffi/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/k9-svc/bindings/haskell/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index e02427f8..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "test-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Test logic at level 4. diff --git a/k9-svc/bindings/haskell/src/interface/ffi/test/README.adoc b/k9-svc/bindings/haskell/src/interface/ffi/test/README.adoc deleted file mode 100644 index f6f38bf6..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/test/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Test Logic diff --git a/k9-svc/bindings/haskell/src/interface/ffi/test/integration_test.zig b/k9-svc/bindings/haskell/src/interface/ffi/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/k9-svc/bindings/haskell/src/interface/ffi/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/k9-svc/bindings/haskell/src/interface/generated/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/generated/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0088b80c..00000000 --- a/k9-svc/bindings/haskell/src/interface/generated/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "generated-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for generated. diff --git a/k9-svc/bindings/haskell/src/interface/generated/README.adoc b/k9-svc/bindings/haskell/src/interface/generated/README.adoc deleted file mode 100644 index 3691b062..00000000 --- a/k9-svc/bindings/haskell/src/interface/generated/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= generated Logic diff --git a/k9-svc/bindings/haskell/src/interface/generated/abi/.gitkeep b/k9-svc/bindings/haskell/src/interface/generated/abi/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/haskell/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 4eeb5808..00000000 --- a/k9-svc/bindings/haskell/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Abi logic at level 4. diff --git a/k9-svc/bindings/haskell/src/interface/generated/abi/README.adoc b/k9-svc/bindings/haskell/src/interface/generated/abi/README.adoc deleted file mode 100644 index aff61a99..00000000 --- a/k9-svc/bindings/haskell/src/interface/generated/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Abi Logic diff --git a/k9-svc/bindings/haskell/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/bindings/haskell/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/bindings/haskell/verification/README.adoc b/k9-svc/bindings/haskell/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/bindings/haskell/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/bindings/haskell/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/bindings/haskell/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/bindings/haskell/verification/benchmarks/README.adoc b/k9-svc/bindings/haskell/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/bindings/haskell/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/bindings/haskell/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/bindings/haskell/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/haskell/verification/coverage/README.adoc b/k9-svc/bindings/haskell/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/bindings/haskell/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/bindings/haskell/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/bindings/haskell/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/bindings/haskell/verification/fuzzing/README.adoc b/k9-svc/bindings/haskell/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/bindings/haskell/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/bindings/haskell/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/bindings/haskell/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/bindings/haskell/verification/proofs/README.adoc b/k9-svc/bindings/haskell/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/bindings/haskell/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/bindings/haskell/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/bindings/haskell/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/haskell/verification/safety_case/README.adoc b/k9-svc/bindings/haskell/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/bindings/haskell/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/bindings/haskell/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/bindings/haskell/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/bindings/haskell/verification/simulations/README.adoc b/k9-svc/bindings/haskell/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/bindings/haskell/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/bindings/haskell/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/bindings/haskell/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/bindings/haskell/verification/tests/README.adoc b/k9-svc/bindings/haskell/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/bindings/haskell/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/bindings/haskell/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/haskell/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/bindings/haskell/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/haskell/verification/traceability/README.adoc b/k9-svc/bindings/haskell/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/bindings/haskell/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/bindings/rust/.devcontainer/Containerfile b/k9-svc/bindings/rust/.devcontainer/Containerfile deleted file mode 100644 index b0a6fd1b..00000000 --- a/k9-svc/bindings/rust/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Dev Container image for {{PROJECT_NAME}} -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/{{PROJECT_NAME}} - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/bindings/rust/.devcontainer/README.adoc b/k9-svc/bindings/rust/.devcontainer/README.adoc deleted file mode 100644 index 3bfb50e5..00000000 --- a/k9-svc/bindings/rust/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}> - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/bindings/rust/.devcontainer/devcontainer.json b/k9-svc/bindings/rust/.devcontainer/devcontainer.json deleted file mode 100644 index a4b33e0a..00000000 --- a/k9-svc/bindings/rust/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -// -// Dev Container configuration for {{PROJECT_NAME}} -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "{{PROJECT_NAME}}", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/bindings/rust/.editorconfig b/k9-svc/bindings/rust/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/bindings/rust/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/bindings/rust/.envrc b/k9-svc/bindings/rust/.envrc deleted file mode 100644 index 4ca685b4..00000000 --- a/k9-svc/bindings/rust/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/bindings/rust/.gitattributes b/k9-svc/bindings/rust/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/bindings/rust/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/bindings/rust/.github/.mailmap b/k9-svc/bindings/rust/.github/.mailmap deleted file mode 100644 index 0ada9de5..00000000 --- a/k9-svc/bindings/rust/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}> diff --git a/k9-svc/bindings/rust/.github/.nojekyll b/k9-svc/bindings/rust/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/rust/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/bindings/rust/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/bindings/rust/.github/CODEOWNERS b/k9-svc/bindings/rust/.github/CODEOWNERS deleted file mode 100644 index 611b5a84..00000000 --- a/k9-svc/bindings/rust/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace {{OWNER}} with your GitHub username or team - -# Default owners for everything -* @{{OWNER}} - -# Security-sensitive files require explicit review -SECURITY.md @{{OWNER}} -.github/workflows/ @{{OWNER}} -Trustfile.a2ml @{{OWNER}} -.machine_readable/ @{{OWNER}} diff --git a/k9-svc/bindings/rust/.github/CODE_OF_CONDUCT.md b/k9-svc/bindings/rust/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index 2777a724..00000000 --- a/k9-svc/bindings/rust/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in {{PROJECT_NAME}} a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://{{FORGE}}/{{OWNER}}/{{REPO}}/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: {{CURRENT_YEAR}} · Based on Contributor Covenant 2.1 diff --git a/k9-svc/bindings/rust/.github/CONTRIBUTING.md b/k9-svc/bindings/rust/.github/CONTRIBUTING.md deleted file mode 100644 index 02758c67..00000000 --- a/k9-svc/bindings/rust/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://{{FORGE}}/{{OWNER}}/{{REPO}}.git -cd {{REPO}} - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create {{REPO}}-dev -toolbox enter {{REPO}}-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -{{REPO}}/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `{{MAIN_BRANCH}}` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/help%20wanted) — Community help needed -- [`documentation`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/documentation) — Docs improvements -- [`perimeter-3`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/bindings/rust/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/bindings/rust/.github/FUNDING.yml b/k9-svc/bindings/rust/.github/FUNDING.yml deleted file mode 100644 index c078261e..00000000 --- a/k9-svc/bindings/rust/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for {{OWNER}} projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: {{OWNER}} -ko_fi: {{OWNER}} -liberapay: {{OWNER}} diff --git a/k9-svc/bindings/rust/.github/GOVERNANCE.md b/k9-svc/bindings/rust/.github/GOVERNANCE.md deleted file mode 100644 index fcbcec0c..00000000 --- a/k9-svc/bindings/rust/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **{{PROJECT_NAME}}**. - ---- - -## Project Governance Model - -{{PROJECT_NAME}} follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) {{CURRENT_YEAR}} {{OWNER}}. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index ec2aa283..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for {{OWNER}}/{{REPO}} -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index cb7a33cb..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for {{OWNER}}/{{REPO}} -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/{{OWNER}}/{{REPO}}/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 6aa9e631..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for {{OWNER}}/{{REPO}} -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 88e07205..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for {{OWNER}}/{{REPO}} -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 6d88090c..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for {{OWNER}}/{{REPO}} -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index 48bb574e..00000000 --- a/k9-svc/bindings/rust/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for {{OWNER}}/{{REPO}} -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/bindings/rust/.github/MAINTAINERS b/k9-svc/bindings/rust/.github/MAINTAINERS deleted file mode 100644 index 145c4e96..00000000 --- a/k9-svc/bindings/rust/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -{{AUTHOR}} <{{AUTHOR_EMAIL}}> (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/bindings/rust/.github/README.adoc b/k9-svc/bindings/rust/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/bindings/rust/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/bindings/rust/.github/SECURITY.md b/k9-svc/bindings/rust/.github/SECURITY.md deleted file mode 100644 index 7dd7b29e..00000000 --- a/k9-svc/bindings/rust/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`{{OWNER}}/{{REPO}}`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using {{PROJECT_NAME}}, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ - ---- - -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 diff --git a/k9-svc/bindings/rust/.github/SUPPORT b/k9-svc/bindings/rust/.github/SUPPORT deleted file mode 100644 index b06c59a3..00000000 --- a/k9-svc/bindings/rust/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/{{OWNER}}/{{REPO}}/discussions -- GitHub Issues: https://github.com/{{OWNER}}/{{REPO}}/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/bindings/rust/.github/copilot-instructions.md b/k9-svc/bindings/rust/.github/copilot-instructions.md deleted file mode 100644 index 6b44aec8..00000000 --- a/k9-svc/bindings/rust/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/bindings/rust/.github/dependabot.yml b/k9-svc/bindings/rust/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/bindings/rust/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/bindings/rust/.github/pull_request_template.md b/k9-svc/bindings/rust/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/bindings/rust/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/bindings/rust/.github/workflows/codeql.yml b/k9-svc/bindings/rust/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/bindings/rust/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/bindings/rust/.github/workflows/governance.yml b/k9-svc/bindings/rust/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/bindings/rust/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/bindings/rust/.github/workflows/hypatia-scan.yml b/k9-svc/bindings/rust/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/bindings/rust/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/rust/.github/workflows/jekyll.yml b/k9-svc/bindings/rust/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/bindings/rust/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/bindings/rust/.github/workflows/mirror.yml b/k9-svc/bindings/rust/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/bindings/rust/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/rust/.github/workflows/release.yml b/k9-svc/bindings/rust/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/bindings/rust/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/bindings/rust/.github/workflows/rhodibot.yml b/k9-svc/bindings/rust/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/bindings/rust/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/bindings/rust/.github/workflows/scorecard-enforcer.yml b/k9-svc/bindings/rust/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/bindings/rust/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/bindings/rust/.github/workflows/scorecard.yml b/k9-svc/bindings/rust/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/bindings/rust/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/rust/.github/workflows/secret-scanner.yml b/k9-svc/bindings/rust/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/bindings/rust/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/bindings/rust/.github/workflows/static-analysis-gate.yml b/k9-svc/bindings/rust/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/bindings/rust/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/bindings/rust/.gitignore b/k9-svc/bindings/rust/.gitignore deleted file mode 100644 index 037efd36..00000000 --- a/k9-svc/bindings/rust/.gitignore +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/bindings/rust/.gitlab-ci.yml b/k9-svc/bindings/rust/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/bindings/rust/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/bindings/rust/.guix-channel b/k9-svc/bindings/rust/.guix-channel deleted file mode 100644 index f9bdf68f..00000000 --- a/k9-svc/bindings/rust/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -;; -;; Guix channel definition for {{PROJECT_NAME}} -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name '{{PROJECT_NAME}}) -;; (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/bindings/rust/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/bindings/rust/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/bindings/rust/.machine_readable/CLADE.a2ml b/k9-svc/bindings/rust/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/bindings/rust/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/bindings/rust/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/bindings/rust/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index 1384822c..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "{{PROJECT_NAME}} Development" -# description = "Panels for {{PROJECT_NAME}} development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/bindings/rust/.machine_readable/README.adoc b/k9-svc/bindings/rust/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/bindings/rust/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/bindings/rust/.machine_readable/ai/.clinerules b/k9-svc/bindings/rust/.machine_readable/ai/.clinerules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/.cursorrules b/k9-svc/bindings/rust/.machine_readable/ai/.cursorrules deleted file mode 100644 index d3b9cee0..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/.windsurfrules b/k9-svc/bindings/rust/.machine_readable/ai/.windsurfrules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/AI.a2ml b/k9-svc/bindings/rust/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/bindings/rust/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index a1382f4f..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .) -sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .) -sed -i 's/{{OWNER}}/my-org/g' $(grep -rl '{{OWNER}}' .) -sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/{{REPO}}/my-project/g' $(grep -rl '{{REPO}}' .) -sed -i 's/{{FORGE}}/github.com/g' $(grep -rl '{{FORGE}}' .) -sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .) -sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `{{REPO}}` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `{{OWNER}}` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `{{FORGE}}` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md | -| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{LICENSE}}` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/bindings/rust/.machine_readable/ai/README.adoc b/k9-svc/bindings/rust/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/bindings/rust/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/bindings/rust/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/bindings/rust/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/bindings/rust/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/bindings/rust/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index 87238998..00000000 --- a/k9-svc/bindings/rust/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "{{OWNER}}/{{REPO}}" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "{{PROJECT_NAME}}" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "{{PROJECT_PURPOSE}}" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/bindings/rust/.machine_readable/anchors/README.adoc b/k9-svc/bindings/rust/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/bindings/rust/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/bindings/rust/.machine_readable/compliance/reuse/dep5 b/k9-svc/bindings/rust/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 3f5b2ef6..00000000 --- a/k9-svc/bindings/rust/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: {{PROJECT_NAME}} -Upstream-Contact: {{AUTHOR}} <{{AUTHOR_EMAIL}}> -Source: https://github.com/{{OWNER}}/{{REPO}} - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/bindings/rust/.machine_readable/compliance/rust/deny.toml b/k9-svc/bindings/rust/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/bindings/rust/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/bindings/rust/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/bindings/rust/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/bindings/rust/.machine_readable/configs/README.adoc b/k9-svc/bindings/rust/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/bindings/rust/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/bindings/rust/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/bindings/rust/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index 5c39b484..00000000 --- a/k9-svc/bindings/rust/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# {{OWNER}} — GitHub organization or username -# {{REPO}} — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/bindings/rust/.machine_readable/contractiles/README.adoc b/k9-svc/bindings/rust/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/bindings/rust/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/bindings/rust/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/rust/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/bindings/rust/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/bindings/rust/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/rust/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/bindings/rust/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/bindings/rust/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/rust/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/bindings/rust/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 4d5db884..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 7788ce09..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project] -name = "rust" -purpose = "" # TODO: describe project purpose -role = "" # TODO: describe project role # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/META.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index d9b09e68..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -type = "library" # TODO: update type (library|binary|service|website|monorepo) # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 1acf7a30..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index 6408e1c7..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/bindings/rust/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/bindings/rust/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index a76d8dd6..00000000 --- a/k9-svc/bindings/rust/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "rsr-template-repo" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "rsr-template-repo" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/bindings/rust/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/bindings/rust/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/bindings/rust/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index eeffd278..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/rust/.machine_readable/policies/README.adoc b/k9-svc/bindings/rust/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/bindings/rust/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/rust/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/rust/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/forge/README.adoc b/k9-svc/bindings/rust/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/bindings/rust/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/bindings/rust/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/bindings/rust/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/bindings/rust/.machine_readable/scripts/verification/README.adoc b/k9-svc/bindings/rust/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/bindings/rust/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/bindings/rust/.tool-versions b/k9-svc/bindings/rust/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/bindings/rust/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/bindings/rust/.well-known/ai.txt b/k9-svc/bindings/rust/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/bindings/rust/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/bindings/rust/.well-known/humans.txt b/k9-svc/bindings/rust/.well-known/humans.txt deleted file mode 100644 index 8891981a..00000000 --- a/k9-svc/bindings/rust/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: {{AUTHOR}} ({{OWNER}}) -Contact: {{AUTHOR_EMAIL}} -From: United Kingdom - -/* SITE */ -Last update: {{CURRENT_DATE}} -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/bindings/rust/.well-known/security.txt b/k9-svc/bindings/rust/.well-known/security.txt deleted file mode 100644 index 5414d508..00000000 --- a/k9-svc/bindings/rust/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:{{SECURITY_EMAIL}} -Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt -Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md -Hiring: https://{{WEBSITE}}/careers diff --git a/k9-svc/bindings/rust/0-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/0-AI-MANIFEST.a2ml deleted file mode 100644 index dc12c575..00000000 --- a/k9-svc/bindings/rust/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **[YOUR-REPO-NAME]**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "{{AUTHOR}} <{{AUTHOR_EMAIL}}>" -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -[YOUR-REPO-NAME]/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/bindings/rust/CHANGELOG.adoc b/k9-svc/bindings/rust/CHANGELOG.adoc deleted file mode 100644 index ca1c6528..00000000 --- a/k9-svc/bindings/rust/CHANGELOG.adoc +++ /dev/null @@ -1,9 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [Unreleased] diff --git a/k9-svc/bindings/rust/CONTRIBUTING.adoc b/k9-svc/bindings/rust/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/bindings/rust/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/bindings/rust/Cargo.lock b/k9-svc/bindings/rust/Cargo.lock deleted file mode 100644 index fc60b4fa..00000000 --- a/k9-svc/bindings/rust/Cargo.lock +++ /dev/null @@ -1,1027 +0,0 @@ -# This file is automatically @generated by Cargo. -# It is not intended for manual editing. -version = 4 - -[[package]] -name = "aho-corasick" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301" -dependencies = [ - "memchr", -] - -[[package]] -name = "anes" -version = "0.1.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299" - -[[package]] -name = "anstyle" -version = "1.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000" - -[[package]] -name = "anyhow" -version = "1.0.102" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" - -[[package]] -name = "autocfg" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" - -[[package]] -name = "bit-set" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3" -dependencies = [ - "bit-vec", -] - -[[package]] -name = "bit-vec" -version = "0.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7" - -[[package]] -name = "bitflags" -version = "2.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" - -[[package]] -name = "bumpalo" -version = "3.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" - -[[package]] -name = "cast" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5" - -[[package]] -name = "cfg-if" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" - -[[package]] -name = "ciborium" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e" -dependencies = [ - "ciborium-io", - "ciborium-ll", - "serde", -] - -[[package]] -name = "ciborium-io" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757" - -[[package]] -name = "ciborium-ll" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9" -dependencies = [ - "ciborium-io", - "half", -] - -[[package]] -name = "clap" -version = "4.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351" -dependencies = [ - "clap_builder", -] - -[[package]] -name = "clap_builder" -version = "4.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" -dependencies = [ - "anstyle", - "clap_lex", -] - -[[package]] -name = "clap_lex" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" - -[[package]] -name = "criterion" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f" -dependencies = [ - "anes", - "cast", - "ciborium", - "clap", - "criterion-plot", - "is-terminal", - "itertools", - "num-traits", - "once_cell", - "oorandom", - "plotters", - "rayon", - "regex", - "serde", - "serde_derive", - "serde_json", - "tinytemplate", - "walkdir", -] - -[[package]] -name = "criterion-plot" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1" -dependencies = [ - "cast", - "itertools", -] - -[[package]] -name = "crossbeam-deque" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51" -dependencies = [ - "crossbeam-epoch", - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-epoch" -version = "0.9.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" -dependencies = [ - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-utils" -version = "0.8.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" - -[[package]] -name = "crunchy" -version = "0.2.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5" - -[[package]] -name = "either" -version = "1.15.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719" - -[[package]] -name = "equivalent" -version = "1.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" - -[[package]] -name = "errno" -version = "0.3.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" -dependencies = [ - "libc", - "windows-sys", -] - -[[package]] -name = "fastrand" -version = "2.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" - -[[package]] -name = "fnv" -version = "1.0.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1" - -[[package]] -name = "foldhash" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" - -[[package]] -name = "getrandom" -version = "0.3.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd" -dependencies = [ - "cfg-if", - "libc", - "r-efi 5.3.0", - "wasip2", -] - -[[package]] -name = "getrandom" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" -dependencies = [ - "cfg-if", - "libc", - "r-efi 6.0.0", - "wasip2", - "wasip3", -] - -[[package]] -name = "half" -version = "2.7.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6ea2d84b969582b4b1864a92dc5d27cd2b77b622a8d79306834f1be5ba20d84b" -dependencies = [ - "cfg-if", - "crunchy", - "zerocopy", -] - -[[package]] -name = "hashbrown" -version = "0.15.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" -dependencies = [ - "foldhash", -] - -[[package]] -name = "hashbrown" -version = "0.16.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" - -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - -[[package]] -name = "hermit-abi" -version = "0.5.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" - -[[package]] -name = "id-arena" -version = "2.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" - -[[package]] -name = "indexmap" -version = "2.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45a8a2b9cb3e0b0c1803dbb0758ffac5de2f425b23c28f518faabd9d805342ff" -dependencies = [ - "equivalent", - "hashbrown 0.16.1", - "serde", - "serde_core", -] - -[[package]] -name = "is-terminal" -version = "0.4.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" -dependencies = [ - "hermit-abi", - "libc", - "windows-sys", -] - -[[package]] -name = "itertools" -version = "0.10.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473" -dependencies = [ - "either", -] - -[[package]] -name = "itoa" -version = "1.0.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" - -[[package]] -name = "js-sys" -version = "0.3.94" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2e04e2ef80ce82e13552136fabeef8a5ed1f985a96805761cbb9a2c34e7664d9" -dependencies = [ - "once_cell", - "wasm-bindgen", -] - -[[package]] -name = "k9-svc" -version = "0.1.0" -dependencies = [ - "criterion", - "proptest", - "serde", - "serde_derive", - "thiserror", -] - -[[package]] -name = "leb128fmt" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" - -[[package]] -name = "libc" -version = "0.2.184" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af" - -[[package]] -name = "linux-raw-sys" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53" - -[[package]] -name = "log" -version = "0.4.29" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" - -[[package]] -name = "memchr" -version = "2.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" - -[[package]] -name = "num-traits" -version = "0.2.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" -dependencies = [ - "autocfg", -] - -[[package]] -name = "once_cell" -version = "1.21.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" - -[[package]] -name = "oorandom" -version = "11.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d6790f58c7ff633d8771f42965289203411a5e5c68388703c06e14f24770b41e" - -[[package]] -name = "plotters" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5aeb6f403d7a4911efb1e33402027fc44f29b5bf6def3effcc22d7bb75f2b747" -dependencies = [ - "num-traits", - "plotters-backend", - "plotters-svg", - "wasm-bindgen", - "web-sys", -] - -[[package]] -name = "plotters-backend" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df42e13c12958a16b3f7f4386b9ab1f3e7933914ecea48da7139435263a4172a" - -[[package]] -name = "plotters-svg" -version = "0.3.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "51bae2ac328883f7acdfea3d66a7c35751187f870bc81f94563733a154d7a670" -dependencies = [ - "plotters-backend", -] - -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - -[[package]] -name = "prettyplease" -version = "0.2.37" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" -dependencies = [ - "proc-macro2", - "syn", -] - -[[package]] -name = "proc-macro2" -version = "1.0.106" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "proptest" -version = "1.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744" -dependencies = [ - "bit-set", - "bit-vec", - "bitflags", - "num-traits", - "rand", - "rand_chacha", - "rand_xorshift", - "regex-syntax", - "rusty-fork", - "tempfile", - "unarray", -] - -[[package]] -name = "quick-error" -version = "1.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" - -[[package]] -name = "quote" -version = "1.0.45" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" -dependencies = [ - "proc-macro2", -] - -[[package]] -name = "r-efi" -version = "5.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f" - -[[package]] -name = "r-efi" -version = "6.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" - -[[package]] -name = "rand" -version = "0.9.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea" -dependencies = [ - "rand_chacha", - "rand_core", -] - -[[package]] -name = "rand_chacha" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb" -dependencies = [ - "ppv-lite86", - "rand_core", -] - -[[package]] -name = "rand_core" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c" -dependencies = [ - "getrandom 0.3.4", -] - -[[package]] -name = "rand_xorshift" -version = "0.4.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a" -dependencies = [ - "rand_core", -] - -[[package]] -name = "rayon" -version = "1.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "368f01d005bf8fd9b1206fb6fa653e6c4a81ceb1466406b81792d87c5677a58f" -dependencies = [ - "either", - "rayon-core", -] - -[[package]] -name = "rayon-core" -version = "1.13.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91" -dependencies = [ - "crossbeam-deque", - "crossbeam-utils", -] - -[[package]] -name = "regex" -version = "1.12.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276" -dependencies = [ - "aho-corasick", - "memchr", - "regex-automata", - "regex-syntax", -] - -[[package]] -name = "regex-automata" -version = "0.4.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f" -dependencies = [ - "aho-corasick", - "memchr", - "regex-syntax", -] - -[[package]] -name = "regex-syntax" -version = "0.8.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a" - -[[package]] -name = "rustix" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" -dependencies = [ - "bitflags", - "errno", - "libc", - "linux-raw-sys", - "windows-sys", -] - -[[package]] -name = "rustversion" -version = "1.0.22" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" - -[[package]] -name = "rusty-fork" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2" -dependencies = [ - "fnv", - "quick-error", - "tempfile", - "wait-timeout", -] - -[[package]] -name = "same-file" -version = "1.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" -dependencies = [ - "winapi-util", -] - -[[package]] -name = "semver" -version = "1.0.28" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" - -[[package]] -name = "serde" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" -dependencies = [ - "serde_core", - "serde_derive", -] - -[[package]] -name = "serde_core" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" -dependencies = [ - "serde_derive", -] - -[[package]] -name = "serde_derive" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "serde_json" -version = "1.0.149" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86" -dependencies = [ - "itoa", - "memchr", - "serde", - "serde_core", - "zmij", -] - -[[package]] -name = "syn" -version = "2.0.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" -dependencies = [ - "proc-macro2", - "quote", - "unicode-ident", -] - -[[package]] -name = "tempfile" -version = "3.27.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" -dependencies = [ - "fastrand", - "getrandom 0.4.2", - "once_cell", - "rustix", - "windows-sys", -] - -[[package]] -name = "thiserror" -version = "2.0.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4" -dependencies = [ - "thiserror-impl", -] - -[[package]] -name = "thiserror-impl" -version = "2.0.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "tinytemplate" -version = "1.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc" -dependencies = [ - "serde", - "serde_json", -] - -[[package]] -name = "unarray" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94" - -[[package]] -name = "unicode-ident" -version = "1.0.24" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" - -[[package]] -name = "unicode-xid" -version = "0.2.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" - -[[package]] -name = "wait-timeout" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11" -dependencies = [ - "libc", -] - -[[package]] -name = "walkdir" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b" -dependencies = [ - "same-file", - "winapi-util", -] - -[[package]] -name = "wasip2" -version = "1.0.2+wasi-0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5" -dependencies = [ - "wit-bindgen", -] - -[[package]] -name = "wasip3" -version = "0.4.0+wasi-0.3.0-rc-2026-01-06" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5" -dependencies = [ - "wit-bindgen", -] - -[[package]] -name = "wasm-bindgen" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0551fc1bb415591e3372d0bc4780db7e587d84e2a7e79da121051c5c4b89d0b0" -dependencies = [ - "cfg-if", - "once_cell", - "rustversion", - "wasm-bindgen-macro", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-macro" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7fbdf9a35adf44786aecd5ff89b4563a90325f9da0923236f6104e603c7e86be" -dependencies = [ - "quote", - "wasm-bindgen-macro-support", -] - -[[package]] -name = "wasm-bindgen-macro-support" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dca9693ef2bab6d4e6707234500350d8dad079eb508dca05530c85dc3a529ff2" -dependencies = [ - "bumpalo", - "proc-macro2", - "quote", - "syn", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-shared" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39129a682a6d2d841b6c429d0c51e5cb0ed1a03829d8b3d1e69a011e62cb3d3b" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "wasm-encoder" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319" -dependencies = [ - "leb128fmt", - "wasmparser", -] - -[[package]] -name = "wasm-metadata" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909" -dependencies = [ - "anyhow", - "indexmap", - "wasm-encoder", - "wasmparser", -] - -[[package]] -name = "wasmparser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" -dependencies = [ - "bitflags", - "hashbrown 0.15.5", - "indexmap", - "semver", -] - -[[package]] -name = "web-sys" -version = "0.3.94" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cd70027e39b12f0849461e08ffc50b9cd7688d942c1c8e3c7b22273236b4dd0a" -dependencies = [ - "js-sys", - "wasm-bindgen", -] - -[[package]] -name = "winapi-util" -version = "0.1.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" -dependencies = [ - "windows-sys", -] - -[[package]] -name = "windows-link" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" - -[[package]] -name = "windows-sys" -version = "0.61.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" -dependencies = [ - "windows-link", -] - -[[package]] -name = "wit-bindgen" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5" -dependencies = [ - "wit-bindgen-rust-macro", -] - -[[package]] -name = "wit-bindgen-core" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc" -dependencies = [ - "anyhow", - "heck", - "wit-parser", -] - -[[package]] -name = "wit-bindgen-rust" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21" -dependencies = [ - "anyhow", - "heck", - "indexmap", - "prettyplease", - "syn", - "wasm-metadata", - "wit-bindgen-core", - "wit-component", -] - -[[package]] -name = "wit-bindgen-rust-macro" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a" -dependencies = [ - "anyhow", - "prettyplease", - "proc-macro2", - "quote", - "syn", - "wit-bindgen-core", - "wit-bindgen-rust", -] - -[[package]] -name = "wit-component" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" -dependencies = [ - "anyhow", - "bitflags", - "indexmap", - "log", - "serde", - "serde_derive", - "serde_json", - "wasm-encoder", - "wasm-metadata", - "wasmparser", - "wit-parser", -] - -[[package]] -name = "wit-parser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736" -dependencies = [ - "anyhow", - "id-arena", - "indexmap", - "log", - "semver", - "serde", - "serde_derive", - "serde_json", - "unicode-xid", - "wasmparser", -] - -[[package]] -name = "zerocopy" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "zmij" -version = "1.0.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" diff --git a/k9-svc/bindings/rust/Cargo.toml b/k9-svc/bindings/rust/Cargo.toml deleted file mode 100644 index 818d8a69..00000000 --- a/k9-svc/bindings/rust/Cargo.toml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# (MPL-2.0 required for crates.io) - -[package] -name = "k9-svc" -version = "0.1.0" -edition = "2021" -authors = ["Jonathan D.A. Jewell "] -license = "MPL-2.0" -description = "Parser and renderer for K9 self-validating configuration format" -repository = "https://github.com/hyperpolymath/k9-rs" -homepage = "https://github.com/hyperpolymath/k9-rs" -documentation = "https://docs.rs/k9-svc" -keywords = ["k9", "self-validating", "nickel", "configuration", "security"] -categories = ["parser-implementations", "config"] -readme = "README.adoc" - -[dependencies] -serde = { version = "1", features = ["derive"] } -serde_derive = { version = "1", optional = true } -thiserror = "2" - -[dev-dependencies] -proptest = "1" -criterion = { version = "0.5", features = ["html_reports"] } - -[[bench]] -name = "k9_bench" -harness = false - -[features] -default = [] -serde_derive = ["dep:serde_derive"] diff --git a/k9-svc/bindings/rust/Containerfile b/k9-svc/bindings/rust/Containerfile deleted file mode 100644 index d7266bc0..00000000 --- a/k9-svc/bindings/rust/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Containerfile for {{PROJECT_NAME}} -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/bindings/rust/Justfile b/k9-svc/bindings/rust/Justfile deleted file mode 100644 index 9d7a5ff4..00000000 --- a/k9-svc/bindings/rust/Justfile +++ /dev/null @@ -1,910 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "{{PROJECT_NAME}}" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/bindings/rust/LICENSE b/k9-svc/bindings/rust/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/bindings/rust/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/bindings/rust/README.adoc b/k9-svc/bindings/rust/README.adoc deleted file mode 100644 index 34c0095c..00000000 --- a/k9-svc/bindings/rust/README.adoc +++ /dev/null @@ -1,165 +0,0 @@ -= RSR Template Repository -:toc: preamble -:icons: font - -[TIP] -==== -**AI-Assisted Install:** Just tell any AI assistant: + -`Set up {{PROJECT_NAME}} from https://{{FORGE}}/{{OWNER}}/{{REPO}}` + -The AI reads the manifest, asks you a few questions, and handles everything. -==== - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This project follows a **Dual-Track** architecture: -* **Root:** High-level orientation and rich documentation for humans. -* **Sub-directories:** Machine-readable metadata and technical implementation. - -== ABI/FFI Standard (Verified Interface Seams) - -All projects with foreign function interfaces MUST follow this consolidated standard: - -* **ABI (Idris2):** `src/interface/abi/*.idr` (The Specification) -* **FFI (Zig):** `src/interface/ffi/src/*.zig` (The Implementation) -* **Generated:** `src/interface/generated/*.h` (The Artifacts) - -This unification ensures that the "Truth," the "Bridge," and the "Result" are managed as a single architectural unit. - -== AI Gatekeeper Protocol - -All projects MUST include a root `0-AI-MANIFEST.a2ml`. This is the mandatory entry point for all AI agents. It prevents duplicate file errors and preserves architectural invariants across sessions. - -== Repository Structure - -[cols="1,3"] -|=== -|Directory |Purpose - -|`.github/` -|Forge-specific metadata (CODEOWNERS, SECURITY.md, workflows). - -|`.machine_readable/` -|Canonical project state (6 a2ml files), bot directives, and AI guides. - -|`container/` -|Stapeln container ecosystem (selur-compose, vordr, rokur). - -|`docs/` -|Technical documentation sorted by tracks (Theory, Practice, Architecture). - -|`docs/legal/` -|Consolidated legal exhibits and full license texts. - -|`src/interface/` -|Unified ABI/FFI/Generated interface unit. -|=== - -== Container Ecosystem (Stapeln) - -This template includes a complete `container/` directory for the **Stapeln Six** tools: -1. **selur** (Orchestration) -2. **cerro-torre** (Verified Packaging) -3. **svalinn** (Edge Gateway) -4. **vordr** (Monitoring) -5. **rokur** (Secrets) -6. **k9-svc** (Deployment Contracts) - -== Quick Start - -[source,bash] ----- -just init # Interactive bootstrap -just build # Unified build -just test # Unified test -just container-build # Build verified OCI image ----- - -== Contractile System - -This template includes five **contractile files** in `.machine_readable/contractiles/` that make your repository's rules executable: - -[cols="1,2,3"] -|=== -| Tool | File | Purpose - -| `must check` -| `Mustfile.a2ml` -| Physical state invariants (files exist, code compiles, no secrets) - -| `trust verify` -| `Trustfile.a2ml` -| Integrity verification (hashes valid, signatures correct, provenance traceable) - -| `dust status` -| `Dustfile.a2ml` -| Cleanup tasks (stale files, build artifacts, expired tokens) - -| `intend list` -| `Intentfile.a2ml` -| Design intent and roadmap tracking - -| `k9 eval` -| `*.k9.ncl` -| Nickel-based deployment validation -|=== - -=== Installation - -[source,bash] ----- -cargo install contractile - -# Create symlinks for individual commands -for cmd in must trust dust intend k9; do - ln -sf $(which contractile) ~/.local/bin/$cmd -done ----- - -=== Usage - -[source,bash] ----- -# Symlink contractiles to project root (CLI searches ./contractiles/) -ln -sf .machine_readable/contractiles contractiles - -# Run checks -must check # Verify physical state (23 checks in typical RSR project) -trust verify # Verify integrity and provenance -dust status # Show cleanup items -intend list # Show design intents and roadmap - -# Generate Just recipes from contractile files -contractile gen-just # Creates contractile.just (already imported by Justfile) - -# Then use via Just: -just must-check -just trust-verify ----- - -=== Writing Checks - -Contractile files use A2ML format — simple, line-oriented: - -[source] ----- -### check-name -- description: Human-readable description -- run: shell command (exit 0 = pass, non-zero = fail) -- severity: critical | warning | info ----- - -See link:https://github.com/hyperpolymath/contractiles[contractiles documentation] for the full specification. - -== Documentation - -* link:CONTRIBUTING.adoc[Contributing Guide] -* link:GOVERNANCE.adoc[Governance Model] -* link:docs/attribution/MAINTAINERS.adoc[Maintainers & Citations] -* link:SECURITY.adoc[Security Policy] - -== License - -SPDX-License-Identifier: MPL-2.0 -See link:LICENSE[LICENSE] and link:docs/legal/[docs/legal/] for details. diff --git a/k9-svc/bindings/rust/ROADMAP.adoc b/k9-svc/bindings/rust/ROADMAP.adoc deleted file mode 100644 index bc3935c4..00000000 --- a/k9-svc/bindings/rust/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Rust Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/bindings/rust/SECURITY.adoc b/k9-svc/bindings/rust/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/bindings/rust/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/bindings/rust/benches/k9_bench.rs b/k9-svc/bindings/rust/benches/k9_bench.rs deleted file mode 100644 index 3d01accc..00000000 --- a/k9-svc/bindings/rust/benches/k9_bench.rs +++ /dev/null @@ -1,204 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// Criterion benchmarks for the k9-svc crate. -// -// Baseline categories covered: -// - Small K9 document parse throughput (single component) -// - Medium K9 document parse throughput (multi-component with contracts) -// - Render throughput (components -> text) -// - Round-trip (parse then render) throughput -// -// Run with: cargo bench (from k9-svc/bindings/rust/) - -use criterion::{black_box, criterion_group, criterion_main, BenchmarkId, Criterion, Throughput}; - -use k9_svc::parser::parse; -use k9_svc::renderer::render; -use k9_svc::types::{Component, Contract, Pedigree, Recipe, SecurityLevel}; - -// --------------------------------------------------------------------------- -// Fixture strings -// --------------------------------------------------------------------------- - -/// Minimal single-component K9 document. -const SMALL_K9: &str = r#"component: my-svc - version: 0.1.0 - pedigree: - origin: https://github.com/example/svc - author: Alice - security: kennel -"#; - -/// Medium K9 document with recipe, contract, and metadata. -const MEDIUM_K9: &str = r#"component: parser-lib - version: 1.2.3 - description: A robust parsing library - pedigree: - origin: https://github.com/example/parser - author: Bob - license: MPL-2.0 - security: yard - recipe: - tool: cargo - command: cargo build --release - contract: no-unsafe - description: Forbid unsafe blocks in this crate - check: cargo clippy -- -D unsafe-code - severity: error - contract: no-panic - description: No unwrap/expect calls in library code - check: cargo clippy -- -D clippy::unwrap_used - severity: warning - metadata: - codeql: true - scorecard: passed -"#; - -/// Multi-component K9 document (3 components). -const MULTI_K9: &str = r#"component: frontend - version: 0.5.0 - pedigree: - origin: https://github.com/example/frontend - author: Carol - security: hunt - -component: backend - version: 1.0.0 - pedigree: - origin: https://github.com/example/backend - author: Dave - license: PMPL-1.0-or-later - security: yard - recipe: - tool: cargo - command: cargo build --release - -component: database - version: 2.1.0 - pedigree: - origin: https://github.com/example/db - author: Eve - security: kennel -"#; - -// --------------------------------------------------------------------------- -// Parse benchmarks -// --------------------------------------------------------------------------- - -/// Benchmark: parse small K9 document. -fn bench_parse_small(c: &mut Criterion) { - let input = black_box(SMALL_K9); - let mut group = c.benchmark_group("k9_parse"); - group.throughput(Throughput::Bytes(input.len() as u64)); - group.bench_function("small", |b| { - b.iter(|| { - let components = parse(black_box(input)).expect("parse should not fail"); - black_box(components) - }); - }); - group.finish(); -} - -/// Benchmark: parse medium K9 document (with recipe + contracts). -fn bench_parse_medium(c: &mut Criterion) { - let input = black_box(MEDIUM_K9); - let mut group = c.benchmark_group("k9_parse"); - group.throughput(Throughput::Bytes(input.len() as u64)); - group.bench_function("medium", |b| { - b.iter(|| { - let components = parse(black_box(input)).expect("parse should not fail"); - black_box(components) - }); - }); - group.finish(); -} - -/// Benchmark: parse multi-component K9 document. -fn bench_parse_multi(c: &mut Criterion) { - let input = black_box(MULTI_K9); - let mut group = c.benchmark_group("k9_parse"); - group.throughput(Throughput::Bytes(input.len() as u64)); - group.bench_function("multi_component", |b| { - b.iter(|| { - let components = parse(black_box(input)).expect("parse should not fail"); - black_box(components) - }); - }); - group.finish(); -} - -// --------------------------------------------------------------------------- -// Render benchmarks -// --------------------------------------------------------------------------- - -/// Benchmark: render a pre-built medium document. -fn bench_render_medium(c: &mut Criterion) { - let components = parse(MEDIUM_K9).expect("setup: parse must succeed"); - let mut group = c.benchmark_group("k9_render"); - group.bench_function("medium", |b| { - b.iter(|| { - let text = render(black_box(&components)).expect("render should not fail"); - black_box(text) - }); - }); - group.finish(); -} - -// --------------------------------------------------------------------------- -// Round-trip benchmarks -// --------------------------------------------------------------------------- - -/// Benchmark: full parse-then-render round-trip. -fn bench_roundtrip(c: &mut Criterion) { - let inputs = [ - ("small", SMALL_K9), - ("medium", MEDIUM_K9), - ("multi", MULTI_K9), - ]; - - let mut group = c.benchmark_group("k9_roundtrip"); - for (name, input) in &inputs { - group.throughput(Throughput::Bytes(input.len() as u64)); - group.bench_with_input(BenchmarkId::new("parse_render", name), input, |b, src| { - b.iter(|| { - let components = parse(black_box(src)).expect("parse"); - let text = render(black_box(&components)).expect("render"); - black_box(text) - }); - }); - } - group.finish(); -} - -// --------------------------------------------------------------------------- -// SecurityLevel micro benchmark -// --------------------------------------------------------------------------- - -/// Benchmark: SecurityLevel::from_str (used in hot parse path). -fn bench_security_level_from_str(c: &mut Criterion) { - let names = ["kennel", "yard", "hunt", "KENNEL", "Yard", "HUNT"]; - c.bench_function("security_level/from_str", |b| { - b.iter(|| { - let mut count = 0u32; - for name in &names { - if SecurityLevel::from_str(black_box(name)).is_some() { - count += 1; - } - } - black_box(count) - }); - }); -} - -criterion_group!( - benches, - bench_parse_small, - bench_parse_medium, - bench_parse_multi, - bench_render_medium, - bench_roundtrip, - bench_security_level_from_str, -); -criterion_main!(benches); diff --git a/k9-svc/bindings/rust/container/.gatekeeper.yaml b/k9-svc/bindings/rust/container/.gatekeeper.yaml deleted file mode 120000 index 87731df3..00000000 --- a/k9-svc/bindings/rust/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/k9-svc/bindings/rust/container/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/bindings/rust/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/bindings/rust/container/Containerfile b/k9-svc/bindings/rust/container/Containerfile deleted file mode 100644 index ba85260a..00000000 --- a/k9-svc/bindings/rust/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t {{SERVICE_NAME}}:latest -f container/Containerfile . -# -# Run: -# podman run -p {{PORT}}:{{PORT}} {{SERVICE_NAME}}:latest -# -# Run with persistent volume: -# podman run -p {{PORT}}:{{PORT}} -v {{SERVICE_NAME}}-data:/data {{SERVICE_NAME}}:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/{{SERVICE_NAME}} -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/{{SERVICE_NAME}}/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/{{SERVICE_NAME}} -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ - org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ - org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} -# COPY --from=builder /build/_build/prod/rel/{{SERVICE_NAME}} /app/release/ -# COPY --from=builder /build/zig-out/bin/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT={{PORT}} -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE {{PORT}} - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/rust/container/README.adoc b/k9-svc/bindings/rust/container/README.adoc deleted file mode 100644 index 9f7f7f05..00000000 --- a/k9-svc/bindings/rust/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -= {{PROJECT_NAME}} Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/bindings/rust/container/compose.example.toml b/k9-svc/bindings/rust/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/bindings/rust/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/rust/container/compose.toml b/k9-svc/bindings/rust/container/compose.toml deleted file mode 100644 index a14f8a00..00000000 --- a/k9-svc/bindings/rust/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f {{SERVICE_NAME}} # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.{{SERVICE_NAME}}] -image = "{{REGISTRY}}/{{SERVICE_NAME}}:latest.ctp" -ports = ["{{PORT}}:{{PORT}}"] -environment = { - APP_HOST = "[::]", - APP_PORT = "{{PORT}}", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["{{SERVICE_NAME}}-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:{{PORT}}/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://{{SERVICE_NAME}}:{{PORT}}", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["{{SERVICE_NAME}}"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.{{SERVICE_NAME}}-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/bindings/rust/container/ct-build.sh b/k9-svc/bindings/rust/container/ct-build.sh deleted file mode 100755 index a54a5418..00000000 --- a/k9-svc/bindings/rust/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: {{SERVICE_NAME}}-release) -# CT_REGISTRY — OCI registry to push to (default: {{REGISTRY}}) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-{{SERVICE_NAME}}-release}" -CT_REGISTRY="${CT_REGISTRY:-{{REGISTRY}}}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="{{SERVICE_NAME}}" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/bindings/rust/container/deploy.k9.ncl b/k9-svc/bindings/rust/container/deploy.k9.ncl deleted file mode 100644 index 0ad0d04a..00000000 --- a/k9-svc/bindings/rust/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "{{SERVICE_NAME}}-deploy", - version = "{{VERSION}}", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "{{REGISTRY}}/{{SERVICE_NAME}}", - port = {{PORT}}, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for {{SERVICE_NAME}}..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying {{SERVICE_NAME}} to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back {{SERVICE_NAME}} deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/bindings/rust/container/entrypoint.sh b/k9-svc/bindings/rust/container/entrypoint.sh deleted file mode 100755 index a7a03699..00000000 --- a/k9-svc/bindings/rust/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping {{SERVICE_NAME}}..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting {{SERVICE_NAME}}..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-{{PORT}}}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/{{SERVICE_NAME}} -# exec /app/release/bin/{{SERVICE_NAME}} start -# exec /app/{{SERVICE_NAME}} serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/bindings/rust/container/manifest.toml b/k9-svc/bindings/rust/container/manifest.toml deleted file mode 100644 index f55fcb3a..00000000 --- a/k9-svc/bindings/rust/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" -revision = 1 -summary = "{{PROJECT_DESCRIPTION}}" -description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" - -[provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "{{PORT}}" - -[outputs] -primary = "{{SERVICE_NAME}}" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [{{PORT}}] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/bindings/rust/container/vordr.toml b/k9-svc/bindings/rust/container/vordr.toml deleted file mode 100644 index af38fc54..00000000 --- a/k9-svc/bindings/rust/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:{{PORT}}/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:{{PORT}}/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/{{SERVICE_NAME}}.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "{{EMAIL}}" -# from = "vordr@{{SERVICE_NAME}}.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/bindings/rust/contractile.just b/k9-svc/bindings/rust/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/bindings/rust/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/bindings/rust/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/bindings/rust/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/bindings/rust/docs/QUICKSTART.adoc b/k9-svc/bindings/rust/docs/QUICKSTART.adoc deleted file mode 100644 index d97c31ec..00000000 --- a/k9-svc/bindings/rust/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/{{OWNER}}/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/bindings/rust/docs/README.adoc b/k9-svc/bindings/rust/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/bindings/rust/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/bindings/rust/docs/RSR_OUTLINE.adoc b/k9-svc/bindings/rust/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/bindings/rust/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/bindings/rust/docs/STATE-VISUALIZER.adoc b/k9-svc/bindings/rust/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/bindings/rust/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/bindings/rust/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/bindings/rust/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/bindings/rust/docs/architecture/THREAT-MODEL.adoc b/k9-svc/bindings/rust/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index df5e0380..00000000 --- a/k9-svc/bindings/rust/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: {{PROJECT_NAME}} - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | {{PROJECT_NAME}} | -| Version | 1.0 | -| Last Reviewed | {{DATE}} | -| Author | {{AUTHOR}} | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of {{PROJECT_NAME}} and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/bindings/rust/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/bindings/rust/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/bindings/rust/docs/attribution/CITATION.cff b/k9-svc/bindings/rust/docs/attribution/CITATION.cff deleted file mode 100644 index 4d562f43..00000000 --- a/k9-svc/bindings/rust/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "{{AUTHOR_LAST}}" - given-names: "{{AUTHOR_FIRST}}" - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "{{PROJECT_NAME}}" -version: 0.1.0 -date-released: {{CURRENT_DATE}} -url: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -repository-code: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/bindings/rust/docs/attribution/CITATIONS.adoc b/k9-svc/bindings/rust/docs/attribution/CITATIONS.adoc deleted file mode 100644 index eeee45fb..00000000 --- a/k9-svc/bindings/rust/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= {{PROJECT_NAME}} - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{{{PROJECT_NAME}}_{{CURRENT_YEAR}}, - author = {{{AUTHOR_LAST}}, {{AUTHOR_FIRST}}}, - title = {{{PROJECT_NAME}}}, - year = {{{CURRENT_YEAR}}}, - url = {https://github.com/{{OWNER}}/{{PROJECT_NAME}}}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}) _{{PROJECT_NAME}}_ [Computer software]. Available at: https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== OSCOLA - -{{AUTHOR}}, '{{PROJECT_NAME}}' ({{CURRENT_YEAR}}) - -== MLA - -{{AUTHOR_LAST}}, {{AUTHOR_FIRST}} "{{PROJECT_NAME}}." {{CURRENT_YEAR}}, github.com/{{OWNER}}/{{PROJECT_NAME}}. - -== APA 7 - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}). _{{PROJECT_NAME}}_ [Computer software]. GitHub. https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/bindings/rust/docs/attribution/CODEOWNERS.adoc b/k9-svc/bindings/rust/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/bindings/rust/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/bindings/rust/docs/attribution/MAINTAINERS.adoc b/k9-svc/bindings/rust/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index d829dd95..00000000 --- a/k9-svc/bindings/rust/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| {{AUTHOR}} -| Lead Maintainer -| https://github.com/{{OWNER}}[@{{OWNER}}] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/bindings/rust/docs/attribution/README.adoc b/k9-svc/bindings/rust/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/bindings/rust/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/bindings/rust/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/bindings/rust/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/bindings/rust/docs/decisions/0000-template.adoc b/k9-svc/bindings/rust/docs/decisions/0000-template.adoc deleted file mode 100644 index 763eab1e..00000000 --- a/k9-svc/bindings/rust/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/bindings/rust/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/bindings/rust/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 85f414be..00000000 --- a/k9-svc/bindings/rust/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/{{OWNER}}/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/bindings/rust/docs/decisions/README.adoc b/k9-svc/bindings/rust/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/bindings/rust/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/bindings/rust/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/bindings/rust/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/bindings/rust/docs/developer/ABI-FFI-README.adoc b/k9-svc/bindings/rust/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index 65d2afe1..00000000 --- a/k9-svc/bindings/rust/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -{{LICENSE}} - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/{{OWNER}}/rhodium-standard-repositories) diff --git a/k9-svc/bindings/rust/docs/developer/README.adoc b/k9-svc/bindings/rust/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/bindings/rust/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/bindings/rust/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/bindings/rust/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.adoc b/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/bindings/rust/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/bindings/rust/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/bindings/rust/docs/governance/README.adoc b/k9-svc/bindings/rust/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/bindings/rust/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/bindings/rust/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/bindings/rust/docs/governance/TSDM.a2ml b/k9-svc/bindings/rust/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/bindings/rust/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/bindings/rust/docs/governance/TSDM.adoc b/k9-svc/bindings/rust/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/bindings/rust/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/bindings/rust/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/bindings/rust/docs/governance/audit/README.adoc b/k9-svc/bindings/rust/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/bindings/rust/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/bindings/rust/docs/governance/audit/compliance/README.adoc b/k9-svc/bindings/rust/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/bindings/rust/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/bindings/rust/docs/governance/audit/effects/README.adoc b/k9-svc/bindings/rust/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/bindings/rust/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/bindings/rust/docs/governance/audit/systems/README.adoc b/k9-svc/bindings/rust/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/bindings/rust/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/README.adoc b/k9-svc/bindings/rust/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/corrective/README.adoc b/k9-svc/bindings/rust/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/bindings/rust/docs/governance/maintenance/perfective/README.adoc b/k9-svc/bindings/rust/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/bindings/rust/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/bindings/rust/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/bindings/rust/docs/governance/planning/README.adoc b/k9-svc/bindings/rust/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/bindings/rust/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/bindings/rust/docs/governance/planning/could/README.adoc b/k9-svc/bindings/rust/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/bindings/rust/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/bindings/rust/docs/governance/planning/must/README.adoc b/k9-svc/bindings/rust/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/bindings/rust/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/bindings/rust/docs/governance/planning/should/README.adoc b/k9-svc/bindings/rust/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/bindings/rust/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/bindings/rust/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/bindings/rust/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/bindings/rust/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/bindings/rust/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/bindings/rust/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/bindings/rust/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/bindings/rust/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/bindings/rust/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/bindings/rust/docs/practice/.gitkeep b/k9-svc/bindings/rust/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/rust/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/bindings/rust/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/bindings/rust/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/bindings/rust/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index 3d9aa304..00000000 --- a/k9-svc/bindings/rust/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **{{AUTHOR}}** -- Email: **{{AUTHOR_EMAIL}}** -- Copyright: `Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/bindings/rust/docs/practice/README.adoc b/k9-svc/bindings/rust/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/bindings/rust/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/bindings/rust/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/bindings/rust/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index b355b468..00000000 --- a/k9-svc/bindings/rust/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> diff --git a/k9-svc/bindings/rust/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/bindings/rust/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/bindings/rust/docs/reports/README.adoc b/k9-svc/bindings/rust/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/bindings/rust/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/bindings/rust/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/bindings/rust/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/bindings/rust/docs/reports/compliance/README.adoc b/k9-svc/bindings/rust/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/bindings/rust/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/bindings/rust/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/bindings/rust/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/bindings/rust/docs/reports/maintenance/README.adoc b/k9-svc/bindings/rust/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/bindings/rust/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/bindings/rust/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/bindings/rust/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/bindings/rust/docs/reports/performance/README.adoc b/k9-svc/bindings/rust/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/bindings/rust/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/bindings/rust/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/bindings/rust/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/bindings/rust/docs/reports/quality/README.adoc b/k9-svc/bindings/rust/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/bindings/rust/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/bindings/rust/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/bindings/rust/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/bindings/rust/docs/reports/security/README.adoc b/k9-svc/bindings/rust/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/bindings/rust/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/bindings/rust/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/bindings/rust/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/bindings/rust/docs/standards/README.adoc b/k9-svc/bindings/rust/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/bindings/rust/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/bindings/rust/docs/templates/contractiles/README.adoc b/k9-svc/bindings/rust/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/bindings/rust/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/bindings/rust/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/bindings/rust/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/bindings/rust/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/bindings/rust/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/bindings/rust/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/bindings/rust/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/bindings/rust/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/bindings/rust/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/bindings/rust/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/bindings/rust/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/bindings/rust/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/bindings/rust/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/bindings/rust/docs/theory/.gitkeep b/k9-svc/bindings/rust/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/rust/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/bindings/rust/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/bindings/rust/docs/theory/README.adoc b/k9-svc/bindings/rust/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/bindings/rust/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/bindings/rust/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/bindings/rust/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/bindings/rust/docs/theory/computing/README.adoc b/k9-svc/bindings/rust/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/bindings/rust/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/bindings/rust/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/bindings/rust/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/bindings/rust/docs/theory/formalisms/README.adoc b/k9-svc/bindings/rust/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/bindings/rust/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/bindings/rust/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/bindings/rust/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/bindings/rust/docs/theory/mathematics/README.adoc b/k9-svc/bindings/rust/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/bindings/rust/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/bindings/rust/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/bindings/rust/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/bindings/rust/docs/theory/ontologies/README.adoc b/k9-svc/bindings/rust/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/bindings/rust/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/bindings/rust/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/bindings/rust/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/bindings/rust/docs/theory/other/README.adoc b/k9-svc/bindings/rust/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/bindings/rust/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/bindings/rust/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/bindings/rust/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/bindings/rust/docs/theory/socio-technical/README.adoc b/k9-svc/bindings/rust/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/bindings/rust/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/bindings/rust/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/bindings/rust/docs/whitepapers/README.adoc b/k9-svc/bindings/rust/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/bindings/rust/docs/whitepapers/academic/.gitkeep b/k9-svc/bindings/rust/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/rust/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/bindings/rust/docs/whitepapers/academic/README.adoc b/k9-svc/bindings/rust/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/bindings/rust/docs/whitepapers/industry/.gitkeep b/k9-svc/bindings/rust/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/bindings/rust/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/bindings/rust/docs/whitepapers/industry/README.adoc b/k9-svc/bindings/rust/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/bindings/rust/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/bindings/rust/docs/whitepapers/outreach/README.adoc b/k9-svc/bindings/rust/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/bindings/rust/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/bindings/rust/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/bindings/rust/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/bindings/rust/docs/wikis/README.adoc b/k9-svc/bindings/rust/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/bindings/rust/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/bindings/rust/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/bindings/rust/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/bindings/rust/examples/README.adoc b/k9-svc/bindings/rust/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/bindings/rust/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/bindings/rust/examples/web-project-deno.json b/k9-svc/bindings/rust/examples/web-project-deno.json deleted file mode 100644 index 028e4f1a..00000000 --- a/k9-svc/bindings/rust/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/{{OWNER}}/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/bindings/rust/features/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/bindings/rust/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/bindings/rust/features/README.adoc b/k9-svc/bindings/rust/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/bindings/rust/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/bindings/rust/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/bindings/rust/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/bindings/rust/features/boj-server/README.adoc b/k9-svc/bindings/rust/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/bindings/rust/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/bindings/rust/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/bindings/rust/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/bindings/rust/features/panic-attacker/README.adoc b/k9-svc/bindings/rust/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/bindings/rust/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/bindings/rust/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/bindings/rust/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/bindings/rust/features/ssg/README.adoc b/k9-svc/bindings/rust/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/bindings/rust/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/bindings/rust/features/ssg/ssg-bootstrap.sh b/k9-svc/bindings/rust/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/bindings/rust/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/bindings/rust/src/error.rs b/k9-svc/bindings/rust/src/error.rs deleted file mode 100644 index f112706a..00000000 --- a/k9-svc/bindings/rust/src/error.rs +++ /dev/null @@ -1,75 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) - -//! Error types for K9 parsing and rendering. -//! -//! Provides structured error reporting with line/column information -//! for parse failures, Nickel format detection, and I/O error wrapping. - -use thiserror::Error; - -/// Errors that can occur during K9 parsing, rendering, or file I/O. -#[derive(Error, Debug)] -pub enum K9Error { - /// A syntax or structural error encountered during parsing. - #[error("parse error at line {line}, column {column}: {message}")] - ParseError { - /// The 1-based line number where the error was detected. - line: usize, - /// The 1-based column number where the error was detected. - column: usize, - /// A human-readable description of the parse failure. - message: String, - }, - - /// The file appears to be Nickel-format K9 (`.k9.ncl`), which requires - /// the Nickel evaluator and is not handled by this parser. - #[error("Nickel K9 format detected: {0} — use a Nickel evaluator to process .k9.ncl files")] - NickelFormat(String), - - /// An unknown or unsupported security level was encountered. - #[error("unknown security level: {0}")] - UnknownSecurityLevel(String), - - /// An I/O error occurred while reading or writing a file. - #[error("I/O error: {0}")] - Io(#[from] std::io::Error), - - /// A rendering error occurred while producing K9 output. - #[error("render error: {0}")] - RenderError(String), -} - -/// Convenience alias for results that may produce a [`K9Error`]. -pub type Result = std::result::Result; - -impl K9Error { - /// Create a new parse error at the given location. - /// - /// # Arguments - /// - /// * `line` - The 1-based line number. - /// * `column` - The 1-based column number. - /// * `message` - A description of what went wrong. - pub fn parse(line: usize, column: usize, message: impl Into) -> Self { - Self::ParseError { - line, - column, - message: message.into(), - } - } - - /// Format the error as a diagnostic string suitable for terminal output. - pub fn diagnostic(&self) -> String { - match self { - Self::ParseError { - line, - column, - message, - } => { - format!("error[K9]: {}:{}: {}", line, column, message) - } - other => format!("error[K9]: {}", other), - } - } -} diff --git a/k9-svc/bindings/rust/src/lib.rs b/k9-svc/bindings/rust/src/lib.rs deleted file mode 100644 index abd3ca9c..00000000 --- a/k9-svc/bindings/rust/src/lib.rs +++ /dev/null @@ -1,46 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) - -//! # k9-svc -//! -//! Parser and renderer for **K9** self-validating configuration files. -//! -//! K9 is a configuration format designed for declaring software components -//! with built-in provenance tracking (pedigree), security classification, -//! build recipes, and runtime contracts. It supports both a YAML-like -//! plain-text format (`.k9`) and a Nickel-based format (`.k9.ncl`) for -//! advanced type-checked configurations. -//! -//! ## Quick start -//! -//! ``` -//! use k9_svc::parser::parse; -//! use k9_svc::renderer::render; -//! -//! let input = r#"component: my-svc -//! version: 0.1.0 -//! pedigree: -//! origin: https://github.com/example/svc -//! author: Alice -//! security: kennel -//! "#; -//! -//! let components = parse(input).unwrap(); -//! let output = render(&components).unwrap(); -//! ``` -//! -//! ## Modules -//! -//! - [`types`] — Core data structures (`Component`, `Pedigree`, `SecurityLevel`, etc.) -//! - [`parser`] — Parse K9 text into components (detects Nickel format) -//! - [`renderer`] — Render components back to K9 text -//! - [`error`] — Error types - -pub mod error; -pub mod parser; -pub mod renderer; -pub mod types; - -// Re-export the most commonly used items at the crate root for convenience. -pub use error::K9Error; -pub use types::{Component, Contract, Pedigree, Recipe, SecurityLevel}; diff --git a/k9-svc/bindings/rust/src/parser.rs b/k9-svc/bindings/rust/src/parser.rs deleted file mode 100644 index d173e996..00000000 --- a/k9-svc/bindings/rust/src/parser.rs +++ /dev/null @@ -1,496 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) - -//! Line-by-line parser for K9 self-validating configuration files. -//! -//! K9 uses a YAML-like syntax with indentation-based nesting. This parser -//! handles `.k9` files directly and detects `.k9.ncl` (Nickel) files, -//! returning an appropriate error for the latter since they require the -//! Nickel evaluator. -//! -//! ## K9 syntax overview -//! -//! ```text -//! component: my-service -//! version: 0.1.0 -//! description: An example service -//! pedigree: -//! origin: https://github.com/example/my-service -//! author: Alice -//! license: MPL-2.0 -//! security: yard -//! recipe: -//! tool: cargo -//! command: cargo build --release -//! contract: no-unsafe -//! description: No unsafe code allowed -//! check: cargo clippy -- -D unsafe-code -//! severity: error -//! ``` - -use std::path::Path; - -use crate::error::{K9Error, Result}; -use crate::types::*; - -// --------------------------------------------------------------------------- -// Public API -// --------------------------------------------------------------------------- - -/// Parse a K9 configuration document from a string. -/// -/// # Errors -/// -/// Returns [`K9Error::ParseError`] if the input contains malformed entries -/// or missing required fields. Returns [`K9Error::NickelFormat`] if the -/// input appears to be Nickel-format K9. -/// -/// # Examples -/// -/// ``` -/// use k9_svc::parser::parse; -/// -/// let input = r#"component: my-svc -/// version: 0.1.0 -/// pedigree: -/// origin: https://github.com/example/svc -/// author: Alice -/// security: kennel -/// "#; -/// let components = parse(input).unwrap(); -/// assert_eq!(components.len(), 1); -/// assert_eq!(components[0].name, "my-svc"); -/// ``` -pub fn parse(input: &str) -> Result> { - // Detect Nickel format. - if is_nickel_format(input) { - return Err(K9Error::NickelFormat( - "input contains Nickel syntax (let, in, {, })".to_string(), - )); - } - - let lines: Vec<&str> = input.lines().collect(); - let mut components = Vec::new(); - let mut i = 0; - - while i < lines.len() { - let line = lines[i]; - let trimmed = line.trim(); - - // Skip blank lines and comments. - if trimmed.is_empty() || trimmed.starts_with('#') { - i += 1; - continue; - } - - // Top-level component declaration. - // `if let` over the strip, not starts_with + strip_prefix().unwrap(): - // that pair scans the prefix twice and lets the guard drift away from - // the extraction it is protecting. - if let Some(rest) = trimmed.strip_prefix("component:") { - let name = rest.trim().to_string(); - if name.is_empty() { - return Err(K9Error::parse(i + 1, 1, "component name is empty")); - } - i += 1; - let (component, next_i) = parse_component_body(&name, &lines, i)?; - components.push(component); - i = next_i; - continue; - } - - // Unknown top-level key. - return Err(K9Error::parse( - i + 1, - 1, - format!("unexpected top-level key: {}", trimmed), - )); - } - - Ok(components) -} - -/// Parse a K9 configuration document from a file on disk. -/// -/// Detects `.k9.ncl` files by extension and returns [`K9Error::NickelFormat`] -/// with guidance to use a Nickel evaluator. -/// -/// # Errors -/// -/// Returns [`K9Error::Io`] if the file cannot be read, [`K9Error::NickelFormat`] -/// if the file is Nickel-format, or a parse error if the content is malformed. -pub fn parse_file(path: impl AsRef) -> Result> { - let path = path.as_ref(); - - // Detect Nickel files by extension. - if let Some(name) = path.file_name().and_then(|n| n.to_str()) { - if name.ends_with(".k9.ncl") { - return Err(K9Error::NickelFormat(format!( - "file '{}' has .k9.ncl extension — use a Nickel evaluator", - path.display() - ))); - } - } - - let content = std::fs::read_to_string(path)?; - parse(&content) -} - -// --------------------------------------------------------------------------- -// Internal: component body parser -// --------------------------------------------------------------------------- - -/// Parse the indented body of a component declaration, returning the -/// component and the line index after the body. -fn parse_component_body(name: &str, lines: &[&str], start: usize) -> Result<(Component, usize)> { - let mut version: Option = None; - let mut description: Option = None; - let mut pedigree: Option = None; - let mut security_level: Option = None; - let mut recipe: Option = None; - let mut contracts: Vec = Vec::new(); - let mut metadata: Vec<(String, String)> = Vec::new(); - - let mut i = start; - - while i < lines.len() { - let line = lines[i]; - - // A non-indented, non-blank line signals the end of this component. - if !line.starts_with(' ') && !line.starts_with('\t') && !line.trim().is_empty() { - break; - } - - let trimmed = line.trim(); - if trimmed.is_empty() || trimmed.starts_with('#') { - i += 1; - continue; - } - - if let Some((key, value)) = split_kv(trimmed) { - match key { - "version" => { - version = Some(value.to_string()); - i += 1; - } - "description" => { - description = Some(value.to_string()); - i += 1; - } - "security" => { - security_level = Some( - SecurityLevel::from_str(value).ok_or_else(|| { - K9Error::UnknownSecurityLevel(value.to_string()) - })?, - ); - i += 1; - } - "pedigree" => { - i += 1; - let (ped, next_i) = parse_pedigree(lines, i)?; - pedigree = Some(ped); - i = next_i; - } - "recipe" => { - i += 1; - let (rec, next_i) = parse_recipe(lines, i)?; - recipe = Some(rec); - i = next_i; - } - "contract" => { - let contract_name = value.to_string(); - i += 1; - let (contract, next_i) = parse_contract(&contract_name, lines, i)?; - contracts.push(contract); - i = next_i; - } - _ => { - metadata.push((key.to_string(), value.to_string())); - i += 1; - } - } - } else { - i += 1; - } - } - - let version = version.ok_or_else(|| { - K9Error::parse(start, 1, format!("component '{}' missing 'version'", name)) - })?; - let pedigree = pedigree.ok_or_else(|| { - K9Error::parse(start, 1, format!("component '{}' missing 'pedigree'", name)) - })?; - let security_level = security_level.ok_or_else(|| { - K9Error::parse(start, 1, format!("component '{}' missing 'security'", name)) - })?; - - let mut comp = Component::new(name, version, pedigree, security_level); - comp.description = description; - comp.recipe = recipe; - comp.contracts = contracts; - comp.metadata = metadata; - - Ok((comp, i)) -} - -/// Parse a pedigree sub-block. -fn parse_pedigree(lines: &[&str], start: usize) -> Result<(Pedigree, usize)> { - let mut origin: Option = None; - let mut author: Option = None; - let mut license: Option = None; - let mut commit: Option = None; - let mut i = start; - - let base_indent = if i < lines.len() { - indent_level(lines[i]) - } else { - 0 - }; - - while i < lines.len() { - let line = lines[i]; - let trimmed = line.trim(); - - if trimmed.is_empty() { - i += 1; - continue; - } - - if indent_level(line) < base_indent { - break; - } - - if let Some((key, value)) = split_kv(trimmed) { - match key { - "origin" => origin = Some(value.to_string()), - "author" => author = Some(value.to_string()), - "license" => license = Some(value.to_string()), - "commit" => commit = Some(value.to_string()), - _ => {} // Ignore unknown pedigree fields for forward compatibility. - } - } - i += 1; - } - - let origin = origin.ok_or_else(|| K9Error::parse(start, 1, "pedigree missing 'origin'"))?; - let author = author.ok_or_else(|| K9Error::parse(start, 1, "pedigree missing 'author'"))?; - - let mut ped = Pedigree::new(origin, author); - ped.license = license; - ped.commit = commit; - Ok((ped, i)) -} - -/// Parse a recipe sub-block. -fn parse_recipe(lines: &[&str], start: usize) -> Result<(Recipe, usize)> { - let mut tool: Option = None; - let mut command: Option = None; - let mut requires: Vec = Vec::new(); - let mut outputs: Vec = Vec::new(); - let mut i = start; - - let base_indent = if i < lines.len() { - indent_level(lines[i]) - } else { - 0 - }; - - while i < lines.len() { - let line = lines[i]; - let trimmed = line.trim(); - - if trimmed.is_empty() { - i += 1; - continue; - } - - if indent_level(line) < base_indent { - break; - } - - if let Some((key, value)) = split_kv(trimmed) { - match key { - "tool" => tool = Some(value.to_string()), - "command" => command = Some(value.to_string()), - "requires" => requires.push(value.to_string()), - "output" | "outputs" => outputs.push(value.to_string()), - _ => {} - } - } - i += 1; - } - - let tool = tool.ok_or_else(|| K9Error::parse(start, 1, "recipe missing 'tool'"))?; - let command = - command.ok_or_else(|| K9Error::parse(start, 1, "recipe missing 'command'"))?; - - let mut rec = Recipe::new(tool, command); - rec.requires = requires; - rec.outputs = outputs; - Ok((rec, i)) -} - -/// Parse a contract sub-block. -fn parse_contract(name: &str, lines: &[&str], start: usize) -> Result<(Contract, usize)> { - let mut description: Option = None; - let mut check: Option = None; - let mut severity = "error".to_string(); - let mut i = start; - - let base_indent = if i < lines.len() { - indent_level(lines[i]) - } else { - 0 - }; - - while i < lines.len() { - let line = lines[i]; - let trimmed = line.trim(); - - if trimmed.is_empty() { - i += 1; - continue; - } - - if indent_level(line) < base_indent { - break; - } - - if let Some((key, value)) = split_kv(trimmed) { - match key { - "description" => description = Some(value.to_string()), - "check" => check = Some(value.to_string()), - "severity" => severity = value.to_string(), - _ => {} - } - } - i += 1; - } - - let description = description.unwrap_or_default(); - let check = - check.ok_or_else(|| K9Error::parse(start, 1, format!("contract '{}' missing 'check'", name)))?; - - let mut contract = Contract::new(name, description, check); - contract.severity = severity; - Ok((contract, i)) -} - -// --------------------------------------------------------------------------- -// Helpers -// --------------------------------------------------------------------------- - -/// Split a `key: value` line into its components. -fn split_kv(line: &str) -> Option<(&str, &str)> { - let (key, rest) = line.split_once(':')?; - Some((key.trim(), rest.trim())) -} - -/// Count the leading whitespace (spaces) of a line. -fn indent_level(line: &str) -> usize { - line.len() - line.trim_start().len() -} - -/// Heuristic check for Nickel-format K9 content. -fn is_nickel_format(input: &str) -> bool { - // Nickel files typically start with `let` bindings or contain `{` at the - // top level outside of string values. - let first_significant = input - .lines() - .map(|l| l.trim()) - .find(|l| !l.is_empty() && !l.starts_with('#')); - - if let Some(line) = first_significant { - line.starts_with("let ") || line.starts_with('{') - } else { - false - } -} - -// --------------------------------------------------------------------------- -// Tests -// --------------------------------------------------------------------------- - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn parse_empty_input() { - let components = parse("").unwrap(); - assert!(components.is_empty()); - } - - #[test] - fn parse_minimal_component() { - let input = r#"component: test-svc - version: 1.0.0 - pedigree: - origin: https://github.com/example/test - author: Alice - security: kennel -"#; - let components = parse(input).unwrap(); - assert_eq!(components.len(), 1); - assert_eq!(components[0].name, "test-svc"); - assert_eq!(components[0].version, "1.0.0"); - assert_eq!(components[0].security_level, SecurityLevel::Kennel); - assert_eq!(components[0].pedigree.author, "Alice"); - } - - #[test] - fn parse_with_recipe_and_contract() { - let input = r#"component: my-lib - version: 0.2.0 - pedigree: - origin: https://github.com/example/lib - author: Bob - license: MPL-2.0 - security: yard - recipe: - tool: cargo - command: cargo build --release - contract: no-unsafe - description: Forbid unsafe blocks - check: cargo clippy -- -D unsafe-code - severity: error -"#; - let components = parse(input).unwrap(); - assert_eq!(components.len(), 1); - let c = &components[0]; - assert!(c.recipe.is_some()); - assert_eq!(c.recipe.as_ref().unwrap().tool, "cargo"); - assert_eq!(c.contracts.len(), 1); - assert_eq!(c.contracts[0].name, "no-unsafe"); - } - - #[test] - fn detect_nickel_format() { - let input = "let config = { name = \"test\" } in config"; - let result = parse(input); - assert!(matches!(result, Err(K9Error::NickelFormat(_)))); - } - - #[test] - fn missing_required_field_errors() { - let input = r#"component: incomplete - version: 1.0.0 - security: hunt -"#; - // Missing pedigree. - assert!(parse(input).is_err()); - } - - #[test] - fn unknown_security_level_errors() { - let input = r#"component: bad - version: 1.0.0 - pedigree: - origin: https://example.com - author: X - security: fortress -"#; - let result = parse(input); - assert!(matches!(result, Err(K9Error::UnknownSecurityLevel(_)))); - } -} diff --git a/k9-svc/bindings/rust/src/renderer.rs b/k9-svc/bindings/rust/src/renderer.rs deleted file mode 100644 index aca79a55..00000000 --- a/k9-svc/bindings/rust/src/renderer.rs +++ /dev/null @@ -1,172 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) - -//! Renderer that serialises K9 data types back to K9 text format. -//! -//! The [`render`] function takes a slice of [`Component`]s and produces a -//! string in the canonical K9 text representation, suitable for writing -//! to a `.k9` file. - -use crate::error::Result; -use crate::types::*; - -/// Render a list of [`Component`]s to their canonical K9 text representation. -/// -/// # Errors -/// -/// Returns [`K9Error::RenderError`] if any element cannot be serialised -/// (currently infallible, but the signature allows future extension). -/// -/// # Examples -/// -/// ``` -/// use k9_svc::types::*; -/// use k9_svc::renderer::render; -/// -/// let comp = Component::new( -/// "example", -/// "1.0.0", -/// Pedigree::new("https://github.com/foo/bar", "Alice"), -/// SecurityLevel::Kennel, -/// ); -/// let output = render(&[comp]).unwrap(); -/// assert!(output.contains("component: example")); -/// ``` -pub fn render(components: &[Component]) -> Result { - let mut out = String::new(); - - for (idx, comp) in components.iter().enumerate() { - render_component(comp, &mut out); - if idx + 1 < components.len() { - out.push('\n'); - } - } - - Ok(out) -} - -// --------------------------------------------------------------------------- -// Component rendering -// --------------------------------------------------------------------------- - -/// Render a single component to the output buffer. -fn render_component(comp: &Component, out: &mut String) { - out.push_str(&format!("component: {}\n", comp.name)); - out.push_str(&format!(" version: {}\n", comp.version)); - - if let Some(desc) = &comp.description { - out.push_str(&format!(" description: {}\n", desc)); - } - - // Pedigree. - render_pedigree(&comp.pedigree, out); - - // Security level. - out.push_str(&format!(" security: {}\n", comp.security_level)); - - // Recipe. - if let Some(recipe) = &comp.recipe { - render_recipe(recipe, out); - } - - // Contracts. - for contract in &comp.contracts { - render_contract(contract, out); - } - - // Metadata. - for (key, value) in &comp.metadata { - out.push_str(&format!(" {}: {}\n", key, value)); - } -} - -/// Render pedigree sub-block. -fn render_pedigree(ped: &Pedigree, out: &mut String) { - out.push_str(" pedigree:\n"); - out.push_str(&format!(" origin: {}\n", ped.origin)); - out.push_str(&format!(" author: {}\n", ped.author)); - if let Some(license) = &ped.license { - out.push_str(&format!(" license: {}\n", license)); - } - if let Some(commit) = &ped.commit { - out.push_str(&format!(" commit: {}\n", commit)); - } -} - -/// Render recipe sub-block. -fn render_recipe(recipe: &Recipe, out: &mut String) { - out.push_str(" recipe:\n"); - out.push_str(&format!(" tool: {}\n", recipe.tool)); - out.push_str(&format!(" command: {}\n", recipe.command)); - for req in &recipe.requires { - out.push_str(&format!(" requires: {}\n", req)); - } - for output_name in &recipe.outputs { - out.push_str(&format!(" output: {}\n", output_name)); - } -} - -/// Render contract sub-block. -fn render_contract(contract: &Contract, out: &mut String) { - out.push_str(&format!(" contract: {}\n", contract.name)); - out.push_str(&format!(" description: {}\n", contract.description)); - out.push_str(&format!(" check: {}\n", contract.check)); - out.push_str(&format!(" severity: {}\n", contract.severity)); -} - -// --------------------------------------------------------------------------- -// Tests -// --------------------------------------------------------------------------- - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn render_minimal_component() { - let comp = Component::new( - "test-svc", - "0.1.0", - Pedigree::new("https://github.com/example/test", "Alice"), - SecurityLevel::Yard, - ); - let output = render(&[comp]).unwrap(); - assert!(output.contains("component: test-svc")); - assert!(output.contains(" version: 0.1.0")); - assert!(output.contains(" security: yard")); - assert!(output.contains(" origin: https://github.com/example/test")); - } - - #[test] - fn render_with_recipe() { - let mut comp = Component::new( - "builder", - "1.0.0", - Pedigree::new("https://example.com", "Bob"), - SecurityLevel::Hunt, - ); - comp.recipe = Some(Recipe::new("cargo", "cargo build --release")); - let output = render(&[comp]).unwrap(); - assert!(output.contains(" recipe:")); - assert!(output.contains(" tool: cargo")); - } - - #[test] - fn render_multiple_components() { - let c1 = Component::new( - "alpha", - "1.0.0", - Pedigree::new("https://example.com/a", "A"), - SecurityLevel::Kennel, - ); - let c2 = Component::new( - "beta", - "2.0.0", - Pedigree::new("https://example.com/b", "B"), - SecurityLevel::Yard, - ); - let output = render(&[c1, c2]).unwrap(); - assert!(output.contains("component: alpha")); - assert!(output.contains("component: beta")); - } -} diff --git a/k9-svc/bindings/rust/src/types.rs b/k9-svc/bindings/rust/src/types.rs deleted file mode 100644 index 1c3eb803..00000000 --- a/k9-svc/bindings/rust/src/types.rs +++ /dev/null @@ -1,229 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) - -//! Core data types for K9 self-validating configuration documents. -//! -//! A K9 document declares software [`Component`]s with their [`Pedigree`] -//! (provenance), [`SecurityLevel`], [`Recipe`] (build instructions), and -//! [`Contract`] (runtime invariants). - -use serde::{Deserialize, Serialize}; - -// --------------------------------------------------------------------------- -// Component — the top-level unit -// --------------------------------------------------------------------------- - -/// A software component declared in a K9 configuration file. -/// -/// Each component has a name, version, pedigree (provenance chain), -/// security classification, optional build recipe, and optional contracts. -#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] -pub struct Component { - /// The unique name of this component (e.g. `"a2ml-parser"`). - pub name: String, - - /// The semantic version string (e.g. `"0.1.0"`). - pub version: String, - - /// A short human-readable description of the component's purpose. - pub description: Option, - - /// Provenance information for this component. - pub pedigree: Pedigree, - - /// The security classification level. - pub security_level: SecurityLevel, - - /// Build or assembly instructions for the component. - pub recipe: Option, - - /// Runtime contracts (invariants) this component must satisfy. - pub contracts: Vec, - - /// Arbitrary key-value metadata. - pub metadata: Vec<(String, String)>, -} - -impl Component { - /// Create a new component with the minimum required fields. - pub fn new( - name: impl Into, - version: impl Into, - pedigree: Pedigree, - security_level: SecurityLevel, - ) -> Self { - Self { - name: name.into(), - version: version.into(), - description: None, - pedigree, - security_level, - recipe: None, - contracts: Vec::new(), - metadata: Vec::new(), - } - } -} - -// --------------------------------------------------------------------------- -// Pedigree — provenance chain -// --------------------------------------------------------------------------- - -/// Provenance information recording how a component was produced. -/// -/// Tracks the origin (source forge/URL), author, and an optional chain -/// of upstream sources for auditability. -#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] -pub struct Pedigree { - /// The origin URL or forge identifier (e.g. `"https://github.com/foo/bar"`). - pub origin: String, - - /// The author or maintainer identity. - pub author: String, - - /// The licence SPDX identifier (e.g. `"MPL-2.0"`). - pub license: Option, - - /// An optional commit hash or tag pinning this pedigree to a specific revision. - pub commit: Option, - - /// Upstream pedigrees this component was derived from. - pub upstream: Vec, -} - -impl Pedigree { - /// Create a new pedigree with origin and author. - pub fn new(origin: impl Into, author: impl Into) -> Self { - Self { - origin: origin.into(), - author: author.into(), - license: None, - commit: None, - upstream: Vec::new(), - } - } -} - -// --------------------------------------------------------------------------- -// SecurityLevel — kennel / yard / hunt -// --------------------------------------------------------------------------- - -/// The security classification of a component. -/// -/// K9 uses a three-tier model inspired by working-dog access zones: -/// -/// - **Kennel** — internal only, highest trust, lowest exposure. -/// - **Yard** — semi-trusted, accessible within a bounded perimeter. -/// - **Hunt** — fully exposed, untrusted environment, maximum hardening. -#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)] -pub enum SecurityLevel { - /// Internal-only component; highest trust, lowest exposure. - Kennel, - /// Semi-trusted component within a bounded perimeter. - Yard, - /// Fully exposed component requiring maximum hardening. - Hunt, -} - -impl SecurityLevel { - /// Parse a security level from its canonical string representation. - /// - /// Recognised values (case-insensitive): `"kennel"`, `"yard"`, `"hunt"`. - pub fn from_str(s: &str) -> Option { - match s.to_lowercase().as_str() { - "kennel" => Some(Self::Kennel), - "yard" => Some(Self::Yard), - "hunt" => Some(Self::Hunt), - _ => None, - } - } - - /// Return the canonical string representation of this security level. - pub fn as_str(&self) -> &'static str { - match self { - Self::Kennel => "kennel", - Self::Yard => "yard", - Self::Hunt => "hunt", - } - } -} - -impl std::fmt::Display for SecurityLevel { - fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { - f.write_str(self.as_str()) - } -} - -// --------------------------------------------------------------------------- -// Recipe — build instructions -// --------------------------------------------------------------------------- - -/// Build or assembly instructions for a component. -/// -/// A recipe describes how to produce the component from source, including -/// build commands, required tools, and output artefacts. -#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] -pub struct Recipe { - /// The build tool or system (e.g. `"cargo"`, `"just"`, `"deno"`). - pub tool: String, - - /// The build command(s) to execute. - pub command: String, - - /// Required tool versions or prerequisites. - pub requires: Vec, - - /// Output artefact paths or names. - pub outputs: Vec, -} - -impl Recipe { - /// Create a new recipe with a tool and command. - pub fn new(tool: impl Into, command: impl Into) -> Self { - Self { - tool: tool.into(), - command: command.into(), - requires: Vec::new(), - outputs: Vec::new(), - } - } -} - -// --------------------------------------------------------------------------- -// Contract — runtime invariants -// --------------------------------------------------------------------------- - -/// A runtime contract (invariant) that a component must satisfy. -/// -/// Contracts are self-validating checks that can be executed at build time, -/// deploy time, or runtime to verify component correctness. -#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)] -pub struct Contract { - /// A short identifier for this contract (e.g. `"no-unsafe"`). - pub name: String, - - /// A human-readable description of what the contract checks. - pub description: String, - - /// The check expression or command that validates the contract. - pub check: String, - - /// The severity if the contract is violated: `"error"`, `"warning"`, or `"info"`. - pub severity: String, -} - -impl Contract { - /// Create a new contract. - pub fn new( - name: impl Into, - description: impl Into, - check: impl Into, - ) -> Self { - Self { - name: name.into(), - description: description.into(), - check: check.into(), - severity: "error".to_string(), - } - } -} diff --git a/k9-svc/bindings/rust/tests/crg_c_tests.rs b/k9-svc/bindings/rust/tests/crg_c_tests.rs deleted file mode 100644 index 195d395d..00000000 --- a/k9-svc/bindings/rust/tests/crg_c_tests.rs +++ /dev/null @@ -1,580 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// (MPL-2.0 required for crates.io) -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// CRG C test suite for the k9-svc crate. -// -// Test categories covered (all required for CRG Grade C): -// -// [SMOKE] Fast, dependency-free sanity checks. -// -// [UNIT] Per-feature correctness tests (supplement to inline tests). -// -// [P2P] Property-based (proptest) tests verifying invariants hold for -// arbitrary inputs. -// -// [CONTRACT] Pre/post-condition tests for every public function's contract. -// -// [ASPECT] Cross-cutting concerns: security (injection, large inputs, -// null bytes), error propagation. -// -// [E2E] Reflexive / dogfood: parse real K9 files from the standards -// repo; verify round-trip stability. - -use k9_svc::parser::parse; -use k9_svc::renderer::render; -use k9_svc::types::{Component, Contract, Pedigree, Recipe, SecurityLevel}; - -// ============================================================================ -// [SMOKE] — happy-path sanity checks -// ============================================================================ - -/// SMOKE: the crate can be imported and a minimal component parses. -#[test] -fn smoke_minimal_parse() { - let input = r#"component: my-svc - version: 0.1.0 - pedigree: - origin: https://github.com/example/svc - author: Alice - security: kennel -"#; - let components = parse(input).expect("[SMOKE] minimal parse must succeed"); - assert_eq!(components.len(), 1, "[SMOKE] one component expected"); - assert_eq!(components[0].name, "my-svc"); -} - -/// SMOKE: SecurityLevel display names are stable. -#[test] -fn smoke_security_level_display() { - assert_eq!(SecurityLevel::Kennel.to_string(), "kennel"); - assert_eq!(SecurityLevel::Yard.to_string(), "yard"); - assert_eq!(SecurityLevel::Hunt.to_string(), "hunt"); -} - -/// SMOKE: render of a minimal component produces expected fields. -#[test] -fn smoke_render_minimal() { - let comp = Component::new( - "smoke-svc", - "1.0.0", - Pedigree::new("https://github.com/example/smoke", "Eve"), - SecurityLevel::Hunt, - ); - let output = render(&[comp]).expect("[SMOKE] render must succeed"); - assert!(output.contains("component: smoke-svc"), "[SMOKE] name in output"); - assert!(output.contains(" version: 1.0.0"), "[SMOKE] version in output"); - assert!(output.contains(" security: hunt"), "[SMOKE] security in output"); -} - -// ============================================================================ -// [UNIT] — targeted per-feature unit tests -// ============================================================================ - -/// UNIT: SecurityLevel ordering: Kennel < Yard < Hunt (most exposed = Hunt). -#[test] -fn unit_security_level_ordering() { - // Kennel is most trusted (least exposed), Hunt is most exposed. - // The ordering should reflect exposure or be well-defined. - // Just verify they are distinct and comparable. - assert_ne!(SecurityLevel::Kennel, SecurityLevel::Yard); - assert_ne!(SecurityLevel::Yard, SecurityLevel::Hunt); - assert_ne!(SecurityLevel::Kennel, SecurityLevel::Hunt); -} - -/// UNIT: component with description is parsed correctly. -#[test] -fn unit_component_with_description() { - let input = r#"component: annotated - version: 0.3.0 - description: A well-described service - pedigree: - origin: https://example.com - author: Bob - security: yard -"#; - let components = parse(input).expect("parse"); - assert_eq!(components[0].description.as_deref(), Some("A well-described service")); -} - -/// UNIT: component with recipe fields (tool, command). -#[test] -fn unit_component_with_recipe() { - let input = r#"component: builder - version: 2.0.0 - pedigree: - origin: https://example.com/builder - author: Carol - security: yard - recipe: - tool: cargo - command: cargo build --release -"#; - let components = parse(input).expect("parse"); - let recipe = components[0].recipe.as_ref().expect("recipe expected"); - assert_eq!(recipe.tool, "cargo"); - assert_eq!(recipe.command, "cargo build --release"); -} - -/// UNIT: component with contract (name, description, check, severity). -#[test] -fn unit_component_with_contract() { - let input = r#"component: guarded - version: 0.1.0 - pedigree: - origin: https://example.com/guarded - author: Dave - security: kennel - contract: no-unsafe - description: Forbid unsafe blocks - check: cargo clippy -- -D unsafe-code - severity: error -"#; - let components = parse(input).expect("parse"); - assert_eq!(components[0].contracts.len(), 1); - let contract = &components[0].contracts[0]; - assert_eq!(contract.name, "no-unsafe"); - assert_eq!(contract.severity, "error"); -} - -/// UNIT: multiple contracts on a single component. -#[test] -fn unit_multiple_contracts() { - let input = r#"component: strict - version: 1.0.0 - pedigree: - origin: https://example.com/strict - author: Eve - security: yard - contract: no-unsafe - description: No unsafe - check: cargo clippy -- -D unsafe-code - severity: error - contract: no-panic - description: No panics - check: cargo clippy -- -D clippy::unwrap_used - severity: warning -"#; - let components = parse(input).expect("parse"); - assert_eq!(components[0].contracts.len(), 2); -} - -/// UNIT: pedigree with license field (verifies optional pedigree.license is stored). -#[test] -fn unit_pedigree_with_license() { - // Build a component programmatically to verify Pedigree.license field exists. - let mut ped = Pedigree::new("https://example.com/licensed", "Frank"); - ped.license = Some("PMPL-1.0-or-later".to_string()); - let comp = Component::new("licensed", "0.1.0", ped, SecurityLevel::Hunt); - assert_eq!( - comp.pedigree.license.as_deref(), - Some("PMPL-1.0-or-later"), - "pedigree.license should be stored" - ); - // Render and check output. - let rendered = render(&[comp]).expect("render"); - assert!(rendered.contains("component: licensed")); -} - -/// UNIT: Component::new creates minimal fields with no recipe/contracts. -#[test] -fn unit_component_new_minimal() { - let comp = Component::new( - "min", - "0.0.1", - Pedigree::new("https://example.com", "X"), - SecurityLevel::Kennel, - ); - assert_eq!(comp.name, "min"); - assert_eq!(comp.version, "0.0.1"); - assert!(comp.recipe.is_none()); - assert!(comp.contracts.is_empty()); - assert!(comp.metadata.is_empty()); - assert!(comp.description.is_none()); -} - -/// UNIT: Recipe::new stores tool and command correctly. -#[test] -fn unit_recipe_new() { - let r = Recipe::new("just", "just build"); - assert_eq!(r.tool, "just"); - assert_eq!(r.command, "just build"); - assert!(r.requires.is_empty()); - assert!(r.outputs.is_empty()); -} - -/// UNIT: Contract::new sets default severity to "error". -#[test] -fn unit_contract_new_default_severity() { - let c = Contract::new("invariant", "Description.", "check command"); - assert_eq!(c.severity, "error"); -} - -// ============================================================================ -// [P2P] — property-based tests using proptest -// ============================================================================ - -use proptest::prelude::*; - -proptest! { - /// P2P: SecurityLevel::from_str is total for the three canonical names - /// (case-insensitive). - #[test] - fn p2p_security_level_from_str_canonical( - s in prop_oneof![ - Just("kennel"), - Just("KENNEL"), - Just("Kennel"), - Just("yard"), - Just("YARD"), - Just("Yard"), - Just("hunt"), - Just("HUNT"), - Just("Hunt"), - ] - ) { - let result = SecurityLevel::from_str(s); - prop_assert!(result.is_some(), "canonical name '{}' must parse", s); - } - - /// P2P: SecurityLevel::from_str returns None for arbitrary non-canonical strings. - #[test] - fn p2p_security_level_from_str_unknown( - s in "[a-z]{2,20}".prop_filter("exclude canonical names", |s| { - !["kennel","yard","hunt"].contains(&s.as_str()) - }) - ) { - let result = SecurityLevel::from_str(&s); - prop_assert!(result.is_none(), "non-canonical '{}' must return None", s); - } - - /// P2P: SecurityLevel display -> from_str is a perfect round-trip for all - /// variants. - #[test] - fn p2p_security_level_display_from_str_roundtrip( - idx in 0usize..3, - ) { - let levels = [SecurityLevel::Kennel, SecurityLevel::Yard, SecurityLevel::Hunt]; - let original = levels[idx]; - let s = original.to_string(); - let parsed = SecurityLevel::from_str(&s); - prop_assert_eq!(parsed, Some(original), "display->from_str roundtrip failed"); - } - - /// P2P: Component::new stores name, version, security_level verbatim. - #[test] - fn p2p_component_new_stores_verbatim( - name in "[a-z][a-z0-9-]{0,20}", - version in "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}", - security_idx in 0usize..3, - ) { - let levels = [SecurityLevel::Kennel, SecurityLevel::Yard, SecurityLevel::Hunt]; - let security = levels[security_idx]; - let comp = Component::new( - name.clone(), - version.clone(), - Pedigree::new("https://example.com", "Test"), - security, - ); - prop_assert_eq!(&comp.name, &name); - prop_assert_eq!(&comp.version, &version); - prop_assert_eq!(comp.security_level, security); - } - - /// P2P: Pedigree::new stores origin and author verbatim. - #[test] - fn p2p_pedigree_stores_verbatim( - origin in "https://[a-z]{3,20}\\.com/[a-z]{3,20}", - author in "[A-Za-z][A-Za-z ]{0,30}", - ) { - let p = Pedigree::new(origin.clone(), author.clone()); - prop_assert_eq!(&p.origin, &origin); - prop_assert_eq!(&p.author, &author); - prop_assert!(p.license.is_none()); - prop_assert!(p.commit.is_none()); - } - - /// P2P: Contract::new stores name, description, check verbatim. - #[test] - fn p2p_contract_stores_verbatim( - name in "[a-z][a-z0-9-]{0,20}", - description in "[A-Za-z ]{5,60}", - check in "[a-z ]{5,40}", - ) { - let c = Contract::new(name.clone(), description.clone(), check.clone()); - prop_assert_eq!(&c.name, &name); - prop_assert_eq!(&c.description, &description); - prop_assert_eq!(&c.check, &check); - prop_assert_eq!(&c.severity, "error"); - } -} - -// ============================================================================ -// [CONTRACT] — pre/post-condition tests -// ============================================================================ - -/// CONTRACT: parse("") post-condition: returns Ok with an empty Vec. -#[test] -fn contract_parse_empty_returns_empty_vec() { - let result = parse(""); - assert!(result.is_ok(), "CONTRACT: parse('') must return Ok"); - assert!(result.unwrap().is_empty(), "CONTRACT: empty input -> empty vec"); -} - -/// CONTRACT: render(&[]) post-condition: returns Ok with empty or whitespace-only string. -#[test] -fn contract_render_empty_slice_returns_empty() { - let result = render(&[]); - assert!(result.is_ok(), "CONTRACT: render([]) must return Ok"); - let out = result.unwrap(); - assert!( - out.is_empty() || out.trim().is_empty(), - "CONTRACT: render([]) must produce empty output, got {:?}", - out - ); -} - -/// CONTRACT: render(components) post-condition: always returns valid UTF-8. -#[test] -fn contract_render_always_utf8() { - let components = vec![ - Component::new( - "utf8-test", - "1.0.0", - Pedigree::new("https://example.com", "Ünïcödë Ãüthör"), - SecurityLevel::Kennel, - ), - ]; - let rendered = render(&components).expect("render must not fail"); - let _valid: &str = &rendered; // Rust String guarantees UTF-8 -} - -/// CONTRACT: parse(s) with Nickel format input must return K9Error::NickelFormat. -#[test] -fn contract_nickel_format_rejected() { - let nickel_input = "let config = { name = \"test\" } in config"; - use k9_svc::error::K9Error; - let result = parse(nickel_input); - assert!(result.is_err(), "CONTRACT: Nickel input must be rejected"); - assert!( - matches!(result.unwrap_err(), K9Error::NickelFormat(_)), - "CONTRACT: error must be K9Error::NickelFormat" - ); -} - -/// CONTRACT: SecurityLevel total order — for any two SecurityLevels, -/// exactly one of a < b, a == b, a > b holds. -#[test] -fn contract_security_level_total_order() { - let levels = [SecurityLevel::Kennel, SecurityLevel::Yard, SecurityLevel::Hunt]; - for &a in &levels { - for &b in &levels { - let lt = a < b; - let eq = a == b; - let gt = a > b; - let exactly_one = (lt as u8) + (eq as u8) + (gt as u8) == 1; - assert!( - exactly_one, - "CONTRACT: total order violated for {:?} vs {:?}", - a, - b - ); - } - } -} - -/// CONTRACT: missing pedigree in parse input must return Err. -#[test] -fn contract_missing_pedigree_is_err() { - let input = r#"component: incomplete - version: 1.0.0 - security: hunt -"#; - assert!(parse(input).is_err(), "CONTRACT: missing pedigree must be Err"); -} - -/// CONTRACT: unknown security level in parse input must return Err. -#[test] -fn contract_unknown_security_level_is_err() { - let input = r#"component: bad-level - version: 1.0.0 - pedigree: - origin: https://example.com - author: X - security: fortress -"#; - use k9_svc::error::K9Error; - let result = parse(input); - assert!(result.is_err(), "CONTRACT: unknown security level must be Err"); - assert!( - matches!(result.unwrap_err(), K9Error::UnknownSecurityLevel(_)), - "CONTRACT: error must be K9Error::UnknownSecurityLevel" - ); -} - -// ============================================================================ -// [ASPECT] — cross-cutting security and error-handling tests -// ============================================================================ - -/// ASPECT/SECURITY: Shell injection in origin URL is stored as plain text, -/// not executed. -#[test] -fn aspect_security_no_shell_injection_in_origin() { - let input = r#"component: injected - version: 1.0.0 - pedigree: - origin: https://example.com; rm -rf / - author: Attacker - security: hunt -"#; - // May parse (storing verbatim) or return error; must NOT execute the command. - let result = parse(input); - if let Ok(components) = result { - if let Some(comp) = components.first() { - // If parsed, origin must be stored as-is (not executed). - assert!(comp.pedigree.origin.contains("example.com")); - } - } - // If Err, that's also acceptable. -} - -/// ASPECT/SECURITY: 1 MB input does not panic. -#[test] -fn aspect_security_large_input_no_panic() { - // Build a large but valid-ish block of K9-like text. - let single_comp = "component: svc\n version: 1.0.0\n pedigree:\n origin: https://x.com\n author: X\n security: yard\n"; - let large_input: String = single_comp.repeat(1000); // ~130 KB - let _ = parse(&large_input); -} - -/// ASPECT/SECURITY: Null bytes in input do not cause UB or panic. -#[test] -fn aspect_security_null_bytes_no_panic() { - let input = "component: svc\0null\n version: 1.0.0\n pedigree:\n origin: https://x.com\n author: X\n security: yard\n"; - let _ = parse(input); -} - -/// ASPECT/SECURITY: Unicode in component name / author does not panic. -#[test] -fn aspect_security_unicode_no_panic() { - let input = r#"component: 日本語コンポーネント - version: 0.1.0 - pedigree: - origin: https://example.com/jp - author: 田中太郎 - security: kennel -"#; - let _ = parse(input); -} - -/// ASPECT/ERROR-HANDLING: K9Error diagnostic produces non-empty string. -#[test] -fn aspect_error_diagnostic_non_empty() { - use k9_svc::error::K9Error; - let err = K9Error::UnknownSecurityLevel("fortress".into()); - let diag = format!("{}", err); - assert!(!diag.is_empty(), "ASPECT: error display must not be empty"); - assert!(diag.contains("fortress"), "ASPECT: error must mention the bad value"); -} - -/// ASPECT/ERROR-HANDLING: NickelFormat error includes the Nickel content. -#[test] -fn aspect_error_nickel_format_message() { - use k9_svc::error::K9Error; - let err = K9Error::NickelFormat("let x = 1 in x".into()); - let msg = format!("{}", err); - assert!(!msg.is_empty(), "ASPECT: NickelFormat error must not be empty"); -} - -// ============================================================================ -// [E2E] — reflexive / dogfood tests -// ============================================================================ - -/// E2E/REFLEXIVE: parse any K9 files found in the standards repo. -/// -/// The k9-svc/ directory may contain real K9 configuration files. -/// This test finds them and verifies they parse without error. -#[test] -fn e2e_dogfood_parse_k9_fixtures() { - let crate_dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")); - // k9-svc/bindings/rust/ -> standards/k9-svc/ -> standards/ - let standards_root = crate_dir - .parent() // rust/ - .and_then(|p| p.parent()) // bindings/ - .and_then(|p| p.parent()) // k9-svc/ - .and_then(|p| p.parent()) // standards/ - .expect("could not traverse to standards root"); - - // Look for .k9 files in the k9-svc directory. - let k9_dir = standards_root.join("k9-svc"); - if !k9_dir.exists() { - eprintln!("[E2E] Skipping: k9-svc dir not found at {}", k9_dir.display()); - return; - } - - // Enumerate .k9 files (non-recursive for simplicity). - let entries: Vec<_> = std::fs::read_dir(&k9_dir) - .expect("[E2E] k9-svc dir must be readable") - .filter_map(|e| e.ok()) - .filter(|e| { - e.path() - .extension() - .map(|ext| ext == "k9") - .unwrap_or(false) - }) - .collect(); - - if entries.is_empty() { - eprintln!("[E2E] No .k9 files found in {}; skipping.", k9_dir.display()); - return; - } - - for entry in &entries { - let path = entry.path(); - let content = std::fs::read_to_string(&path) - .expect(&format!("[E2E] {} must be readable", path.display())); - let result = parse(&content); - assert!( - result.is_ok(), - "[E2E] {} must parse successfully, got: {:?}", - path.display(), - result.unwrap_err() - ); - } -} - -/// E2E/REFLEXIVE: round-trip a programmatically constructed K9 document. -/// -/// Build a component, render it, re-parse the rendered output, and verify -/// the key fields are preserved. -#[test] -fn e2e_roundtrip_constructed_component() { - let mut comp = Component::new( - "e2e-svc", - "3.0.0", - Pedigree::new("https://github.com/hyperpolymath/e2e-test", "Tester"), - SecurityLevel::Yard, - ); - comp.description = Some("E2E round-trip test component".into()); - comp.recipe = Some(Recipe::new("cargo", "cargo build --release")); - comp.contracts.push(Contract::new( - "no-unsafe", - "Forbid unsafe blocks", - "cargo clippy -- -D unsafe-code", - )); - - let rendered = render(&[comp.clone()]).expect("[E2E] render must succeed"); - assert!(!rendered.is_empty(), "[E2E] rendered output must be non-empty"); - - let re_parsed = parse(&rendered).expect("[E2E] re-parse must succeed"); - assert_eq!(re_parsed.len(), 1, "[E2E] one component after roundtrip"); - - let c = &re_parsed[0]; - assert_eq!(c.name, "e2e-svc", "[E2E] name preserved"); - assert_eq!(c.version, "3.0.0", "[E2E] version preserved"); - assert_eq!(c.security_level, SecurityLevel::Yard, "[E2E] security_level preserved"); - assert_eq!( - c.pedigree.author, "Tester", - "[E2E] pedigree.author preserved" - ); -} diff --git a/k9-svc/bindings/rust/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/bindings/rust/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/bindings/rust/verification/README.adoc b/k9-svc/bindings/rust/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/bindings/rust/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/bindings/rust/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/bindings/rust/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/bindings/rust/verification/benchmarks/README.adoc b/k9-svc/bindings/rust/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/bindings/rust/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/bindings/rust/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/bindings/rust/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/rust/verification/coverage/README.adoc b/k9-svc/bindings/rust/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/bindings/rust/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/bindings/rust/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/bindings/rust/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/bindings/rust/verification/fuzzing/README.adoc b/k9-svc/bindings/rust/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/bindings/rust/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/bindings/rust/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/bindings/rust/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/bindings/rust/verification/proofs/README.adoc b/k9-svc/bindings/rust/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/bindings/rust/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/bindings/rust/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/bindings/rust/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/rust/verification/safety_case/README.adoc b/k9-svc/bindings/rust/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/bindings/rust/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/bindings/rust/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/bindings/rust/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/bindings/rust/verification/simulations/README.adoc b/k9-svc/bindings/rust/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/bindings/rust/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/bindings/rust/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/bindings/rust/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/bindings/rust/verification/tests/README.adoc b/k9-svc/bindings/rust/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/bindings/rust/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/bindings/rust/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/bindings/rust/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/bindings/rust/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/bindings/rust/verification/traceability/README.adoc b/k9-svc/bindings/rust/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/bindings/rust/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/compose.yaml b/k9-svc/compose.yaml deleted file mode 100644 index 2e4aa701..00000000 --- a/k9-svc/compose.yaml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# compose.yaml - K9 SVC Development Environment -# -# Usage: -# podman-compose up -d # Start development environment -# podman-compose run k9 dogfood # Run dogfood test -# podman-compose down # Stop environment - -services: - k9: - build: - context: . - dockerfile: Containerfile - container_name: k9-svc - volumes: - # Mount local components for development - - ./components:/home/k9user/k9/components:ro - # Mount examples (read-only) - - ./examples:/home/k9user/k9/examples:ro - environment: - # Default to Yard level (safe) - K9_DEFAULT_LEASH: "'Yard" - # Enable verbose output - K9_VERBOSE: "true" - # Override entrypoint for interactive use - stdin_open: true - tty: true - - # Validation service - runs in 'Yard mode only - validator: - build: - context: . - dockerfile: Containerfile - container_name: k9-validator - entrypoint: ["./must", "run", "validate-all"] - volumes: - - ./components:/home/k9user/k9/components:ro - environment: - K9_DEFAULT_LEASH: "'Yard" - read_only: true - security_opt: - - no-new-privileges:true - - # Documentation generator - docs: - build: - context: . - dockerfile: Containerfile - container_name: k9-docs - entrypoint: ["./must", "run", "docs"] - volumes: - - ./docs:/home/k9user/k9/docs:rw - environment: - K9_DEFAULT_LEASH: "'Kennel" diff --git a/k9-svc/eclexiaiser.toml b/k9-svc/eclexiaiser.toml deleted file mode 100644 index 46848c66..00000000 --- a/k9-svc/eclexiaiser.toml +++ /dev/null @@ -1,26 +0,0 @@ -# eclexiaiser manifest — energy/carbon resource budgets -# SPDX-License-Identifier: MPL-2.0 - -[project] -name = "k9-svc" - -[[functions]] -name = "parse" -source = "bindings/rust/src/parser.rs" -energy-budget-mj = 25.0 -carbon-budget-mg = 5.0 - -[[functions]] -name = "parse_file" -source = "bindings/rust/src/parser.rs" -energy-budget-mj = 20.0 -carbon-budget-mg = 4.0 - -[carbon] -provider = "static" -region = "GB" -static-intensity = 200.0 - -[report] -format = "text" -include-recommendations = true diff --git a/k9-svc/editors/k9-notepadpp.xml b/k9-svc/editors/k9-notepadpp.xml deleted file mode 100644 index fd27f863..00000000 --- a/k9-svc/editors/k9-notepadpp.xml +++ /dev/null @@ -1,83 +0,0 @@ - - - - - - - - - - - - let in import std if then else match fun forall merge default optional - - Kennel Yard Hunt true false null - - name version description author breed magic_number trust_level leash pedigree config schema_version component_type created k9_spec_version os is_edge requires_podman min_memory_mb allow_network allow_filesystem_write allow_subprocess signature - - install validate deploy migrate rollback preflight postflight build test sign scan verify release package clean - - - - - - - - 00" 01" 02 - - 03m%" 04"% 05 - - 06 07 08 - - 09 10 11 - - 12 13 14 - - 15 16 17 - - 18 19 20 - - 21 22 23 - - - - 00# 01 02 03 04 - - - = | : , - - - { [ - } ] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/k9-svc/editors/k9.tmLanguage.json b/k9-svc/editors/k9.tmLanguage.json deleted file mode 100644 index f9b99dbe..00000000 --- a/k9-svc/editors/k9.tmLanguage.json +++ /dev/null @@ -1,129 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/martinring/tmlanguage/master/tmlanguage.json", - "name": "K9", - "scopeName": "source.k9", - "comment": "SPDX-License-Identifier: MPL-2.0", - "fileTypes": ["k9", "k9.ncl"], - "patterns": [ - { "include": "#comment" }, - { "include": "#magic" }, - { "include": "#import" }, - { "include": "#let-binding" }, - { "include": "#contract-annotation" }, - { "include": "#security-level" }, - { "include": "#boolean" }, - { "include": "#recipe" }, - { "include": "#pedigree-field" }, - { "include": "#multiline-string" }, - { "include": "#string" }, - { "include": "#number" }, - { "include": "#operator" }, - { "include": "#braces" } - ], - "repository": { - "comment": { - "name": "comment.line.number-sign.k9", - "match": "#.*$" - }, - "magic": { - "comment": "K9! magic number at start of file", - "name": "keyword.other.magic.k9", - "match": "^K9!" - }, - "import": { - "comment": "import \"path\" statements", - "match": "(import)\\s+(\"[^\"]*\")", - "captures": { - "1": { "name": "keyword.control.import.k9" }, - "2": { "name": "string.quoted.double.k9" } - } - }, - "let-binding": { - "comment": "let Name = ... in", - "match": "\\b(let)\\s+([A-Za-z_][A-Za-z0-9_]*)\\b", - "captures": { - "1": { "name": "keyword.control.let.k9" }, - "2": { "name": "entity.name.function.k9" } - } - }, - "contract-annotation": { - "comment": "| Contract type annotations (Nickel contracts)", - "match": "\\|\\s+([A-Z][A-Za-z0-9_]*)", - "captures": { - "1": { "name": "entity.name.type.contract.k9" } - } - }, - "security-level": { - "comment": "Trust levels: 'Kennel, 'Yard, 'Hunt and other enum variants", - "name": "constant.language.security.k9", - "match": "'(Kennel|Yard|Hunt|Linux|Minix|MacOS|Android|PC|ASIC|Unknown|Major|Minor|Patch)\\b" - }, - "boolean": { - "name": "constant.language.boolean.k9", - "match": "\\b(true|false)\\b" - }, - "recipe": { - "comment": "Recipe/lifecycle names used as keys", - "match": "\\b(install|validate|deploy|migrate|rollback|preflight|postflight|build|test|sign|scan|verify|release|package|clean)\\b(?=\\s*=)", - "captures": { - "1": { "name": "keyword.other.recipe.k9" } - } - }, - "pedigree-field": { - "comment": "Common pedigree and config field names", - "match": "\\b(name|version|description|author|breed|magic_number|trust_level|leash|pedigree|config|schema_version|component_type|created|k9_spec_version|os|is_edge|requires_podman|min_memory_mb|allow_network|allow_filesystem_write|allow_subprocess|signature)\\b(?=\\s*[|=])", - "captures": { - "1": { "name": "variable.other.pedigree.k9" } - } - }, - "multiline-string": { - "comment": "Nickel multiline strings m%\"...\"% ", - "name": "string.quoted.other.multiline.k9", - "begin": "m%\"", - "end": "\"%", - "patterns": [ - { - "name": "constant.character.escape.k9", - "match": "%\\{[^}]*\\}" - } - ] - }, - "string": { - "name": "string.quoted.double.k9", - "begin": "\"", - "end": "\"", - "patterns": [ - { - "name": "constant.character.escape.k9", - "match": "\\\\." - }, - { - "name": "constant.character.escape.interpolation.k9", - "match": "%\\{[^}]*\\}" - } - ] - }, - "number": { - "name": "constant.numeric.k9", - "match": "\\b-?[0-9]+(\\.[0-9]+)?\\b" - }, - "operator": { - "name": "keyword.operator.k9", - "match": "[=|{}\\[\\]]" - }, - "braces": { - "comment": "Block delimiters for folding", - "begin": "\\{", - "end": "\\}", - "beginCaptures": { - "0": { "name": "punctuation.section.block.begin.k9" } - }, - "endCaptures": { - "0": { "name": "punctuation.section.block.end.k9" } - }, - "patterns": [ - { "include": "$self" } - ] - } - } -} diff --git a/k9-svc/editors/vscode/.devcontainer/Containerfile b/k9-svc/editors/vscode/.devcontainer/Containerfile deleted file mode 100644 index b0a6fd1b..00000000 --- a/k9-svc/editors/vscode/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Dev Container image for {{PROJECT_NAME}} -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/{{PROJECT_NAME}} - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/editors/vscode/.devcontainer/README.adoc b/k9-svc/editors/vscode/.devcontainer/README.adoc deleted file mode 100644 index 3bfb50e5..00000000 --- a/k9-svc/editors/vscode/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}> - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/editors/vscode/.devcontainer/devcontainer.json b/k9-svc/editors/vscode/.devcontainer/devcontainer.json deleted file mode 100644 index a4b33e0a..00000000 --- a/k9-svc/editors/vscode/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -// -// Dev Container configuration for {{PROJECT_NAME}} -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "{{PROJECT_NAME}}", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/editors/vscode/.editorconfig b/k9-svc/editors/vscode/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/editors/vscode/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/editors/vscode/.envrc b/k9-svc/editors/vscode/.envrc deleted file mode 100644 index 4ca685b4..00000000 --- a/k9-svc/editors/vscode/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/editors/vscode/.gitattributes b/k9-svc/editors/vscode/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/editors/vscode/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/editors/vscode/.github/.mailmap b/k9-svc/editors/vscode/.github/.mailmap deleted file mode 100644 index 0ada9de5..00000000 --- a/k9-svc/editors/vscode/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}> diff --git a/k9-svc/editors/vscode/.github/.nojekyll b/k9-svc/editors/vscode/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/editors/vscode/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/editors/vscode/.github/CODEOWNERS b/k9-svc/editors/vscode/.github/CODEOWNERS deleted file mode 100644 index 611b5a84..00000000 --- a/k9-svc/editors/vscode/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace {{OWNER}} with your GitHub username or team - -# Default owners for everything -* @{{OWNER}} - -# Security-sensitive files require explicit review -SECURITY.md @{{OWNER}} -.github/workflows/ @{{OWNER}} -Trustfile.a2ml @{{OWNER}} -.machine_readable/ @{{OWNER}} diff --git a/k9-svc/editors/vscode/.github/CODE_OF_CONDUCT.md b/k9-svc/editors/vscode/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index 2777a724..00000000 --- a/k9-svc/editors/vscode/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in {{PROJECT_NAME}} a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://{{FORGE}}/{{OWNER}}/{{REPO}}/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: {{CURRENT_YEAR}} · Based on Contributor Covenant 2.1 diff --git a/k9-svc/editors/vscode/.github/CONTRIBUTING.md b/k9-svc/editors/vscode/.github/CONTRIBUTING.md deleted file mode 100644 index 02758c67..00000000 --- a/k9-svc/editors/vscode/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://{{FORGE}}/{{OWNER}}/{{REPO}}.git -cd {{REPO}} - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create {{REPO}}-dev -toolbox enter {{REPO}}-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -{{REPO}}/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `{{MAIN_BRANCH}}` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/help%20wanted) — Community help needed -- [`documentation`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/documentation) — Docs improvements -- [`perimeter-3`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/editors/vscode/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/editors/vscode/.github/FUNDING.yml b/k9-svc/editors/vscode/.github/FUNDING.yml deleted file mode 100644 index c078261e..00000000 --- a/k9-svc/editors/vscode/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for {{OWNER}} projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: {{OWNER}} -ko_fi: {{OWNER}} -liberapay: {{OWNER}} diff --git a/k9-svc/editors/vscode/.github/GOVERNANCE.md b/k9-svc/editors/vscode/.github/GOVERNANCE.md deleted file mode 100644 index fcbcec0c..00000000 --- a/k9-svc/editors/vscode/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **{{PROJECT_NAME}}**. - ---- - -## Project Governance Model - -{{PROJECT_NAME}} follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) {{CURRENT_YEAR}} {{OWNER}}. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index ec2aa283..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for {{OWNER}}/{{REPO}} -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index cb7a33cb..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for {{OWNER}}/{{REPO}} -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/{{OWNER}}/{{REPO}}/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 6aa9e631..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for {{OWNER}}/{{REPO}} -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 88e07205..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for {{OWNER}}/{{REPO}} -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 6d88090c..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for {{OWNER}}/{{REPO}} -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index 48bb574e..00000000 --- a/k9-svc/editors/vscode/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for {{OWNER}}/{{REPO}} -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/editors/vscode/.github/MAINTAINERS b/k9-svc/editors/vscode/.github/MAINTAINERS deleted file mode 100644 index 145c4e96..00000000 --- a/k9-svc/editors/vscode/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -{{AUTHOR}} <{{AUTHOR_EMAIL}}> (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/editors/vscode/.github/README.adoc b/k9-svc/editors/vscode/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/editors/vscode/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/editors/vscode/.github/SECURITY.md b/k9-svc/editors/vscode/.github/SECURITY.md deleted file mode 100644 index 7dd7b29e..00000000 --- a/k9-svc/editors/vscode/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`{{OWNER}}/{{REPO}}`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using {{PROJECT_NAME}}, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ - ---- - -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 diff --git a/k9-svc/editors/vscode/.github/SUPPORT b/k9-svc/editors/vscode/.github/SUPPORT deleted file mode 100644 index b06c59a3..00000000 --- a/k9-svc/editors/vscode/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/{{OWNER}}/{{REPO}}/discussions -- GitHub Issues: https://github.com/{{OWNER}}/{{REPO}}/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/editors/vscode/.github/copilot-instructions.md b/k9-svc/editors/vscode/.github/copilot-instructions.md deleted file mode 100644 index 6b44aec8..00000000 --- a/k9-svc/editors/vscode/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/editors/vscode/.github/dependabot.yml b/k9-svc/editors/vscode/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/editors/vscode/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/editors/vscode/.github/pull_request_template.md b/k9-svc/editors/vscode/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/editors/vscode/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/editors/vscode/.github/workflows/codeql.yml b/k9-svc/editors/vscode/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/editors/vscode/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/editors/vscode/.github/workflows/governance.yml b/k9-svc/editors/vscode/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/editors/vscode/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/editors/vscode/.github/workflows/hypatia-scan.yml b/k9-svc/editors/vscode/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/editors/vscode/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/editors/vscode/.github/workflows/jekyll.yml b/k9-svc/editors/vscode/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/editors/vscode/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/editors/vscode/.github/workflows/mirror.yml b/k9-svc/editors/vscode/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/editors/vscode/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/editors/vscode/.github/workflows/release.yml b/k9-svc/editors/vscode/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/editors/vscode/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/editors/vscode/.github/workflows/rhodibot.yml b/k9-svc/editors/vscode/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/editors/vscode/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/editors/vscode/.github/workflows/scorecard-enforcer.yml b/k9-svc/editors/vscode/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/editors/vscode/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/editors/vscode/.github/workflows/scorecard.yml b/k9-svc/editors/vscode/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/editors/vscode/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/editors/vscode/.github/workflows/secret-scanner.yml b/k9-svc/editors/vscode/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/editors/vscode/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/editors/vscode/.github/workflows/static-analysis-gate.yml b/k9-svc/editors/vscode/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/editors/vscode/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/editors/vscode/.gitignore b/k9-svc/editors/vscode/.gitignore deleted file mode 100644 index 037efd36..00000000 --- a/k9-svc/editors/vscode/.gitignore +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/editors/vscode/.gitlab-ci.yml b/k9-svc/editors/vscode/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/editors/vscode/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/editors/vscode/.guix-channel b/k9-svc/editors/vscode/.guix-channel deleted file mode 100644 index f9bdf68f..00000000 --- a/k9-svc/editors/vscode/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -;; -;; Guix channel definition for {{PROJECT_NAME}} -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name '{{PROJECT_NAME}}) -;; (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/editors/vscode/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/editors/vscode/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/editors/vscode/.machine_readable/CLADE.a2ml b/k9-svc/editors/vscode/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/editors/vscode/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/editors/vscode/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/editors/vscode/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index 1384822c..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "{{PROJECT_NAME}} Development" -# description = "Panels for {{PROJECT_NAME}} development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/editors/vscode/.machine_readable/README.adoc b/k9-svc/editors/vscode/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/editors/vscode/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/editors/vscode/.machine_readable/ai/.clinerules b/k9-svc/editors/vscode/.machine_readable/ai/.clinerules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/.cursorrules b/k9-svc/editors/vscode/.machine_readable/ai/.cursorrules deleted file mode 100644 index d3b9cee0..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/.windsurfrules b/k9-svc/editors/vscode/.machine_readable/ai/.windsurfrules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/AI.a2ml b/k9-svc/editors/vscode/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/editors/vscode/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index a1382f4f..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .) -sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .) -sed -i 's/{{OWNER}}/my-org/g' $(grep -rl '{{OWNER}}' .) -sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/{{REPO}}/my-project/g' $(grep -rl '{{REPO}}' .) -sed -i 's/{{FORGE}}/github.com/g' $(grep -rl '{{FORGE}}' .) -sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .) -sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `{{REPO}}` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `{{OWNER}}` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `{{FORGE}}` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md | -| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{LICENSE}}` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/editors/vscode/.machine_readable/ai/README.adoc b/k9-svc/editors/vscode/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/editors/vscode/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/editors/vscode/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/editors/vscode/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/editors/vscode/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/editors/vscode/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index 87238998..00000000 --- a/k9-svc/editors/vscode/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "{{OWNER}}/{{REPO}}" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "{{PROJECT_NAME}}" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "{{PROJECT_PURPOSE}}" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/editors/vscode/.machine_readable/anchors/README.adoc b/k9-svc/editors/vscode/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/editors/vscode/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/editors/vscode/.machine_readable/compliance/reuse/dep5 b/k9-svc/editors/vscode/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 3f5b2ef6..00000000 --- a/k9-svc/editors/vscode/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: {{PROJECT_NAME}} -Upstream-Contact: {{AUTHOR}} <{{AUTHOR_EMAIL}}> -Source: https://github.com/{{OWNER}}/{{REPO}} - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/editors/vscode/.machine_readable/compliance/rust/deny.toml b/k9-svc/editors/vscode/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/editors/vscode/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/editors/vscode/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/editors/vscode/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/editors/vscode/.machine_readable/configs/README.adoc b/k9-svc/editors/vscode/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/editors/vscode/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/editors/vscode/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/editors/vscode/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index 5c39b484..00000000 --- a/k9-svc/editors/vscode/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# {{OWNER}} — GitHub organization or username -# {{REPO}} — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/editors/vscode/.machine_readable/contractiles/README.adoc b/k9-svc/editors/vscode/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/editors/vscode/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/editors/vscode/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/editors/vscode/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/editors/vscode/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/editors/vscode/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/editors/vscode/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/editors/vscode/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/editors/vscode/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/editors/vscode/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/editors/vscode/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 4d5db884..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 8003ca07..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project] -name = "vscode" -purpose = "" # TODO: describe project purpose -role = "" # TODO: describe project role # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/META.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index d9b09e68..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -type = "library" # TODO: update type (library|binary|service|website|monorepo) # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 1acf7a30..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index 6408e1c7..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/editors/vscode/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/editors/vscode/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index a76d8dd6..00000000 --- a/k9-svc/editors/vscode/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "rsr-template-repo" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "rsr-template-repo" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/editors/vscode/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/editors/vscode/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/editors/vscode/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index eeffd278..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/editors/vscode/.machine_readable/policies/README.adoc b/k9-svc/editors/vscode/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/editors/vscode/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/editors/vscode/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/editors/vscode/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/forge/README.adoc b/k9-svc/editors/vscode/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/editors/vscode/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/editors/vscode/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/editors/vscode/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/editors/vscode/.machine_readable/scripts/verification/README.adoc b/k9-svc/editors/vscode/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/editors/vscode/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/editors/vscode/.tool-versions b/k9-svc/editors/vscode/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/editors/vscode/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/editors/vscode/.well-known/ai.txt b/k9-svc/editors/vscode/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/editors/vscode/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/editors/vscode/.well-known/humans.txt b/k9-svc/editors/vscode/.well-known/humans.txt deleted file mode 100644 index 8891981a..00000000 --- a/k9-svc/editors/vscode/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: {{AUTHOR}} ({{OWNER}}) -Contact: {{AUTHOR_EMAIL}} -From: United Kingdom - -/* SITE */ -Last update: {{CURRENT_DATE}} -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/editors/vscode/.well-known/security.txt b/k9-svc/editors/vscode/.well-known/security.txt deleted file mode 100644 index 5414d508..00000000 --- a/k9-svc/editors/vscode/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:{{SECURITY_EMAIL}} -Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt -Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md -Hiring: https://{{WEBSITE}}/careers diff --git a/k9-svc/editors/vscode/0-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/0-AI-MANIFEST.a2ml deleted file mode 100644 index dc12c575..00000000 --- a/k9-svc/editors/vscode/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **[YOUR-REPO-NAME]**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "{{AUTHOR}} <{{AUTHOR_EMAIL}}>" -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -[YOUR-REPO-NAME]/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/editors/vscode/CHANGELOG.adoc b/k9-svc/editors/vscode/CHANGELOG.adoc deleted file mode 100644 index ca1c6528..00000000 --- a/k9-svc/editors/vscode/CHANGELOG.adoc +++ /dev/null @@ -1,9 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [Unreleased] diff --git a/k9-svc/editors/vscode/CONTRIBUTING.adoc b/k9-svc/editors/vscode/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/editors/vscode/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/editors/vscode/Containerfile b/k9-svc/editors/vscode/Containerfile deleted file mode 100644 index d7266bc0..00000000 --- a/k9-svc/editors/vscode/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Containerfile for {{PROJECT_NAME}} -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/editors/vscode/Justfile b/k9-svc/editors/vscode/Justfile deleted file mode 100644 index 9d7a5ff4..00000000 --- a/k9-svc/editors/vscode/Justfile +++ /dev/null @@ -1,910 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "{{PROJECT_NAME}}" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/editors/vscode/LICENSE b/k9-svc/editors/vscode/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/editors/vscode/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/editors/vscode/LICENSE-PMPL b/k9-svc/editors/vscode/LICENSE-PMPL deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/editors/vscode/LICENSE-PMPL +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/editors/vscode/README.adoc b/k9-svc/editors/vscode/README.adoc deleted file mode 100644 index b92a1fa2..00000000 --- a/k9-svc/editors/vscode/README.adoc +++ /dev/null @@ -1,45 +0,0 @@ -== K9-SVC for Visual Studio Code - -Syntax highlighting for -https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9] -(Self-Validating Components) — a security-tiered service configuration -language built on Nickel. - -=== Features - -* Syntax highlighting for `+.k9+` and `+.k9.ncl+` files -* Trust level keyword recognition (Kennel, Yard, Hunt) -* Pedigree field highlighting (`+name+`, `+version+`, `+description+`, -`+trust_level+`) -* Nickel contract annotation colouring (`+| Type+`) -* Recipe block identification -* SPDX license header recognition -* K9 magic number (`+K9!+`) detection - -=== File Associations - -[cols=",",options="header",] -|=== -|Extension |Language -|`+.k9+` |K9 -|`+.k9.ncl+` |K9 -|=== - -=== LSP Support - -For diagnostics, completions, and hover documentation, install the -https://github.com/hyperpolymath/standards/tree/main/k9-svc/lsp[K9 LSP -server] and configure the `+k9.lsp.path+` setting. - -=== Related - -* https://github.com/hyperpolymath/standards/tree/main/k9-svc/SPEC.adoc[K9 -Specification] -* https://github.com/hyperpolymath/standards/tree/main/k9-svc/pandoc[Pandoc -Reader/Writer] -* https://github.com/hyperpolymath/standards/tree/main/k9-svc/pedigree.ncl[Pedigree -Contract] - -=== License - -PMPL-1.0-or-later (Palimpsest License) diff --git a/k9-svc/editors/vscode/ROADMAP.adoc b/k9-svc/editors/vscode/ROADMAP.adoc deleted file mode 100644 index 8af55ca6..00000000 --- a/k9-svc/editors/vscode/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Vscode Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/editors/vscode/SECURITY.adoc b/k9-svc/editors/vscode/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/editors/vscode/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/editors/vscode/container/.gatekeeper.yaml b/k9-svc/editors/vscode/container/.gatekeeper.yaml deleted file mode 120000 index 87731df3..00000000 --- a/k9-svc/editors/vscode/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/k9-svc/editors/vscode/container/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/editors/vscode/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/editors/vscode/container/Containerfile b/k9-svc/editors/vscode/container/Containerfile deleted file mode 100644 index ba85260a..00000000 --- a/k9-svc/editors/vscode/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t {{SERVICE_NAME}}:latest -f container/Containerfile . -# -# Run: -# podman run -p {{PORT}}:{{PORT}} {{SERVICE_NAME}}:latest -# -# Run with persistent volume: -# podman run -p {{PORT}}:{{PORT}} -v {{SERVICE_NAME}}-data:/data {{SERVICE_NAME}}:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/{{SERVICE_NAME}} -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/{{SERVICE_NAME}}/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/{{SERVICE_NAME}} -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ - org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ - org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} -# COPY --from=builder /build/_build/prod/rel/{{SERVICE_NAME}} /app/release/ -# COPY --from=builder /build/zig-out/bin/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT={{PORT}} -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE {{PORT}} - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/editors/vscode/container/README.adoc b/k9-svc/editors/vscode/container/README.adoc deleted file mode 100644 index 9f7f7f05..00000000 --- a/k9-svc/editors/vscode/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -= {{PROJECT_NAME}} Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/editors/vscode/container/compose.example.toml b/k9-svc/editors/vscode/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/editors/vscode/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/editors/vscode/container/compose.toml b/k9-svc/editors/vscode/container/compose.toml deleted file mode 100644 index a14f8a00..00000000 --- a/k9-svc/editors/vscode/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f {{SERVICE_NAME}} # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.{{SERVICE_NAME}}] -image = "{{REGISTRY}}/{{SERVICE_NAME}}:latest.ctp" -ports = ["{{PORT}}:{{PORT}}"] -environment = { - APP_HOST = "[::]", - APP_PORT = "{{PORT}}", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["{{SERVICE_NAME}}-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:{{PORT}}/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://{{SERVICE_NAME}}:{{PORT}}", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["{{SERVICE_NAME}}"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.{{SERVICE_NAME}}-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/editors/vscode/container/ct-build.sh b/k9-svc/editors/vscode/container/ct-build.sh deleted file mode 100755 index a54a5418..00000000 --- a/k9-svc/editors/vscode/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: {{SERVICE_NAME}}-release) -# CT_REGISTRY — OCI registry to push to (default: {{REGISTRY}}) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-{{SERVICE_NAME}}-release}" -CT_REGISTRY="${CT_REGISTRY:-{{REGISTRY}}}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="{{SERVICE_NAME}}" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/editors/vscode/container/deploy.k9.ncl b/k9-svc/editors/vscode/container/deploy.k9.ncl deleted file mode 100644 index 0ad0d04a..00000000 --- a/k9-svc/editors/vscode/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "{{SERVICE_NAME}}-deploy", - version = "{{VERSION}}", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "{{REGISTRY}}/{{SERVICE_NAME}}", - port = {{PORT}}, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for {{SERVICE_NAME}}..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying {{SERVICE_NAME}} to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back {{SERVICE_NAME}} deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/editors/vscode/container/entrypoint.sh b/k9-svc/editors/vscode/container/entrypoint.sh deleted file mode 100755 index a7a03699..00000000 --- a/k9-svc/editors/vscode/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping {{SERVICE_NAME}}..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting {{SERVICE_NAME}}..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-{{PORT}}}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/{{SERVICE_NAME}} -# exec /app/release/bin/{{SERVICE_NAME}} start -# exec /app/{{SERVICE_NAME}} serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/editors/vscode/container/manifest.toml b/k9-svc/editors/vscode/container/manifest.toml deleted file mode 100644 index f55fcb3a..00000000 --- a/k9-svc/editors/vscode/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" -revision = 1 -summary = "{{PROJECT_DESCRIPTION}}" -description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" - -[provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "{{PORT}}" - -[outputs] -primary = "{{SERVICE_NAME}}" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [{{PORT}}] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/editors/vscode/container/vordr.toml b/k9-svc/editors/vscode/container/vordr.toml deleted file mode 100644 index af38fc54..00000000 --- a/k9-svc/editors/vscode/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:{{PORT}}/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:{{PORT}}/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/{{SERVICE_NAME}}.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "{{EMAIL}}" -# from = "vordr@{{SERVICE_NAME}}.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/editors/vscode/contractile.just b/k9-svc/editors/vscode/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/editors/vscode/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/editors/vscode/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/editors/vscode/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/editors/vscode/docs/QUICKSTART.adoc b/k9-svc/editors/vscode/docs/QUICKSTART.adoc deleted file mode 100644 index d97c31ec..00000000 --- a/k9-svc/editors/vscode/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/{{OWNER}}/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/editors/vscode/docs/README.adoc b/k9-svc/editors/vscode/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/editors/vscode/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/editors/vscode/docs/RSR_OUTLINE.adoc b/k9-svc/editors/vscode/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/editors/vscode/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/editors/vscode/docs/STATE-VISUALIZER.adoc b/k9-svc/editors/vscode/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/editors/vscode/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/editors/vscode/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/editors/vscode/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/editors/vscode/docs/architecture/THREAT-MODEL.adoc b/k9-svc/editors/vscode/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index df5e0380..00000000 --- a/k9-svc/editors/vscode/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: {{PROJECT_NAME}} - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | {{PROJECT_NAME}} | -| Version | 1.0 | -| Last Reviewed | {{DATE}} | -| Author | {{AUTHOR}} | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of {{PROJECT_NAME}} and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/editors/vscode/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/editors/vscode/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/editors/vscode/docs/attribution/CITATION.cff b/k9-svc/editors/vscode/docs/attribution/CITATION.cff deleted file mode 100644 index 4d562f43..00000000 --- a/k9-svc/editors/vscode/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "{{AUTHOR_LAST}}" - given-names: "{{AUTHOR_FIRST}}" - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "{{PROJECT_NAME}}" -version: 0.1.0 -date-released: {{CURRENT_DATE}} -url: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -repository-code: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/editors/vscode/docs/attribution/CITATIONS.adoc b/k9-svc/editors/vscode/docs/attribution/CITATIONS.adoc deleted file mode 100644 index eeee45fb..00000000 --- a/k9-svc/editors/vscode/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= {{PROJECT_NAME}} - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{{{PROJECT_NAME}}_{{CURRENT_YEAR}}, - author = {{{AUTHOR_LAST}}, {{AUTHOR_FIRST}}}, - title = {{{PROJECT_NAME}}}, - year = {{{CURRENT_YEAR}}}, - url = {https://github.com/{{OWNER}}/{{PROJECT_NAME}}}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}) _{{PROJECT_NAME}}_ [Computer software]. Available at: https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== OSCOLA - -{{AUTHOR}}, '{{PROJECT_NAME}}' ({{CURRENT_YEAR}}) - -== MLA - -{{AUTHOR_LAST}}, {{AUTHOR_FIRST}} "{{PROJECT_NAME}}." {{CURRENT_YEAR}}, github.com/{{OWNER}}/{{PROJECT_NAME}}. - -== APA 7 - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}). _{{PROJECT_NAME}}_ [Computer software]. GitHub. https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/editors/vscode/docs/attribution/CODEOWNERS.adoc b/k9-svc/editors/vscode/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/editors/vscode/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/editors/vscode/docs/attribution/MAINTAINERS.adoc b/k9-svc/editors/vscode/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index d829dd95..00000000 --- a/k9-svc/editors/vscode/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| {{AUTHOR}} -| Lead Maintainer -| https://github.com/{{OWNER}}[@{{OWNER}}] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/editors/vscode/docs/attribution/README.adoc b/k9-svc/editors/vscode/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/editors/vscode/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/editors/vscode/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/editors/vscode/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/editors/vscode/docs/decisions/0000-template.adoc b/k9-svc/editors/vscode/docs/decisions/0000-template.adoc deleted file mode 100644 index 763eab1e..00000000 --- a/k9-svc/editors/vscode/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/editors/vscode/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/editors/vscode/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 85f414be..00000000 --- a/k9-svc/editors/vscode/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/{{OWNER}}/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/editors/vscode/docs/decisions/README.adoc b/k9-svc/editors/vscode/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/editors/vscode/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/editors/vscode/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/editors/vscode/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/editors/vscode/docs/developer/ABI-FFI-README.adoc b/k9-svc/editors/vscode/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index 65d2afe1..00000000 --- a/k9-svc/editors/vscode/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -{{LICENSE}} - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/{{OWNER}}/rhodium-standard-repositories) diff --git a/k9-svc/editors/vscode/docs/developer/README.adoc b/k9-svc/editors/vscode/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/editors/vscode/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/editors/vscode/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/editors/vscode/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.adoc b/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/editors/vscode/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/editors/vscode/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/editors/vscode/docs/governance/README.adoc b/k9-svc/editors/vscode/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/editors/vscode/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/editors/vscode/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/editors/vscode/docs/governance/TSDM.a2ml b/k9-svc/editors/vscode/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/editors/vscode/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/editors/vscode/docs/governance/TSDM.adoc b/k9-svc/editors/vscode/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/editors/vscode/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/editors/vscode/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/editors/vscode/docs/governance/audit/README.adoc b/k9-svc/editors/vscode/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/editors/vscode/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/editors/vscode/docs/governance/audit/compliance/README.adoc b/k9-svc/editors/vscode/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/editors/vscode/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/editors/vscode/docs/governance/audit/effects/README.adoc b/k9-svc/editors/vscode/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/editors/vscode/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/editors/vscode/docs/governance/audit/systems/README.adoc b/k9-svc/editors/vscode/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/editors/vscode/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/README.adoc b/k9-svc/editors/vscode/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/corrective/README.adoc b/k9-svc/editors/vscode/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/editors/vscode/docs/governance/maintenance/perfective/README.adoc b/k9-svc/editors/vscode/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/editors/vscode/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/editors/vscode/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/editors/vscode/docs/governance/planning/README.adoc b/k9-svc/editors/vscode/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/editors/vscode/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/editors/vscode/docs/governance/planning/could/README.adoc b/k9-svc/editors/vscode/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/editors/vscode/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/editors/vscode/docs/governance/planning/must/README.adoc b/k9-svc/editors/vscode/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/editors/vscode/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/editors/vscode/docs/governance/planning/should/README.adoc b/k9-svc/editors/vscode/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/editors/vscode/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/editors/vscode/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/editors/vscode/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/editors/vscode/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/editors/vscode/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/editors/vscode/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/editors/vscode/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/editors/vscode/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/editors/vscode/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/editors/vscode/docs/practice/.gitkeep b/k9-svc/editors/vscode/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/editors/vscode/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/editors/vscode/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/editors/vscode/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index 3d9aa304..00000000 --- a/k9-svc/editors/vscode/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **{{AUTHOR}}** -- Email: **{{AUTHOR_EMAIL}}** -- Copyright: `Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/editors/vscode/docs/practice/README.adoc b/k9-svc/editors/vscode/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/editors/vscode/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/editors/vscode/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/editors/vscode/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index b355b468..00000000 --- a/k9-svc/editors/vscode/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> diff --git a/k9-svc/editors/vscode/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/editors/vscode/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/editors/vscode/docs/reports/README.adoc b/k9-svc/editors/vscode/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/editors/vscode/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/editors/vscode/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/editors/vscode/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/editors/vscode/docs/reports/compliance/README.adoc b/k9-svc/editors/vscode/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/editors/vscode/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/editors/vscode/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/editors/vscode/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/editors/vscode/docs/reports/maintenance/README.adoc b/k9-svc/editors/vscode/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/editors/vscode/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/editors/vscode/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/editors/vscode/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/editors/vscode/docs/reports/performance/README.adoc b/k9-svc/editors/vscode/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/editors/vscode/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/editors/vscode/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/editors/vscode/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/editors/vscode/docs/reports/quality/README.adoc b/k9-svc/editors/vscode/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/editors/vscode/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/editors/vscode/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/editors/vscode/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/editors/vscode/docs/reports/security/README.adoc b/k9-svc/editors/vscode/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/editors/vscode/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/editors/vscode/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/editors/vscode/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/editors/vscode/docs/standards/README.adoc b/k9-svc/editors/vscode/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/editors/vscode/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/editors/vscode/docs/templates/contractiles/README.adoc b/k9-svc/editors/vscode/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/editors/vscode/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/editors/vscode/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/editors/vscode/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/editors/vscode/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/editors/vscode/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/editors/vscode/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/editors/vscode/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/editors/vscode/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/editors/vscode/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/editors/vscode/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/editors/vscode/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/editors/vscode/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/editors/vscode/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/editors/vscode/docs/theory/.gitkeep b/k9-svc/editors/vscode/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/editors/vscode/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/editors/vscode/docs/theory/README.adoc b/k9-svc/editors/vscode/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/editors/vscode/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/editors/vscode/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/editors/vscode/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/editors/vscode/docs/theory/computing/README.adoc b/k9-svc/editors/vscode/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/editors/vscode/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/editors/vscode/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/editors/vscode/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/editors/vscode/docs/theory/formalisms/README.adoc b/k9-svc/editors/vscode/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/editors/vscode/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/editors/vscode/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/editors/vscode/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/editors/vscode/docs/theory/mathematics/README.adoc b/k9-svc/editors/vscode/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/editors/vscode/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/editors/vscode/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/editors/vscode/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/editors/vscode/docs/theory/ontologies/README.adoc b/k9-svc/editors/vscode/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/editors/vscode/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/editors/vscode/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/editors/vscode/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/editors/vscode/docs/theory/other/README.adoc b/k9-svc/editors/vscode/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/editors/vscode/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/editors/vscode/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/editors/vscode/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/editors/vscode/docs/theory/socio-technical/README.adoc b/k9-svc/editors/vscode/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/editors/vscode/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/editors/vscode/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/editors/vscode/docs/whitepapers/README.adoc b/k9-svc/editors/vscode/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/editors/vscode/docs/whitepapers/academic/.gitkeep b/k9-svc/editors/vscode/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/editors/vscode/docs/whitepapers/academic/README.adoc b/k9-svc/editors/vscode/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/editors/vscode/docs/whitepapers/industry/.gitkeep b/k9-svc/editors/vscode/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/editors/vscode/docs/whitepapers/industry/README.adoc b/k9-svc/editors/vscode/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/editors/vscode/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/editors/vscode/docs/whitepapers/outreach/README.adoc b/k9-svc/editors/vscode/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/editors/vscode/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/editors/vscode/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/editors/vscode/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/editors/vscode/docs/wikis/README.adoc b/k9-svc/editors/vscode/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/editors/vscode/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/editors/vscode/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/editors/vscode/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/editors/vscode/examples/README.adoc b/k9-svc/editors/vscode/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/editors/vscode/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/editors/vscode/examples/web-project-deno.json b/k9-svc/editors/vscode/examples/web-project-deno.json deleted file mode 100644 index 028e4f1a..00000000 --- a/k9-svc/editors/vscode/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/{{OWNER}}/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/editors/vscode/features/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/editors/vscode/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/editors/vscode/features/README.adoc b/k9-svc/editors/vscode/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/editors/vscode/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/editors/vscode/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/editors/vscode/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/editors/vscode/features/boj-server/README.adoc b/k9-svc/editors/vscode/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/editors/vscode/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/editors/vscode/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/editors/vscode/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/editors/vscode/features/panic-attacker/README.adoc b/k9-svc/editors/vscode/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/editors/vscode/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/editors/vscode/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/editors/vscode/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/editors/vscode/features/ssg/README.adoc b/k9-svc/editors/vscode/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/editors/vscode/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/editors/vscode/features/ssg/ssg-bootstrap.sh b/k9-svc/editors/vscode/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/editors/vscode/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/editors/vscode/icons/k9-icon.svg b/k9-svc/editors/vscode/icons/k9-icon.svg deleted file mode 100644 index 8bfde316..00000000 --- a/k9-svc/editors/vscode/icons/k9-icon.svg +++ /dev/null @@ -1,14 +0,0 @@ - - - - - - - - - - - K9 - - - diff --git a/k9-svc/editors/vscode/language-configuration-nickel.json b/k9-svc/editors/vscode/language-configuration-nickel.json deleted file mode 100644 index eef28781..00000000 --- a/k9-svc/editors/vscode/language-configuration-nickel.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "comments": { - "lineComment": "#", - "blockComment": ["/*", "*/"] - }, - "brackets": [ - ["{", "}"], - ["[", "]"], - ["(", ")"] - ], - "autoClosingPairs": [ - { "open": "{", "close": "}" }, - { "open": "[", "close": "]" }, - { "open": "(", "close": ")" }, - { "open": "\"", "close": "\"", "notIn": ["string"] }, - { "open": "'", "close": "'", "notIn": ["string"] }, - { "open": "m%\"", "close": "\"%", "notIn": ["string"] } - ], - "surroundingPairs": [ - { "open": "{", "close": "}" }, - { "open": "[", "close": "]" }, - { "open": "(", "close": ")" }, - { "open": "\"", "close": "\"" }, - { "open": "'", "close": "'" } - ], - "folding": { - "markers": { - "start": "\\{", - "end": "\\}" - } - }, - "wordPattern": "[\\w][\\w\\-]*" -} diff --git a/k9-svc/editors/vscode/language-configuration.json b/k9-svc/editors/vscode/language-configuration.json deleted file mode 100644 index 26b6507b..00000000 --- a/k9-svc/editors/vscode/language-configuration.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "comments": { - "lineComment": "#" - }, - "brackets": [ - ["{", "}"], - ["[", "]"], - ["(", ")"] - ], - "autoClosingPairs": [ - { "open": "{", "close": "}" }, - { "open": "[", "close": "]" }, - { "open": "(", "close": ")" }, - { "open": "\"", "close": "\"", "notIn": ["string"] }, - { "open": "'", "close": "'", "notIn": ["string"] } - ], - "surroundingPairs": [ - { "open": "{", "close": "}" }, - { "open": "[", "close": "]" }, - { "open": "(", "close": ")" }, - { "open": "\"", "close": "\"" }, - { "open": "'", "close": "'" } - ], - "wordPattern": "[\\w][\\w\\-]*" -} diff --git a/k9-svc/editors/vscode/package.json b/k9-svc/editors/vscode/package.json deleted file mode 100644 index b028a917..00000000 --- a/k9-svc/editors/vscode/package.json +++ /dev/null @@ -1,46 +0,0 @@ -{ - "name": "k9-svc", - "displayName": "K9-SVC", - "description": "Syntax highlighting for K9 — a security-tiered service configuration language built on Nickel.", - "version": "0.1.0", - "license": "SEE LICENSE IN LICENSE", - "publisher": "hyperpolymath", - "author": { - "name": "Jonathan D.A. Jewell", - "email": "j.d.a.jewell@open.ac.uk" - }, - "repository": { - "type": "git", - "url": "https://github.com/hyperpolymath/standards.git", - "directory": "k9-svc/editors/vscode" - }, - "engines": { - "vscode": "^1.75.0" - }, - "categories": [ - "Programming Languages" - ], - "contributes": { - "languages": [ - { - "id": "k9", - "aliases": [ - "K9", - "K9-SVC" - ], - "extensions": [ - ".k9", - ".k9.ncl" - ], - "configuration": "./language-configuration.json" - } - ], - "grammars": [ - { - "language": "k9", - "scopeName": "source.k9", - "path": "../k9.tmLanguage.json" - } - ] - } -} diff --git a/k9-svc/editors/vscode/snippets/k9-nickel.json b/k9-svc/editors/vscode/snippets/k9-nickel.json deleted file mode 100644 index 281a1c18..00000000 --- a/k9-svc/editors/vscode/snippets/k9-nickel.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "K9 Nickel Validator": { - "prefix": "k9ncl", - "body": [ - "# SPDX-License-Identifier: ${1:PMPL-1.0-or-later}", - "# K9 Nickel Validator: ${2:name}", - "", - "let config = import \"${3:config.ncl}\" in", - "", - "let validator : ${4:Contract} = {", - " name = \"${2}\",", - " security_level = \"${5|kennel,yard,hunt|}\",", - " $0", - "} in", - "", - "validator" - ], - "description": "Insert a K9 Nickel validator template" - }, - "K9 Nickel Let Binding": { - "prefix": "let", - "body": [ - "let ${1:name} : ${2:Type} = ${3:value} in" - ], - "description": "Insert a let binding with contract" - }, - "K9 Nickel Record": { - "prefix": "rec", - "body": [ - "{", - " ${1:key} = ${2:value},", - " $0", - "}" - ], - "description": "Insert a record literal" - }, - "K9 Nickel Contract": { - "prefix": "contract", - "body": [ - "let ${1:ContractName} = fun label value =>", - " if ${2:condition value}", - " then value", - " else Contract.blame label", - "in" - ], - "description": "Insert a custom Nickel contract" - }, - "K9 Nickel Import": { - "prefix": "import", - "body": [ - "let ${1:module} = import \"${2:path}.ncl\" in" - ], - "description": "Insert an import statement" - }, - "K9 Nickel Recipe": { - "prefix": "recipe", - "body": [ - "let recipe = {", - " name | Str = \"${1:recipe-name}\",", - " inputs | Array Str = [${2}],", - " outputs | Array Str = [${3}],", - " run | Str -> Str = fun input =>", - " ${4:transform input},", - "} in" - ], - "description": "Insert a K9 Nickel recipe block" - } -} diff --git a/k9-svc/editors/vscode/snippets/k9.json b/k9-svc/editors/vscode/snippets/k9.json deleted file mode 100644 index 68a658b5..00000000 --- a/k9-svc/editors/vscode/snippets/k9.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "K9 Magic Header": { - "prefix": "k9", - "body": [ - "K9!", - "# SPDX-License-Identifier: ${1:PMPL-1.0-or-later}", - "", - "name: ${2:validator-name}", - "version: ${3:0.1.0}", - "description: ${4:description}", - "security_level: ${5|kennel,yard,hunt|}", - "" - ], - "description": "Insert K9 file header with magic number and pedigree fields" - }, - "K9 Validator": { - "prefix": "validator", - "body": [ - "validators:", - " - name: ${1:validator-name}", - " description: ${2:what this validates}", - " trust_level: ${3|kennel,yard,hunt|}", - " checks:", - " - ${4:check-name}", - "" - ], - "description": "Insert a validator block" - }, - "K9 Recipe": { - "prefix": "recipe", - "body": [ - "recipes:", - " - name: ${1:recipe-name}", - " inputs:", - " - ${2:input}", - " outputs:", - " - ${3:output}", - " constraints:", - " - ${4:constraint}", - "" - ], - "description": "Insert a recipe block" - }, - "K9 Dependency": { - "prefix": "dep", - "body": [ - "dependencies:", - " - name: ${1:dependency-name}", - " version: ${2:>=0.1.0}", - " trust_level: ${3|kennel,yard,hunt|}", - "" - ], - "description": "Insert a dependency entry" - }, - "K9 Kennel Trust": { - "prefix": "kennel", - "body": [ - "trust_level: kennel", - "# Kennel: fully trusted, internal validator" - ], - "description": "Set trust level to kennel (highest)" - }, - "K9 Yard Trust": { - "prefix": "yard", - "body": [ - "trust_level: yard", - "# Yard: semi-trusted, verified external validator" - ], - "description": "Set trust level to yard (medium)" - }, - "K9 Hunt Trust": { - "prefix": "hunt", - "body": [ - "trust_level: hunt", - "# Hunt: untrusted, requires full verification" - ], - "description": "Set trust level to hunt (lowest)" - } -} diff --git a/k9-svc/editors/vscode/src/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index c92e124d..00000000 --- a/k9-svc/editors/vscode/src/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary source code directory. Organized by role and architectural - aspect. - -canonical_locations: - core: "core/" - interface: "interface/" - bridges: "bridges/" - contracts: "contracts/" - errors: "errors/" - definitions: "definitions/" - aspects: "aspects/" - -invariants: - - "Core logic MUST reside in core/" - - "Verified seams MUST reside in interface/" - - "Safety constraints MUST reside in contracts/" - - "Failure dictionaries MUST reside in errors/" diff --git a/k9-svc/editors/vscode/src/README.adoc b/k9-svc/editors/vscode/src/README.adoc deleted file mode 100644 index 5529f66f..00000000 --- a/k9-svc/editors/vscode/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= src Pillar diff --git a/k9-svc/editors/vscode/src/aspects/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/aspects/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d5b209e..00000000 --- a/k9-svc/editors/vscode/src/aspects/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-aspects" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Cross-cutting concerns and domain-specific aspects (Security, - Observability, Integrity). - -canonical_locations: - security: "security/" - observability: "observability/" - integrity: "integrity/" diff --git a/k9-svc/editors/vscode/src/aspects/README.adoc b/k9-svc/editors/vscode/src/aspects/README.adoc deleted file mode 100644 index 6456f962..00000000 --- a/k9-svc/editors/vscode/src/aspects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Aspects Pillar diff --git a/k9-svc/editors/vscode/src/aspects/integrity/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/aspects/integrity/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f114cbd2..00000000 --- a/k9-svc/editors/vscode/src/aspects/integrity/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-integrity" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the integrity aspect. diff --git a/k9-svc/editors/vscode/src/aspects/integrity/README.adoc b/k9-svc/editors/vscode/src/aspects/integrity/README.adoc deleted file mode 100644 index f15d829d..00000000 --- a/k9-svc/editors/vscode/src/aspects/integrity/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Integrity Aspect diff --git a/k9-svc/editors/vscode/src/aspects/observability/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/aspects/observability/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index e16cbdf9..00000000 --- a/k9-svc/editors/vscode/src/aspects/observability/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-observability" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the observability aspect. diff --git a/k9-svc/editors/vscode/src/aspects/observability/README.adoc b/k9-svc/editors/vscode/src/aspects/observability/README.adoc deleted file mode 100644 index 7852ee64..00000000 --- a/k9-svc/editors/vscode/src/aspects/observability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Observability Aspect diff --git a/k9-svc/editors/vscode/src/aspects/security/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/aspects/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 09965363..00000000 --- a/k9-svc/editors/vscode/src/aspects/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the security aspect. diff --git a/k9-svc/editors/vscode/src/aspects/security/README.adoc b/k9-svc/editors/vscode/src/aspects/security/README.adoc deleted file mode 100644 index 3c3536ec..00000000 --- a/k9-svc/editors/vscode/src/aspects/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Aspect diff --git a/k9-svc/editors/vscode/src/bridges/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/bridges/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d3e27a0..00000000 --- a/k9-svc/editors/vscode/src/bridges/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-bridges" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Integration logic for external systems (API, Database, RPC, etc.). diff --git a/k9-svc/editors/vscode/src/contracts/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/contracts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0bd9198f..00000000 --- a/k9-svc/editors/vscode/src/contracts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-contracts" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Contracts unit for high-rigor source code. diff --git a/k9-svc/editors/vscode/src/contracts/README.adoc b/k9-svc/editors/vscode/src/contracts/README.adoc deleted file mode 100644 index 9cfa2098..00000000 --- a/k9-svc/editors/vscode/src/contracts/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Contracts Unit diff --git a/k9-svc/editors/vscode/src/core/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/core/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 22846c78..00000000 --- a/k9-svc/editors/vscode/src/core/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-core" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary application logic and core domain models. diff --git a/k9-svc/editors/vscode/src/definitions/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/definitions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e54f4dab..00000000 --- a/k9-svc/editors/vscode/src/definitions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-definitions" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Definitions unit for high-rigor source code. diff --git a/k9-svc/editors/vscode/src/definitions/README.adoc b/k9-svc/editors/vscode/src/definitions/README.adoc deleted file mode 100644 index 95483497..00000000 --- a/k9-svc/editors/vscode/src/definitions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Definitions Unit diff --git a/k9-svc/editors/vscode/src/errors/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/errors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index dddcc6c4..00000000 --- a/k9-svc/editors/vscode/src/errors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-errors" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Errors unit for high-rigor source code. diff --git a/k9-svc/editors/vscode/src/errors/README.adoc b/k9-svc/editors/vscode/src/errors/README.adoc deleted file mode 100644 index 460fc1e9..00000000 --- a/k9-svc/editors/vscode/src/errors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Errors Unit diff --git a/k9-svc/editors/vscode/src/interface/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 7f0f471b..00000000 --- a/k9-svc/editors/vscode/src/interface/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "interface-seams-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Consolidated "Verified Interface Seams" unit. This directory unifies the - formal specification (ABI), the bridge implementation (FFI), and the - resulting artifacts (Generated). - -canonical_locations: - abi: "abi/" - ffi: "ffi/" - generated: "generated/" - -invariants: - - "ABI MUST be Idris2 (.idr)" - - "FFI MUST be Zig (.zig)" - - "Generated artifacts MUST be C-compatible" - - "The 'Truth' lives in abi/; the 'Implementation' lives in ffi/" diff --git a/k9-svc/editors/vscode/src/interface/README.adoc b/k9-svc/editors/vscode/src/interface/README.adoc deleted file mode 100644 index 8faf0aad..00000000 --- a/k9-svc/editors/vscode/src/interface/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= interface Unit diff --git a/k9-svc/editors/vscode/src/interface/abi/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/abi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 91cafa01..00000000 --- a/k9-svc/editors/vscode/src/interface/abi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for abi. diff --git a/k9-svc/editors/vscode/src/interface/abi/README.adoc b/k9-svc/editors/vscode/src/interface/abi/README.adoc deleted file mode 100644 index 2330304d..00000000 --- a/k9-svc/editors/vscode/src/interface/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= abi Logic diff --git a/k9-svc/editors/vscode/src/interface/ffi/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/ffi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index bf456ae2..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ffi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for ffi. diff --git a/k9-svc/editors/vscode/src/interface/ffi/README.adoc b/k9-svc/editors/vscode/src/interface/ffi/README.adoc deleted file mode 100644 index 8fe57d34..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= ffi Logic diff --git a/k9-svc/editors/vscode/src/interface/ffi/build.zig b/k9-svc/editors/vscode/src/interface/ffi/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/k9-svc/editors/vscode/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 5b5f1b1e..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "src-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Src logic at level 4. diff --git a/k9-svc/editors/vscode/src/interface/ffi/src/README.adoc b/k9-svc/editors/vscode/src/interface/ffi/src/README.adoc deleted file mode 100644 index a5c0c6d5..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Src Logic diff --git a/k9-svc/editors/vscode/src/interface/ffi/src/main.zig b/k9-svc/editors/vscode/src/interface/ffi/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/k9-svc/editors/vscode/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index e02427f8..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "test-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Test logic at level 4. diff --git a/k9-svc/editors/vscode/src/interface/ffi/test/README.adoc b/k9-svc/editors/vscode/src/interface/ffi/test/README.adoc deleted file mode 100644 index f6f38bf6..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/test/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Test Logic diff --git a/k9-svc/editors/vscode/src/interface/ffi/test/integration_test.zig b/k9-svc/editors/vscode/src/interface/ffi/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/k9-svc/editors/vscode/src/interface/ffi/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/k9-svc/editors/vscode/src/interface/generated/0.3-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/generated/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0088b80c..00000000 --- a/k9-svc/editors/vscode/src/interface/generated/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "generated-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for generated. diff --git a/k9-svc/editors/vscode/src/interface/generated/README.adoc b/k9-svc/editors/vscode/src/interface/generated/README.adoc deleted file mode 100644 index 3691b062..00000000 --- a/k9-svc/editors/vscode/src/interface/generated/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= generated Logic diff --git a/k9-svc/editors/vscode/src/interface/generated/abi/.gitkeep b/k9-svc/editors/vscode/src/interface/generated/abi/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/editors/vscode/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 4eeb5808..00000000 --- a/k9-svc/editors/vscode/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Abi logic at level 4. diff --git a/k9-svc/editors/vscode/src/interface/generated/abi/README.adoc b/k9-svc/editors/vscode/src/interface/generated/abi/README.adoc deleted file mode 100644 index aff61a99..00000000 --- a/k9-svc/editors/vscode/src/interface/generated/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Abi Logic diff --git a/k9-svc/editors/vscode/syntaxes/k9-nickel.tmLanguage.json b/k9-svc/editors/vscode/syntaxes/k9-nickel.tmLanguage.json deleted file mode 100644 index a66e9699..00000000 --- a/k9-svc/editors/vscode/syntaxes/k9-nickel.tmLanguage.json +++ /dev/null @@ -1,182 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/martinring/tmlanguage/master/tmlanguage.json", - "name": "K9 Nickel", - "scopeName": "source.k9.ncl", - "fileTypes": ["k9.ncl"], - "patterns": [ - { "include": "#comment-line" }, - { "include": "#comment-block" }, - { "include": "#import" }, - { "include": "#let-binding" }, - { "include": "#contract-annotation" }, - { "include": "#security-level" }, - { "include": "#trust-level" }, - { "include": "#keywords" }, - { "include": "#builtin-types" }, - { "include": "#recipe-block" }, - { "include": "#record-literal" }, - { "include": "#string-multiline" }, - { "include": "#string-double" }, - { "include": "#boolean" }, - { "include": "#number" }, - { "include": "#operator" }, - { "include": "#identifier" } - ], - "repository": { - "comment-line": { - "name": "comment.line.number-sign.k9ncl", - "match": "#.*$" - }, - "comment-block": { - "name": "comment.block.k9ncl", - "begin": "/\\*", - "end": "\\*/" - }, - "import": { - "name": "meta.import.k9ncl", - "match": "(import)\\s+(\"[^\"]+\")", - "captures": { - "1": { "name": "keyword.control.import.k9ncl" }, - "2": { "name": "string.quoted.double.import-path.k9ncl" } - } - }, - "let-binding": { - "name": "meta.let-binding.k9ncl", - "match": "\\b(let)\\s+([\\w][\\w\\-_']*)\\s*((?::[^=]+)?)(=)", - "captures": { - "1": { "name": "keyword.other.let.k9ncl" }, - "2": { "name": "variable.other.binding.k9ncl" }, - "3": { - "patterns": [ - { "include": "#contract-annotation" }, - { "include": "#builtin-types" } - ] - }, - "4": { "name": "keyword.operator.assignment.k9ncl" } - } - }, - "contract-annotation": { - "name": "meta.contract.k9ncl", - "match": "(:|\\|)\\s*([A-Z][\\w]*)", - "captures": { - "1": { "name": "punctuation.separator.contract.k9ncl" }, - "2": { "name": "entity.name.type.contract.k9ncl" } - } - }, - "security-level": { - "name": "constant.language.security-level.k9ncl", - "match": "\\b(critical|high|medium|low|informational)\\b" - }, - "trust-level": { - "patterns": [ - { - "name": "entity.name.type.trust-level.kennel.k9ncl", - "match": "\\b(kennel)\\b" - }, - { - "name": "entity.name.type.trust-level.yard.k9ncl", - "match": "\\b(yard)\\b" - }, - { - "name": "entity.name.type.trust-level.hunt.k9ncl", - "match": "\\b(hunt)\\b" - } - ] - }, - "keywords": { - "name": "keyword.control.k9ncl", - "match": "\\b(let|in|if|then|else|fun|match|merge|default|forall|rec|switch|null)\\b" - }, - "builtin-types": { - "name": "support.type.builtin.k9ncl", - "match": "\\b(Str|Num|Bool|Dyn|Array|Record|Enum|Contract|Label|Number|String)\\b" - }, - "recipe-block": { - "name": "meta.recipe.k9ncl", - "match": "\\b(recipe|validator|check|constraint|assertion)\\b", - "captures": { - "1": { "name": "keyword.other.recipe.k9ncl" } - } - }, - "record-literal": { - "name": "meta.record.k9ncl", - "begin": "\\{", - "end": "\\}", - "beginCaptures": { - "0": { "name": "punctuation.definition.record.begin.k9ncl" } - }, - "endCaptures": { - "0": { "name": "punctuation.definition.record.end.k9ncl" } - }, - "patterns": [ - { "include": "$self" } - ] - }, - "string-multiline": { - "name": "string.quoted.multiline.k9ncl", - "begin": "m%\"", - "end": "\"%", - "patterns": [ - { - "name": "constant.character.escape.k9ncl", - "match": "\\\\." - }, - { - "name": "meta.interpolation.k9ncl", - "begin": "%\\{", - "end": "\\}", - "beginCaptures": { - "0": { "name": "punctuation.definition.interpolation.begin.k9ncl" } - }, - "endCaptures": { - "0": { "name": "punctuation.definition.interpolation.end.k9ncl" } - }, - "patterns": [ - { "include": "$self" } - ] - } - ] - }, - "string-double": { - "name": "string.quoted.double.k9ncl", - "begin": "\"", - "end": "\"", - "patterns": [ - { - "name": "constant.character.escape.k9ncl", - "match": "\\\\." - }, - { - "name": "meta.interpolation.k9ncl", - "begin": "%\\{", - "end": "\\}", - "beginCaptures": { - "0": { "name": "punctuation.definition.interpolation.begin.k9ncl" } - }, - "endCaptures": { - "0": { "name": "punctuation.definition.interpolation.end.k9ncl" } - }, - "patterns": [ - { "include": "$self" } - ] - } - ] - }, - "boolean": { - "name": "constant.language.boolean.k9ncl", - "match": "\\b(true|false)\\b" - }, - "number": { - "name": "constant.numeric.k9ncl", - "match": "\\b\\d+(\\.\\d+)?\\b" - }, - "operator": { - "name": "keyword.operator.k9ncl", - "match": "(=>|->|\\|>|==|!=|>=|<=|&&|\\|\\||\\+\\+|@)" - }, - "identifier": { - "name": "variable.other.k9ncl", - "match": "\\b[a-z_][\\w\\-_']*\\b" - } - } -} diff --git a/k9-svc/editors/vscode/syntaxes/k9.tmLanguage.json b/k9-svc/editors/vscode/syntaxes/k9.tmLanguage.json deleted file mode 100644 index 96668b72..00000000 --- a/k9-svc/editors/vscode/syntaxes/k9.tmLanguage.json +++ /dev/null @@ -1,104 +0,0 @@ -{ - "$schema": "https://raw.githubusercontent.com/martinring/tmlanguage/master/tmlanguage.json", - "name": "K9", - "scopeName": "source.k9", - "fileTypes": ["k9"], - "patterns": [ - { "include": "#comment" }, - { "include": "#magic-number" }, - { "include": "#trust-level" }, - { "include": "#pedigree-fields" }, - { "include": "#security-level" }, - { "include": "#key-value" }, - { "include": "#string-double" }, - { "include": "#string-single" }, - { "include": "#boolean" }, - { "include": "#number" } - ], - "repository": { - "comment": { - "name": "comment.line.number-sign.k9", - "match": "#.*$" - }, - "magic-number": { - "name": "keyword.control.magic.k9", - "match": "^K9!.*$" - }, - "trust-level": { - "patterns": [ - { - "name": "entity.name.type.trust-level.kennel.k9", - "match": "\\b(kennel)\\b" - }, - { - "name": "entity.name.type.trust-level.yard.k9", - "match": "\\b(yard)\\b" - }, - { - "name": "entity.name.type.trust-level.hunt.k9", - "match": "\\b(hunt)\\b" - } - ] - }, - "pedigree-fields": { - "name": "keyword.other.pedigree.k9", - "match": "\\b(name|version|description|security_level|trust_level|breed|pedigree|lineage|handler|kennel_name|kennel_version|dependencies|validators|recipes|constraints|checks|assertions|inputs|outputs|metadata|tags)\\b(?=\\s*:)" - }, - "security-level": { - "name": "constant.language.security-level.k9", - "match": "\\b(critical|high|medium|low|informational)\\b" - }, - "key-value": { - "name": "meta.key-value.k9", - "match": "^(\\s*[\\w][\\w\\-_.]*)(:)\\s*(.*)", - "captures": { - "1": { "name": "entity.name.tag.key.k9" }, - "2": { "name": "punctuation.separator.key-value.k9" }, - "3": { - "patterns": [ - { "include": "#trust-level" }, - { "include": "#security-level" }, - { "include": "#string-double" }, - { "include": "#string-single" }, - { "include": "#boolean" }, - { "include": "#number" }, - { - "name": "string.unquoted.value.k9", - "match": ".+" - } - ] - } - } - }, - "string-double": { - "name": "string.quoted.double.k9", - "begin": "\"", - "end": "\"", - "patterns": [ - { - "name": "constant.character.escape.k9", - "match": "\\\\." - } - ] - }, - "string-single": { - "name": "string.quoted.single.k9", - "begin": "'", - "end": "'", - "patterns": [ - { - "name": "constant.character.escape.k9", - "match": "\\\\." - } - ] - }, - "boolean": { - "name": "constant.language.boolean.k9", - "match": "\\b(true|false|yes|no)\\b" - }, - "number": { - "name": "constant.numeric.k9", - "match": "\\b\\d+(\\.\\d+)?\\b" - } - } -} diff --git a/k9-svc/editors/vscode/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/editors/vscode/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/editors/vscode/verification/README.adoc b/k9-svc/editors/vscode/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/editors/vscode/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/editors/vscode/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/editors/vscode/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/editors/vscode/verification/benchmarks/README.adoc b/k9-svc/editors/vscode/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/editors/vscode/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/editors/vscode/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/editors/vscode/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/editors/vscode/verification/coverage/README.adoc b/k9-svc/editors/vscode/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/editors/vscode/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/editors/vscode/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/editors/vscode/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/editors/vscode/verification/fuzzing/README.adoc b/k9-svc/editors/vscode/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/editors/vscode/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/editors/vscode/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/editors/vscode/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/editors/vscode/verification/proofs/README.adoc b/k9-svc/editors/vscode/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/editors/vscode/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/editors/vscode/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/editors/vscode/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/editors/vscode/verification/safety_case/README.adoc b/k9-svc/editors/vscode/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/editors/vscode/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/editors/vscode/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/editors/vscode/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/editors/vscode/verification/simulations/README.adoc b/k9-svc/editors/vscode/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/editors/vscode/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/editors/vscode/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/editors/vscode/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/editors/vscode/verification/tests/README.adoc b/k9-svc/editors/vscode/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/editors/vscode/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/editors/vscode/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/editors/vscode/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/editors/vscode/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/editors/vscode/verification/traceability/README.adoc b/k9-svc/editors/vscode/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/editors/vscode/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/examples/NOT-a-good-fit.adoc b/k9-svc/examples/NOT-a-good-fit.adoc deleted file mode 100644 index 25b77a9c..00000000 --- a/k9-svc/examples/NOT-a-good-fit.adoc +++ /dev/null @@ -1,340 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// NOT-a-good-fit.adoc - Honest comparison, deprecation analysis, and anti-patterns -// -// Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -// -// This is the definitive guide for understanding where k9-svc and a2ml -// outperform alternatives, where they do NOT, and what should or should -// not be deprecated. Honesty over advocacy. -= k9-svc and a2ml: Comparison, Deprecation Analysis, and Anti-Patterns -:toc: left -:toclevels: 3 -:icons: font -:source-highlighter: rouge -:sectnums: - -== Purpose - -This document answers three questions: - -1. **Where does k9-svc or a2ml genuinely outperform alternatives?** Deprecate those alternatives. -2. **Where are alternatives equal or superior?** Keep them. Do not force k9-svc where it adds nothing. -3. **What are the anti-patterns?** Things people will try that they should not. - -The goal is intellectual honesty. k9-svc is good at specific things. It is not a universal replacement for everything. - -== Section 1: k9-svc vs. Alternatives -- Where k9-svc Wins - -These are use cases where k9-svc provides genuine, measurable improvement over the next-best alternative. For each, we recommend deprecating the alternative. - -[cols="1,2,2,2,1"] -|=== -| Use Case | k9-svc Approach | Next-Best Alternative | Why k9-svc Wins | Deprecate? - -| **Container deployment orchestration** -| Hunt-level `.k9.ncl` with pedigree, signed recipes, selur-compose generation -| `docker-compose.yml` + Makefile targets -| Nickel contracts catch invalid configs at eval time (before any container starts). Security levels prevent accidental execution of destructive recipes. Pedigree provides machine-readable provenance. Makefile deploy targets have no type safety, no security model, and no self-validation. -| **YES** -- deprecate raw Makefile deploy targets - -| **Configuration validation for deployments** -| Yard-level `.k9.ncl` with Nickel type contracts -| JSON Schema + ajv validator -| Nickel contracts are more expressive than JSON Schema: they support computed defaults, dependent constraints (`if x then y must be > z`), and first-class functions. JSON Schema can validate shapes but cannot express business logic. k9-svc Yard-level evaluation catches errors that JSON Schema cannot. -| **YES** -- deprecate standalone JSON Schema for deployment configs - -| **Signed release artifacts** -| `.k9` component + cerro-torre `.ctp` signature bundles -| Manual `SHA256SUMS` file + detached GPG signature -| k9-svc integrates supply chain verification into the component itself. The pedigree carries the checksum, the Leash system enforces signature verification before execution, and cerro-torre bundles are machine-verifiable without manual steps. Manual hash files require humans to remember to check them. -| **YES** -- deprecate manual SHA256SUMS files for operational artifacts - -| **CI/CD pipeline component wrapping** -| `.k9` components at appropriate security level (Kennel for config, Yard for validation, Hunt for execution) -| Raw YAML workflow files (GitHub Actions, GitLab CI) -| k9-svc components are self-documenting (pedigree), security-level-aware (Leash), and composable (Nickel imports). A `.k9.ncl` component that wraps a deployment step is type-checked, signed, and auditable. Raw YAML is stringly-typed and has no security model. -| **PARTIAL** -- k9 wraps but does not replace GitHub Actions YAML. You still need the YAML; k9 makes the steps within it safer. - -| **Multi-environment deployment config** -| Nickel records with environment-specific overrides and contracts -| Helm `values.yaml` / Kustomize overlays -| Nickel is a real programming language with types, functions, and contracts. Helm uses Go templates (stringly-typed, error-prone). Kustomize uses YAML patches (limited expressiveness). For non-Kubernetes deployments, Helm and Kustomize are irrelevant. k9-svc works with any container runtime. -| **DEPENDS** -- see note below - -| **Component self-validation (dogfooding)** -| Built-in: every `.k9` component can validate itself via `just validate` -| External linters, CI-only validation -| k9-svc components carry their own validation contracts. They do not depend on external tooling being configured correctly. The dogfooding principle means the repo itself uses `.k9` to manage itself. -| **YES** -- deprecate external-only config validation for deployment components -|=== - -[NOTE] -==== -**On Helm/Kustomize:** If your deployment target is Kubernetes, Helm and Kustomize have deep ecosystem integration (chart repositories, operator patterns, Argo CD integration) that k9-svc cannot match today. k9-svc is superior for Podman-first, non-K8s, and multi-runtime deployments. For pure K8s shops, keep Helm/Kustomize and consider k9-svc for the _validation layer_ around your Helm values. -==== - -== Section 2: Where k9-svc Does NOT Fit -- Keep the Alternative - -These are anti-patterns. People will try these because k9-svc looks powerful, but forcing it into these use cases adds overhead with zero benefit. - -[cols="1,2,2,2,1"] -|=== -| Anti-Pattern | Why People Try It | Why It Fails | What To Use Instead | Can k9-svc Ever Outperform? - -| **Wrapping simple config files** -| "Everything should be `.k9`" -| Security levels are irrelevant for pure data. A `config.toml` is already Kennel-level by nature -- it has no execution capability. Wrapping it in a `.k9` pedigree adds metadata overhead and import complexity for zero security benefit. The Leash system has nothing to enforce. -| Plain TOML, Nickel (without k9 pedigree), or JSON -| **NO** -- pure data does not benefit from security levels or pedigree. The overhead is permanent and the benefit is zero. - -| **Wrapping library code** -| "My Rust crate / Gleam package should be a k9 component" -| Libraries do not deploy themselves. k9-svc is for *operational components* -- things that run, deploy, validate, or configure. A library is consumed by a build system, not by a deployment pipeline. Pedigree fields like `target.os`, `security.allow_network`, and `recipes.deploy` are meaningless for a library. -| `Cargo.toml`, `mix.exs`, `gleam.toml`, `deno.json` -- the native package manifest for that ecosystem -| **NO** -- libraries are a fundamentally different abstraction. They are build-time dependencies, not runtime deployment units. - -| **Wrapping documentation** -| "Our `.adoc` files should have pedigree and security levels" -| Documentation is Kennel-level by definition -- it is pure data with no execution. Adding a k9 pedigree to a documentation file tells you what you already know (it is safe to read) and nothing you do not know. The pedigree fields are almost entirely irrelevant. -| Plain `.adoc` or `.md` files -| **NO** -- documentation needs readability and discoverability, not typed deployment contracts. - -| **Wrapping individual source files** -| "Each `.rs` or `.res` file should be a self-validating component" -| k9-svc is for *self-contained deployable units*, not build artifacts. A single source file is meaningless without its build context. The `recipes` fields make no sense for something that is compiled as part of a larger project. -| The build system (`cargo`, `mix`, `just`, `deno`) -| **NO** -- source files are not deployment units. The granularity is wrong. - -| **Replacing README with k9 pedigree** -| "The pedigree metadata has name, version, description -- that is a README" -| The pedigree is machine-readable metadata for the k9 runtime. The README is human-readable documentation for developers. They serve entirely different audiences. A pedigree cannot contain installation guides, architecture diagrams, or usage examples in a human-friendly way. -| `README.adoc` for humans, k9 pedigree for machines -| **NO** -- different audiences require different formats. This will never change. - -| **Using Hunt level for read-only operations** -| "I want the full triad for my config viewer" -| Hunt level requires cryptographic signatures, key management, and careful security review. If your component only reads and displays data, it should be Kennel or Yard. Using Hunt for read-only operations is like requiring a passport to read a menu. It creates friction with no security benefit. -| Kennel (pure data) or Yard (if Nickel evaluation is needed) -| **NO** -- the Leash system is designed for graduated trust. Overriding it defeats the purpose. - -| **Wrapping third-party tools** -| "Nickel itself should be a k9 component" -| k9-svc describes _your_ components that _you_ deploy. Third-party tools have their own installation, versioning, and update mechanisms. Wrapping them in k9 pedigree creates a maintenance burden (you must update the wrapper every time the tool updates) with no benefit (you cannot validate their internals). -| System package managers (`apk`, `rpm-ostree`), `asdf`, or Guix/Nix -| **NO** -- package management is a solved problem. k9-svc is not a package manager. -|=== - -== Section 3: a2ml vs. Alternatives -- Where a2ml Wins - -`0-AI-MANIFEST.a2ml` is the universal AI agent entry point. It tells agents what a directory or repository contains and how to interact with it. - -[cols="1,2,2,2,1"] -|=== -| Use Case | a2ml Approach | Next-Best Alternative | Why a2ml Wins | Deprecate? - -| **Multi-service orchestration discovery** -| `0-AI-MANIFEST.a2ml` in `test-infra/` or repo root describing available services, ports, and commands -| `README.md` + inline comments in `compose.yml` -| a2ml is structured and machine-parseable. An agent can read it and know exactly what services are available, how to start them, and what health checks exist, without parsing natural language from a README or YAML comments. -| **NO** -- a2ml _complements_ README, it does not replace it. Humans need README. Agents need a2ml. Ship both. - -| **Complex config directory mapping** -| a2ml describing file relationships, load order, and override semantics -| `README.md` listing files with descriptions -| Machine-actionable: agents can auto-discover which config file controls what, without parsing prose. The structured format means agents from any vendor (Claude, Gemini, GPT) can consume it identically. -| **NO** -- keep the README for humans. Add a2ml for agents. - -| **Repo entry point for AI agents** -| `0-AI-MANIFEST.a2ml` at repository root with lifecycle hooks (on-enter, on-exit) -| `.claude/CLAUDE.md` + `README.adoc` -| a2ml is universal (vendor-neutral, structured, machine-parseable). `.claude/CLAUDE.md` is Claude-specific. a2ml works with any AI agent that supports the protocol. -| **PARTIAL** -- a2ml is universal, CLAUDE.md is Claude-specific. Keep both. They serve overlapping but distinct purposes. - -| **Capability advertisement** -| a2ml listing available tools, APIs, and commands a project exposes -| No standard alternative exists -| Nothing else fills this role. README is for humans. package.json/Cargo.toml describes build deps, not operational capabilities. a2ml is the only structured format for telling agents "here is what you can do with this project." -| **N/A** -- no alternative to deprecate. a2ml fills a gap. -|=== - -== Section 4: Where a2ml Does NOT Fit - -[cols="1,2,2"] -|=== -| Anti-Pattern | Why It Fails | What To Use Instead - -| **Single-file directories** -| A directory containing one `Containerfile` does not need a manifest. The agent can read the file directly. An a2ml file that says "this directory contains a Containerfile" adds a layer of indirection with no information gain. -| Direct file reading. If there is only one file, the agent will find it. - -| **Code directories (`lib/`, `src/`)** -| Module-level documentation (docstrings, module comments, type signatures) describes code far better than an external manifest. a2ml cannot express function signatures, type hierarchies, or implementation details. Agents understand code natively. -| Inline documentation, module docstrings, type annotations. Let the code speak for itself. - -| **Replacing human documentation** -| a2ml is for machines. Putting human-readable tutorials, architecture explanations, or onboarding guides in a2ml format makes them harder for humans to read and no easier for machines (which can already parse Markdown/AsciiDoc). -| `README.adoc` for humans. `0-AI-MANIFEST.a2ml` for machines. Never mix the audiences. - -| **Deeply nested directories** -| Placing a2ml in every subdirectory (e.g., `src/utils/a2ml`, `src/models/a2ml`) creates maintenance overhead. The root a2ml should describe the project structure; subdirectories should be self-explanatory from their contents and naming. -| One `0-AI-MANIFEST.a2ml` at repo root. Maybe one more in complex subdirectories (like `test-infra/` or `deploy/`). No more. - -| **Version-pinning dependencies** -| a2ml describes capabilities, not dependency versions. Using it as a lockfile or version manifest duplicates information from `Cargo.lock`, `deno.lock`, or `guix.scm` and will drift out of sync. -| Native lockfiles for the ecosystem (`Cargo.lock`, `deno.lock`, etc.). -|=== - -== Section 5: Deprecation Recommendations Summary - -The definitive table. Sorted by recommendation. - -=== DEPRECATE -- k9-svc/a2ml is genuinely better - -[cols="2,1,3"] -|=== -| Format / Tool | Status | Reason - -| Makefile deploy targets (`make deploy`, `make rollback`) -| **DEPRECATE** -| k9-svc Hunt components are typed (Nickel contracts), signed (Ed25519), and self-validating. Makefile targets are untyped, unsigned, and provide no security model. Replace with `.k9.ncl` Hunt components + `justfile` recipes. - -| Manual `SHA256SUMS` files -| **DEPRECATE** -| cerro-torre `.ctp` bundles + k9-svc pedigree checksums provide integrated, machine-verifiable supply chain security. Manual hash files require humans to remember to check them and can be silently tampered with. - -| `docker-compose.yml` for deployment orchestration -| **DEPRECATE** -| Replace with `selur-compose.toml` generated by k9-svc. Docker Compose YAML is untyped and allows invalid configurations that fail at runtime. k9-svc generates compose files from typed Nickel configs that are validated at evaluation time. - -| Standalone JSON Schema for deployment configs -| **DEPRECATE** -| Nickel contracts in `.k9.ncl` are strictly more expressive than JSON Schema. They support computed defaults, dependent validation, and first-class functions. JSON Schema cannot express "if environment is production, replicas must be >= 3." - -| External-only config validation (CI linters, ad-hoc scripts) -| **DEPRECATE** -| k9-svc components carry their own validation. The dogfooding principle means validation is embedded, not bolted on. If the component cannot validate itself, it refuses to run. -|=== - -=== KEEP -- alternatives are equal or superior - -[cols="2,1,3"] -|=== -| Format / Tool | Status | Reason - -| Helm `values.yaml` -| **KEEP** -| Kubernetes ecosystem integration (chart repos, Argo CD, Flux, operator pattern) that k9-svc cannot match. For pure K8s shops, Helm is the right tool. Consider k9-svc for the validation layer _around_ Helm values. - -| Kustomize overlays -| **KEEP** -| Kubernetes-native, built into `kubectl`. Better for pure K8s shops that want to avoid templating. k9-svc adds nothing if you are already in the K8s ecosystem and do not need Podman-first deployment. - -| `Cargo.toml` / `mix.exs` / `gleam.toml` / `deno.json` -| **KEEP** -| Library manifests for build-time dependencies. k9-svc is for deployment-time components. These are fundamentally different abstraction levels. - -| GitHub Actions YAML -| **KEEP** -| k9-svc can _wrap_ steps within a workflow (making them typed and signed) but cannot replace the workflow engine itself. GitHub Actions YAML is the CI/CD platform config; k9-svc is the component standard within it. - -| `README.adoc` / `README.md` -| **KEEP** -| Human audience. Pedigree and a2ml are machine-readable complements, not replacements. Humans need prose, diagrams, and examples. Machines need structured metadata. Both are necessary. - -| `.claude/CLAUDE.md` -| **KEEP** -| Claude-specific instructions that `0-AI-MANIFEST.a2ml` complements but does not replace. CLAUDE.md has Claude-specific features (memory integration, tool configuration) that a2ml's vendor-neutral format cannot express. - -| TOML / JSON / Nickel for app config -| **KEEP** -| Pure data configuration does not benefit from security levels, pedigree, or recipes. A `config.toml` is already Kennel-level by nature. Wrapping it in k9-svc adds overhead with zero benefit. - -| Inline code documentation -| **KEEP** -| Docstrings, module comments, and type signatures are better for code comprehension than any external manifest. a2ml describes project-level capabilities, not function-level documentation. - -| System package managers (`apk`, Guix, Nix, `rpm-ostree`) -| **KEEP** -| Package management is a solved problem. k9-svc is not a package manager and should never pretend to be one. - -| Lockfiles (`Cargo.lock`, `deno.lock`) -| **KEEP** -| Dependency version pinning is the lockfile's job. k9-svc pedigree tracks _component_ versions, not _dependency_ versions. These are different concerns. -|=== - -== Section 6: Decision Flowchart - -Use this to decide whether k9-svc or a2ml is appropriate for your use case. - -.... -Is it a deployable operational component? -├── YES: Does it need execution (subprocess, network, filesystem)? -│ ├── YES → Hunt-level .k9.ncl (sign it!) -│ └── NO: Does it need Nickel evaluation for validation? -│ ├── YES → Yard-level .k9.ncl -│ └── NO → Plain data file (TOML/JSON/Nickel). Do NOT use k9-svc. -└── NO: Is it a library, documentation, or source code? - └── YES → Do NOT use k9-svc. Use the native format for that domain. - -Should you add a 0-AI-MANIFEST.a2ml? -├── Is it a repo root? → YES, always. -├── Is it a complex multi-file directory (test-infra/, deploy/, configs/)? -│ → YES, agents benefit from the map. -├── Is it a single-file directory? → NO, the agent can read the file directly. -├── Is it a code directory (lib/, src/)? → NO, code documents itself. -└── Default → Probably not. One a2ml at repo root covers most cases. -.... - -== Section 7: Real-World Examples - -=== Good: k9-svc wrapping a deployment - -A multi-service deployment with environment-specific configs, health checks, and rollback. This is exactly what k9-svc was designed for. - -See: `examples/container-deploy.k9.ncl` - -=== Good: a2ml at repo root - -A `0-AI-MANIFEST.a2ml` telling agents what the repo contains, how to build it, and what services are available. Universal, structured, vendor-neutral. - -=== Bad: k9 wrapping a config file - -[source,nickel] ----- -# DON'T DO THIS -- pure data doesn't need pedigree -let pedigree = import "../pedigree.ncl" in -pedigree.K9Pedigree & { - metadata = { name = "my-toml-config", version = "1.0.0" }, - target = { os = 'Linux }, - security = { trust_level = 'Kennel }, # <-- always Kennel = pointless - validation = { checksum = "..." }, - recipes = { deploy = "cp config.toml /etc/myapp/" }, # <-- this is a Hunt recipe in Kennel clothing -} ----- - -This is wrong for two reasons: - -1. The security level is `'Kennel` but the recipe runs a shell command (`cp`), which requires `'Hunt`. The Leash system will reject this. -2. Even if corrected to `'Hunt`, the overhead of Ed25519 signing for a config file copy is absurd. - -**Just use:** `config.toml` + a `justfile` recipe. - -=== Bad: a2ml in every directory - -.... -src/ -├── 0-AI-MANIFEST.a2ml # NO -├── utils/ -│ ├── 0-AI-MANIFEST.a2ml # NO -│ └── helpers.rs -├── models/ -│ ├── 0-AI-MANIFEST.a2ml # NO -│ └── user.rs -└── handlers/ - ├── 0-AI-MANIFEST.a2ml # NO - └── api.rs -.... - -This is maintenance overhead with no benefit. The agent can read `helpers.rs`, `user.rs`, and `api.rs` directly and understand them from their code, docstrings, and type signatures. - -**Just use:** One `0-AI-MANIFEST.a2ml` at the repo root. diff --git a/k9-svc/examples/complex.k9 b/k9-svc/examples/complex.k9 deleted file mode 100644 index 897e0036..00000000 --- a/k9-svc/examples/complex.k9 +++ /dev/null @@ -1,28 +0,0 @@ -# Auto-generated K9 contract for container-build -# Safety tier: yard - -[must] -metadata.license : string { == 'PMPL-1.0-or-later' } -metadata.registry : string { == 'ghcr.io/hyperpolymath' } -build.runtime : string { == 'podman' } -layers.base.verify : bool { == true } -layers.runtime.user : string { == 'nonroot' } -security.non-root : bool { == true } -security.no-new-privileges : bool { == true } -security.signing.algorithm : string { == 'ML-DSA-87' } -security.signing.provider : string { == 'cerro-torre' } -security.sbom.format : string { == 'spdx-json' } -security.sbom.include-deps : bool { == true } -verify.vordr : bool { == true } -verify.svalinn : bool { == true } -verify.scan-on-build : bool { == true } - -[trust] -signed-by = "ci-pipeline" - -[dust] -remove = ["unfilled {{PLACEHOLDER}} values"] - -[intend] -production-ready = true -supply-chain-verified = true diff --git a/k9-svc/examples/config.k9.ncl b/k9-svc/examples/config.k9.ncl deleted file mode 100644 index eb2dff55..00000000 --- a/k9-svc/examples/config.k9.ncl +++ /dev/null @@ -1,99 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# config.k9.ncl - Example Yard-level component (Nickel validation) -# -# Security Level: 'Yard (Nickel evaluation, no I/O) -# -# This component demonstrates typed configuration with contracts. -# Nickel ensures the config is valid before any deployment. - -let pedigree = import "../pedigree.ncl" in - -# The component's pedigree (self-description) -let component_pedigree = { - metadata = { - name = "example-config", - version = "1.0.0", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "Example configuration component with type contracts", - }, - target = { - os = 'Linux, - is_edge = false, - requires_podman = false, - min_memory_mb = 64, - }, - security = { - trust_level = 'Yard, - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, - recipes = { - install = "echo 'Config component - no install needed'", - validate = "nickel typecheck config.k9.ncl", - deploy = "echo 'Config component - use as import'", - migrate = "echo 'Config component - update version field'", - }, -} in - -# The actual configuration this component provides -let config = { - # Database connection settings - database | { - host | String | default = "localhost", - port | std.contract.from_predicate (fun p => p > 0 && p < 65536) | default = 5432, - name | String, - } = { - host = "db.example.com", - port = 5432, - name = "k9_example", - }, - - # Cache settings - cache | { - enabled | Bool | default = true, - ttl_seconds | std.contract.from_predicate (fun t => t > 0) | default = 300, - max_entries | Number | default = 1000, - } = { - enabled = true, - ttl_seconds = 600, - max_entries = 5000, - }, - - # Logging configuration - logging | { - level | [| 'debug, 'info, 'warn, 'error |] | default = 'info, - format | [| 'json, 'text, 'structured |] | default = 'json, - output | String | default = "stdout", - } = { - level = 'info, - format = 'json, - output = "stdout", - }, - - # Feature flags - features | { - enable_metrics | Bool | default = false, - enable_tracing | Bool | default = false, - experimental | Bool | default = false, - } = { - enable_metrics = true, - enable_tracing = true, - experimental = false, - }, -} in - -# Export both pedigree and config -{ - pedigree = component_pedigree, - config = config, - - # Helper: Get config as JSON for external tools - as_json = std.serialize 'Json config, -} diff --git a/k9-svc/examples/container-deploy.k9.ncl b/k9-svc/examples/container-deploy.k9.ncl deleted file mode 100644 index 39c9d569..00000000 --- a/k9-svc/examples/container-deploy.k9.ncl +++ /dev/null @@ -1,662 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# container-deploy.k9.ncl - Multi-service container deployment component -# -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Security Level: 'Hunt (requires cryptographic handshake) -# -# This is a realistic container deployment component that demonstrates -# how k9-svc wraps selur-compose deployments with typed configuration, -# security-level enforcement, rolling deployment, and rollback. -# -# It deploys a three-service stack (app, database, cache) across -# dev/staging/prod environments using selur-compose (Podman-first). -# -# WARNING: This is a Hunt-level component. It can execute shell commands, -# modify the filesystem, and access the network. It REQUIRES a valid -# Ed25519 signature before any execution is permitted. -# -# Usage: -# just authorize examples/container-deploy.k9.ncl -# just deploy-stack dev -# just deploy-stack staging -# just deploy-stack production - -let pedigree = import "../pedigree.ncl" in -let leash = import "../leash.ncl" in - -# ───────────────────────────────────────────────────────────────────── -# Component Pedigree (L1-L5) -# -# This is the self-description that every k9 component carries. -# The pedigree tells the runtime WHO this component is, WHERE it -# runs, WHAT it's allowed to do, and HOW it validates itself. -# ───────────────────────────────────────────────────────────────────── -let component_pedigree = { - metadata = { - name = "container-deploy-stack", - version = "1.0.0", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "Multi-service container deployment with rolling updates and rollback", - }, - - # Target: Linux with Podman, needs at least 1GB for the full stack. - # is_edge = false because this is a server-side deployment component, - # not something that runs on constrained hardware. - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 1024, - }, - - # Security: Hunt level because this component: - # - Runs selur-compose commands (subprocess) - # - Pulls container images (network) - # - Writes deployment state files (filesystem) - # All three I/O capabilities are needed, so Hunt is the correct level. - # Kennel and Yard cannot perform any of these operations. - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, this MUST be a real Ed25519 signature generated by: - # just sign examples/container-deploy.k9.ncl - # The placeholder below will cause the Leash system to reject execution - # until a real signature is provided. - signature = "PLACEHOLDER-REQUIRES-REAL-ED25519-SIGNATURE", - }, - - # Validation: The checksum is computed over the component payload - # (everything except the signature field itself). The pedigree_version - # tracks which version of the pedigree schema this component was - # written against. hunt_authorized starts false and is set true only - # after the Leash handshake completes successfully. - validation = { - checksum = "sha256:placeholder-recomputed-at-sign-time", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, - - # Recipes: The Just targets that implement each lifecycle phase. - # These are the actual commands the k9 runtime will invoke. - recipes = { - install = "just install-stack", - validate = "just validate-stack", - deploy = "just deploy-stack", - migrate = "just migrate-stack", - }, -} in - -# ───────────────────────────────────────────────────────────────────── -# Service Definitions -# -# Each service in the stack is defined as a typed Nickel record. -# Nickel contracts enforce that port numbers are valid, memory -# limits are reasonable, and required fields are present. -# -# This is where k9-svc shines compared to raw docker-compose.yml: -# invalid configurations are caught at evaluation time, BEFORE -# any container is started. -# ───────────────────────────────────────────────────────────────────── - -# Contract: A valid TCP/UDP port number (1-65535) -let ValidPort = std.contract.from_predicate (fun p => p > 0 && p < 65536) in - -# Contract: A valid replica count (at least 1, at most 10 for safety) -let ValidReplicas = std.contract.from_predicate (fun r => r >= 1 && r <= 10) in - -let services = { - # The primary application service. - # Uses Chainguard base images for minimal attack surface. - app = { - image = "ghcr.io/hyperpolymath/myapp", - port | ValidPort = 8080, - health_check = "/api/health", - readiness_check = "/api/ready", - # Liveness probe: if the app doesn't respond within 5 seconds, - # Podman will restart it. This prevents zombie processes. - liveness_interval_seconds = 10, - liveness_timeout_seconds = 5, - depends_on = ["database", "cache"], - }, - - # PostgreSQL database service. - # Chainguard provides a hardened PostgreSQL image with no shell, - # no package manager, and minimal CVE surface. - database = { - image = "cgr.dev/chainguard/postgres:latest", - port | ValidPort = 5432, - health_check = "pg_isready -U app -d myapp", - # Persistent volume for data. Without this, database state - # is lost on container restart. - volume = "pgdata:/var/lib/postgresql/data", - depends_on = [], - }, - - # Redis-compatible cache (Valkey). - # Valkey is the community fork of Redis, fully compatible. - # We use it for session caching and rate limiting. - cache = { - image = "cgr.dev/chainguard/valkey:latest", - port | ValidPort = 6379, - health_check = "valkey-cli ping", - depends_on = [], - }, -} in - -# ───────────────────────────────────────────────────────────────────── -# Environment-Specific Configuration -# -# Each environment overrides the base service definitions with -# resource limits, replica counts, and image tags appropriate -# for that deployment tier. -# -# The Nickel type system ensures that dev/staging/prod configs -# all share the same shape, so you cannot accidentally omit a -# field in production that exists in dev. -# ───────────────────────────────────────────────────────────────────── -let environments = { - # Development: Single replica, generous resources, debug logging. - # Uses :dev image tags built from the current branch. - dev = { - replicas | ValidReplicas = 1, - app_memory = "256Mi", - app_cpu = "100m", - db_memory = "256Mi", - cache_memory = "64Mi", - image_tag = "dev", - log_level = "debug", - # In dev, we allow insecure connections for local testing. - # This flag is checked by the deploy script and NEVER set in prod. - allow_insecure = true, - # Domain for the app service (used in health check URLs) - domain = "localhost", - }, - - # Staging: Mirrors production topology but with fewer resources. - # Uses :staging tags from the release branch. - staging = { - replicas | ValidReplicas = 2, - app_memory = "512Mi", - app_cpu = "250m", - db_memory = "512Mi", - cache_memory = "128Mi", - image_tag = "staging", - log_level = "info", - allow_insecure = false, - domain = "staging.example.com", - }, - - # Production: Full resources, multiple replicas, strict security. - # Uses :latest tags from the main branch (tagged releases only). - production = { - replicas | ValidReplicas = 3, - app_memory = "1Gi", - app_cpu = "500m", - db_memory = "2Gi", - cache_memory = "256Mi", - image_tag = "latest", - log_level = "warn", - allow_insecure = false, - domain = "app.example.com", - }, -} in - -# ───────────────────────────────────────────────────────────────────── -# Deployment Strategy -# -# Rolling deployment: replace one replica at a time, wait for health -# checks to pass before proceeding to the next. If any replica fails -# health checks, halt the rollout and trigger rollback. -# -# max_surge = 1 means we can temporarily have one extra replica -# during the transition. max_unavailable = 0 means we never reduce -# capacity below the target count — zero-downtime deployment. -# ───────────────────────────────────────────────────────────────────── -let strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - # How many seconds to wait after a new replica starts before - # checking its health. Gives the app time to initialize. - startup_delay_seconds = 10, - # How many consecutive health check passes are required before - # declaring a replica healthy. - health_check_threshold = 3, - # Maximum time (seconds) to wait for a replica to become healthy. - # If exceeded, the rollout is halted and rollback begins. - health_check_timeout_seconds = 120, - # Whether to automatically rollback on failure. - # If false, the deployment halts but does not revert. - auto_rollback = true, -} in - -# ───────────────────────────────────────────────────────────────────── -# Certificate and Signing Verification -# -# Before deploying to staging or production, the component verifies: -# 1. The container images are signed (cerro-torre .ctp bundles) -# 2. The SBOM (Software Bill of Materials) is present and valid -# 3. The k9 component itself has a valid Ed25519 signature -# -# This is the supply chain security layer. Without it, you're -# trusting that the image you pulled is the image you built. -# ───────────────────────────────────────────────────────────────────── -let signing = { - # Whether to verify container image signatures before deployment. - # Always true in staging/production. Can be false in dev for speed. - verify_images = true, - # The cerro-torre key ID used to sign container images. - # This must match the key in your organization's trust store. - image_signing_key_id = "hyperpolymath-release-2026", - # Whether to require SBOM attestation on images. - require_sbom = true, - # Accepted SBOM formats (SPDX or CycloneDX) - sbom_formats = ["spdx", "cyclonedx"], - # Whether to verify this k9 component's own signature. - # Always true — this is enforced by the Leash system anyway. - verify_self = true, -} in - -# ───────────────────────────────────────────────────────────────────── -# Deployment Scripts -# -# These are the actual shell scripts executed at Hunt level. -# Each script is a self-contained POSIX shell program embedded -# in the Nickel record. The k9 runtime extracts and executes them. -# -# SECURITY NOTE: These scripts have full system access. Review -# every line before authorizing this component. -# ───────────────────────────────────────────────────────────────────── -let scripts = { - # ── Pre-deployment validation ────────────────────────────────── - # Runs before any containers are touched. Checks: - # - Nickel contracts pass (typed config is valid) - # - Podman/selur-compose are available - # - Target environment has enough resources - # - Container images exist and are signed - pre_deploy = m%" -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# Pre-deployment validation for container-deploy-stack -set -eu - -ENV="${1:-dev}" -echo "K9: Pre-deployment validation for environment: $ENV" - -# Step 1: Validate the k9 component itself (Nickel typecheck) -echo "K9: [1/5] Typechecking component..." -nickel typecheck examples/container-deploy.k9.ncl -echo "K9: Typecheck passed." - -# Step 2: Verify Podman and selur-compose are available -echo "K9: [2/5] Checking runtime dependencies..." -command -v podman >/dev/null 2>&1 || { echo "ERROR: podman not found"; exit 1; } -command -v selur-compose >/dev/null 2>&1 || { echo "ERROR: selur-compose not found"; exit 1; } -echo "K9: Runtime dependencies present." - -# Step 3: Check available system resources -echo "K9: [3/5] Checking system resources..." -AVAILABLE_MB=$(free -m | awk '/^Mem:/ {print $7}') -if [ "$AVAILABLE_MB" -lt 1024 ]; then - echo "WARNING: Less than 1GB available memory ($AVAILABLE_MB MB)" - if [ "$ENV" = "production" ]; then - echo "ERROR: Insufficient memory for production deployment" - exit 1 - fi -fi -echo "K9: System resources adequate ($AVAILABLE_MB MB available)." - -# Step 4: Verify container image signatures (staging/production only) -if [ "$ENV" != "dev" ]; then - echo "K9: [4/5] Verifying container image signatures..." - for IMAGE in ghcr.io/hyperpolymath/myapp cgr.dev/chainguard/postgres cgr.dev/chainguard/valkey; do - echo "K9: Checking signature for $IMAGE..." - # cerro-torre verify checks the .ctp signature bundle - cerro-torre verify "$IMAGE" --key-id hyperpolymath-release-2026 || { - echo "ERROR: Image signature verification failed for $IMAGE" - exit 1 - } - done - echo "K9: All image signatures verified." -else - echo "K9: [4/5] Skipping image signature verification (dev environment)." -fi - -# Step 5: Verify this component's own Ed25519 signature -echo "K9: [5/5] Verifying component signature..." -./must verify examples/container-deploy.k9.ncl || { - echo "ERROR: Component signature verification failed" - exit 1 -} -echo "K9: Component signature verified." - -echo "K9: Pre-deployment validation PASSED for $ENV." -"%, - - # ── Generate selur-compose configuration ──────────────────────── - # Produces a selur-compose.toml from the Nickel configuration. - # This is where the typed config becomes a concrete deployment - # manifest. The Nickel evaluation has already validated all values, - # so the generated TOML is guaranteed to be well-formed. - generate_compose = m%" -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# Generate selur-compose.toml from k9 configuration -set -eu - -ENV="${1:-dev}" -OUTFILE="selur-compose.${ENV}.toml" - -echo "K9: Generating $OUTFILE..." - -# Extract environment-specific config via Nickel -# nickel export outputs the evaluated config as JSON, -# which we then transform into selur-compose TOML format. -nickel export --format json examples/container-deploy.k9.ncl \ - | jq -r --arg env "$ENV" '.environments[$env]' \ - > "/tmp/k9-env-config.json" - -TAG=$(jq -r '.image_tag' /tmp/k9-env-config.json) -REPLICAS=$(jq -r '.replicas' /tmp/k9-env-config.json) -APP_MEM=$(jq -r '.app_memory' /tmp/k9-env-config.json) -DB_MEM=$(jq -r '.db_memory' /tmp/k9-env-config.json) -CACHE_MEM=$(jq -r '.cache_memory' /tmp/k9-env-config.json) -LOG_LEVEL=$(jq -r '.log_level' /tmp/k9-env-config.json) -DOMAIN=$(jq -r '.domain' /tmp/k9-env-config.json) - -cat > "$OUTFILE" << TOML -# SPDX-License-Identifier: MPL-2.0 -# Auto-generated by container-deploy-stack k9 component -# Environment: $ENV -# Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ) -# DO NOT EDIT — regenerate with: just generate-compose $ENV - -[services.app] -image = "ghcr.io/hyperpolymath/myapp:$TAG" -ports = ["8080:8080"] -replicas = $REPLICAS -memory_limit = "$APP_MEM" -depends_on = ["database", "cache"] -healthcheck_cmd = "wget -qO- http://localhost:8080/api/health || exit 1" -healthcheck_interval = "10s" -healthcheck_timeout = "5s" -healthcheck_retries = 3 - -[services.app.environment] -LOG_LEVEL = "$LOG_LEVEL" -DATABASE_URL = "postgresql://app:app@database:5432/myapp" -CACHE_URL = "valkey://cache:6379" -APP_DOMAIN = "$DOMAIN" - -[services.database] -image = "cgr.dev/chainguard/postgres:latest" -ports = ["5432:5432"] -memory_limit = "$DB_MEM" -volumes = ["pgdata:/var/lib/postgresql/data"] -healthcheck_cmd = "pg_isready -U app -d myapp" -healthcheck_interval = "5s" -healthcheck_timeout = "3s" - -[services.database.environment] -POSTGRES_USER = "app" -POSTGRES_DB = "myapp" - -[services.cache] -image = "cgr.dev/chainguard/valkey:latest" -ports = ["6379:6379"] -memory_limit = "$CACHE_MEM" -healthcheck_cmd = "valkey-cli ping" -healthcheck_interval = "5s" -healthcheck_timeout = "3s" - -[volumes] -pgdata = {} -TOML - -echo "K9: Generated $OUTFILE successfully." -"%, - - # ── Rolling deployment with health checks ────────────────────── - # The main deployment script. Performs: - # 1. Pre-deployment validation - # 2. Compose file generation - # 3. Image pull (with signature verification) - # 4. Rolling service update - # 5. Post-deployment health check - # 6. Rollback on failure - deploy = m%" -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# Rolling deployment for container-deploy-stack -set -eu - -ENV="${1:-dev}" -COMPOSE_FILE="selur-compose.${ENV}.toml" -STATE_FILE="/tmp/k9-deploy-state-${ENV}.json" -PREV_STATE_FILE="/tmp/k9-deploy-state-${ENV}.prev.json" - -echo "==============================================" -echo "K9: Container Stack Deployment" -echo "K9: Environment: $ENV" -echo "K9: Timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)" -echo "==============================================" - -# Save current state for rollback -if [ -f "$STATE_FILE" ]; then - cp "$STATE_FILE" "$PREV_STATE_FILE" - echo "K9: Previous deployment state saved for rollback." -fi - -# Step 1: Pull images -echo "" -echo "K9: [1/4] Pulling container images..." -selur-compose -f "$COMPOSE_FILE" pull -echo "K9: Images pulled." - -# Step 2: Start infrastructure services first (database, cache) -echo "" -echo "K9: [2/4] Starting infrastructure services..." -selur-compose -f "$COMPOSE_FILE" up -d database cache -echo "K9: Waiting for infrastructure health checks..." - -# Wait for database -RETRIES=0 -MAX_RETRIES=30 -while [ $RETRIES -lt $MAX_RETRIES ]; do - if selur-compose -f "$COMPOSE_FILE" exec database pg_isready -U app -d myapp >/dev/null 2>&1; then - echo "K9: Database is ready." - break - fi - RETRIES=$((RETRIES + 1)) - echo "K9: Waiting for database... ($RETRIES/$MAX_RETRIES)" - sleep 2 -done -if [ $RETRIES -eq $MAX_RETRIES ]; then - echo "ERROR: Database failed to become ready within timeout." - exit 1 -fi - -# Wait for cache -RETRIES=0 -while [ $RETRIES -lt $MAX_RETRIES ]; do - if selur-compose -f "$COMPOSE_FILE" exec cache valkey-cli ping >/dev/null 2>&1; then - echo "K9: Cache is ready." - break - fi - RETRIES=$((RETRIES + 1)) - echo "K9: Waiting for cache... ($RETRIES/$MAX_RETRIES)" - sleep 2 -done -if [ $RETRIES -eq $MAX_RETRIES ]; then - echo "ERROR: Cache failed to become ready within timeout." - exit 1 -fi - -# Step 3: Rolling update of app service -echo "" -echo "K9: [3/4] Rolling update of app service..." -selur-compose -f "$COMPOSE_FILE" up -d --no-deps app -echo "K9: App containers starting..." - -# Step 4: Post-deployment health check -echo "" -echo "K9: [4/4] Running post-deployment health checks..." -HEALTH_PASSES=0 -REQUIRED_PASSES=3 -RETRIES=0 -MAX_RETRIES=60 -while [ $HEALTH_PASSES -lt $REQUIRED_PASSES ] && [ $RETRIES -lt $MAX_RETRIES ]; do - if wget -qO- "http://localhost:8080/api/health" >/dev/null 2>&1; then - HEALTH_PASSES=$((HEALTH_PASSES + 1)) - echo "K9: Health check passed ($HEALTH_PASSES/$REQUIRED_PASSES)" - else - HEALTH_PASSES=0 - echo "K9: Health check failed, resetting counter..." - fi - RETRIES=$((RETRIES + 1)) - sleep 2 -done - -if [ $HEALTH_PASSES -lt $REQUIRED_PASSES ]; then - echo "" - echo "ERROR: Deployment health checks failed after $MAX_RETRIES attempts." - echo "K9: Initiating rollback..." - if [ -f "$PREV_STATE_FILE" ]; then - # Rollback to previous state - selur-compose -f "$COMPOSE_FILE" down - selur-compose -f "$COMPOSE_FILE" up -d - echo "K9: Rollback complete. Previous deployment restored." - else - echo "WARNING: No previous state available for rollback." - echo "K9: Services are in a potentially broken state." - fi - exit 1 -fi - -# Record deployment state -cat > "$STATE_FILE" << STATE -{ - "environment": "$ENV", - "deployed_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)", - "compose_file": "$COMPOSE_FILE", - "status": "healthy", - "health_checks_passed": $HEALTH_PASSES -} -STATE - -echo "" -echo "==============================================" -echo "K9: Deployment SUCCESSFUL" -echo "K9: Environment: $ENV" -echo "K9: All health checks passed." -echo "==============================================" -"%, - - # ── Rollback script ──────────────────────────────────────────── - # Restores the previous deployment state. Called automatically - # on health check failure (if auto_rollback is true), or - # manually via: just rollback-stack - rollback = m%" -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# Rollback for container-deploy-stack -set -eu - -ENV="${1:-dev}" -COMPOSE_FILE="selur-compose.${ENV}.toml" -PREV_STATE_FILE="/tmp/k9-deploy-state-${ENV}.prev.json" - -echo "K9: Initiating rollback for environment: $ENV" - -if [ ! -f "$PREV_STATE_FILE" ]; then - echo "ERROR: No previous deployment state found." - echo "K9: Cannot rollback — no known-good state to restore." - exit 1 -fi - -echo "K9: Stopping current services..." -selur-compose -f "$COMPOSE_FILE" down - -echo "K9: Restoring previous deployment..." -selur-compose -f "$COMPOSE_FILE" up -d - -echo "K9: Rollback complete." -echo "K9: Verify with: selur-compose -f $COMPOSE_FILE ps" -"%, - - # ── Teardown script ──────────────────────────────────────────── - # Completely removes all services and volumes for an environment. - # Use with caution — this destroys data. - teardown = m%" -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# Teardown for container-deploy-stack -set -eu - -ENV="${1:-dev}" -COMPOSE_FILE="selur-compose.${ENV}.toml" - -echo "K9: Tearing down environment: $ENV" -echo "WARNING: This will destroy all data including database volumes." -echo "K9: Press Ctrl+C within 5 seconds to abort..." -sleep 5 - -selur-compose -f "$COMPOSE_FILE" down --volumes --remove-orphans - -echo "K9: Environment $ENV torn down completely." -"%, -} in - -# ───────────────────────────────────────────────────────────────────── -# Export -# -# The top-level record is what the k9 runtime and other tools consume. -# It bundles the pedigree (self-description), service definitions, -# environment configs, deployment strategy, signing requirements, -# and executable scripts into a single self-validating unit. -# ───────────────────────────────────────────────────────────────────── -{ - pedigree = component_pedigree, - services = services, - environments = environments, - strategy = strategy, - signing = signing, - scripts = scripts, - - # Security check: This component requires Hunt level. - # The Leash system will verify this before allowing execution. - required_level = 'Hunt, - - # Usage instructions for operators - usage = m%" -CONTAINER DEPLOYMENT STACK — Usage Guide -========================================= - -This is a Hunt-level k9 component. Before running: - - 1. Verify signature: ./must verify examples/container-deploy.k9.ncl - 2. Authorize: just authorize examples/container-deploy.k9.ncl - -Deploy to an environment: - - just deploy-stack dev # Development (single replica) - just deploy-stack staging # Staging (2 replicas, signed images) - just deploy-stack production # Production (3 replicas, full verification) - -Rollback: - - just rollback-stack dev - -Teardown (destroys data): - - just teardown-stack dev - -Generate compose file without deploying: - - just generate-compose dev -"%, -} diff --git a/k9-svc/examples/conversation-walkthrough.txt b/k9-svc/examples/conversation-walkthrough.txt deleted file mode 100644 index c0f9fe54..00000000 --- a/k9-svc/examples/conversation-walkthrough.txt +++ /dev/null @@ -1,35 +0,0 @@ -K9 File Examples - Conversation Dump -================================= - -Date: Wed Apr 8 10:17:04 AM BST 2026 - -Files created: --rw-r--r--. 1 hyper hyper 857 Apr 8 09:52 /home/hyper/Desktop/k9-complex-example.k9 --rw-r--r--. 1 hyper hyper 975 Apr 8 09:52 /home/hyper/Desktop/k9-example.k9 - -File 1 content (first 10 lines): -K9! -# SPDX-License-Identifier: MIT -# hello.k9 - Example Kennel-level component (pure data) -# -# Security Level: 'Kennel (no execution, safe anywhere) -# -# This is the simplest K9 component: just data. -# It can be parsed and displayed without any risk. - ---- - -File 2 content (first 10 lines): -# Auto-generated K9 contract for container-build -# Safety tier: yard - -[must] -metadata.license : string { == 'PMPL-1.0-or-later' } -metadata.registry : string { == 'ghcr.io/hyperpolymath' } -build.runtime : string { == 'podman' } -layers.base.verify : bool { == true } -layers.runtime.user : string { == 'nonroot' } -security.non-root : bool { == true } - -End of dump -Files are on your desktop - they do contain content! diff --git a/k9-svc/examples/deploy.k9.ncl b/k9-svc/examples/deploy.k9.ncl deleted file mode 100644 index 653c386f..00000000 --- a/k9-svc/examples/deploy.k9.ncl +++ /dev/null @@ -1,152 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl - Example Hunt-level component (full execution) -# -# Security Level: 'Hunt (requires cryptographic handshake) -# -# WARNING: This component can execute shell commands! -# It requires explicit authorization via the Leash system. -# -# This demonstrates a deployment component that: -# 1. Validates its own configuration -# 2. Checks target environment -# 3. Deploys to the appropriate target - -let pedigree = import "../pedigree.ncl" in -let leash = import "../leash.ncl" in - -# The component's pedigree (self-description) -let component_pedigree = { - metadata = { - name = "example-deploy", - version = "1.0.0", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "Example deployment component (Hunt level)", - }, - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 512, - }, - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, this would be a real Ed25519 signature - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - recipes = { - install = "just install-deploy-example", - validate = "just validate-deploy-example", - deploy = "just deploy-example", - migrate = "just migrate-deploy-example", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "ghcr.io/hyperpolymath/k9-example", - port = 8080, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (these would be executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation..." -nickel typecheck deploy.k9.ncl -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying to $ENV environment..." - -# In a real deployment, this would: -# 1. Build/pull the container image -# 2. Apply Kubernetes/Podman manifests -# 3. Wait for rollout completion -# 4. Run smoke tests - -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back deployment..." -# Rollback logic here -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: This component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -⚠️ WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorized Hunt-level execution - -Run with: just authorize examples/deploy.k9.ncl && just deploy-example -"%, -} diff --git a/k9-svc/examples/hello.k9 b/k9-svc/examples/hello.k9 deleted file mode 100644 index 78bad1ab..00000000 --- a/k9-svc/examples/hello.k9 +++ /dev/null @@ -1,40 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# hello.k9 - Example Kennel-level component (pure data) -# -# Security Level: 'Kennel (no execution, safe anywhere) -# -# This is the simplest K9 component: just data. -# It can be parsed and displayed without any risk. - ---- -metadata: - name: hello-k9 - version: 1.0.0 - description: A friendly greeting from the K9 pack - author: hyperpolymath - license: PMPL-1.0-or-later - -content: - greeting: "Hello from K9!" - message: | - Welcome to the K9 Self-Validating Component system. - - This file demonstrates the 'Kennel security level: - - Pure data only - - No code execution - - Safe to open anywhere - - Think of it as a smarter YAML that knows what it is. - - facts: - - K9 files start with the magic number "K9!" - - The must-just-nickel triad enables self-validation - - Three security levels: 'Kennel, 'Yard, 'Hunt - - Podman-first deployment prevents host pollution - -tags: - - example - - kennel - - hello-world - - safe diff --git a/k9-svc/examples/hello.k9.ncl b/k9-svc/examples/hello.k9.ncl deleted file mode 100644 index c1cd9646..00000000 --- a/k9-svc/examples/hello.k9.ncl +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# hello.k9.ncl - Example K9 Self-Validating Component -# -# This is a minimal .k9 component demonstrating the pedigree structure. -# It validates itself against the pedigree schema. - -let pedigree = import "../pedigree.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "hello-k9", - version = "1.0.0-alpha", - description = "A minimal K9 component that says hello", - }, - - target = { - os = 'Linux, - is_edge = false, - requires_podman = false, - }, - - security = { - trust_level = 'Yard, - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - - validation = { - checksum = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, - - recipes = { - install = "echo 'Hello from K9!'", - validate = "nickel typecheck examples/hello.k9.ncl", - deploy = "echo 'K9 deployed successfully'", - migrate = "echo 'No migration needed'", - }, -} diff --git a/k9-svc/examples/simple.k9 b/k9-svc/examples/simple.k9 deleted file mode 100644 index 78bad1ab..00000000 --- a/k9-svc/examples/simple.k9 +++ /dev/null @@ -1,40 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# hello.k9 - Example Kennel-level component (pure data) -# -# Security Level: 'Kennel (no execution, safe anywhere) -# -# This is the simplest K9 component: just data. -# It can be parsed and displayed without any risk. - ---- -metadata: - name: hello-k9 - version: 1.0.0 - description: A friendly greeting from the K9 pack - author: hyperpolymath - license: PMPL-1.0-or-later - -content: - greeting: "Hello from K9!" - message: | - Welcome to the K9 Self-Validating Component system. - - This file demonstrates the 'Kennel security level: - - Pure data only - - No code execution - - Safe to open anywhere - - Think of it as a smarter YAML that knows what it is. - - facts: - - K9 files start with the magic number "K9!" - - The must-just-nickel triad enables self-validation - - Three security levels: 'Kennel, 'Yard, 'Hunt - - Podman-first deployment prevents host pollution - -tags: - - example - - kennel - - hello-world - - safe diff --git a/k9-svc/k9-scan b/k9-svc/k9-scan deleted file mode 100755 index edd523ec..00000000 --- a/k9-svc/k9-scan +++ /dev/null @@ -1,258 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# k9-scan - Static analysis tool for K9 components -# Checks for common security issues and suspicious patterns - -set -eu - -VERSION="0.1.0-alpha" -COMPONENT="" -WARNINGS=0 -ERRORS=0 - -# Color output (if terminal supports it) -if [ -t 1 ]; then - RED='\033[0;31m' - YELLOW='\033[1;33m' - GREEN='\033[0;32m' - BLUE='\033[0;34m' - NC='\033[0m' # No Color -else - RED='' - YELLOW='' - GREEN='' - BLUE='' - NC='' -fi - -warn() { - WARNINGS=$((WARNINGS + 1)) - printf "${YELLOW}⚠️ WARNING:${NC} %s\n" "$1" >&2 -} - -error() { - ERRORS=$((ERRORS + 1)) - printf "${RED}❌ ERROR:${NC} %s\n" "$1" >&2 -} - -info() { - printf "${BLUE}ℹ️ INFO:${NC} %s\n" "$1" >&2 -} - -ok() { - printf "${GREEN}✓${NC} %s\n" "$1" >&2 -} - -usage() { - cat < - -Checks for: - • Suspicious file paths (/etc/shadow, /root/.ssh, etc.) - • Dangerous commands (rm -rf /, dd, mkfs, etc.) - • Network exfiltration patterns - • Obfuscation (base64, hex encoding) - • Privilege escalation attempts - • Missing security declarations - -Exit codes: - 0 - No issues found - 1 - Warnings found (review recommended) - 2 - Errors found (DO NOT RUN) - -Examples: - k9-scan component.k9.ncl - k9-scan examples/*.k9.ncl - -See: docs/SECURITY-BEST-PRACTICES.adoc -EOF -} - -check_magic_number() { - if ! head -n 1 "$COMPONENT" | grep -q "^K9!"; then - error "Missing K9! magic number at start of file" - else - ok "K9! magic number present" - fi -} - -check_security_level() { - if ! grep -q "leash.*=" "$COMPONENT"; then - error "Missing security level declaration (leash)" - else - level=$(grep "leash.*=" "$COMPONENT" | head -1) - info "Security level: $level" - if echo "$level" | grep -q "'Hunt"; then - warn "Hunt-level component detected (full system access)" - fi - fi -} - -check_suspicious_files() { - info "Checking for suspicious file paths..." - - # Critical system files - if grep -q "/etc/shadow\|/etc/sudoers\|/root/.ssh" "$COMPONENT"; then - error "Accesses critical system files (/etc/shadow, /etc/sudoers, /root/.ssh)" - fi - - # Sensitive user files - if grep -q "\.ssh/id_rsa\|\.gnupg/\|\.aws/credentials" "$COMPONENT"; then - warn "Accesses sensitive user files (SSH keys, GPG, AWS credentials)" - fi - - # Password/credential files - if grep -q "password.*=.*\"\|api_key.*=.*\"\|secret.*=.*\"" "$COMPONENT"; then - warn "Contains hardcoded credentials or secrets" - fi -} - -check_dangerous_commands() { - info "Checking for dangerous commands..." - - # Destructive commands - if grep -q "rm -rf /\|dd if=/dev/zero\|mkfs\|fdisk\|parted" "$COMPONENT"; then - error "Contains destructive commands (rm -rf /, dd, mkfs)" - fi - - # Privilege escalation - if grep -q "sudo\|chmod.*[+]s\|setuid\|setgid" "$COMPONENT"; then - warn "Contains privilege escalation patterns (sudo, setuid)" - fi - - # System modification - if grep -q "systemctl.*disable\|systemctl.*mask\|iptables -F\|setenforce 0" "$COMPONENT"; then - warn "Disables security features (firewall, SELinux)" - fi - - # Reverse shells - if grep -q "nc.*-e.*bash\|/dev/tcp/\|bash -i >& /dev/tcp\|python.*-m.*SimpleHTTPServer" "$COMPONENT"; then - error "Contains reverse shell or network backdoor patterns" - fi -} - -check_network_exfiltration() { - info "Checking for network exfiltration..." - - # Data exfiltration patterns - if grep -q "curl.*-X POST\|wget.*--post\|nc.*<\|tar.*|.*curl" "$COMPONENT"; then - warn "Contains network upload patterns (potential data exfiltration)" - fi - - # Unexpected network access - if grep -q "curl\|wget\|nc\|ncat\|socat" "$COMPONENT"; then - info "Uses network tools (curl, wget, nc) - verify this is expected" - fi -} - -check_obfuscation() { - info "Checking for obfuscation..." - - # Base64 encoding (often used to hide malicious commands) - if grep -q "base64.*-d\|base64 --decode" "$COMPONENT"; then - error "Uses base64 decoding (potential obfuscation)" - fi - - # Hex encoding - if grep -q "\\\\x[0-9a-fA-F][0-9a-fA-F]" "$COMPONENT"; then - warn "Contains hex-encoded strings (potential obfuscation)" - fi - - # String concatenation (hiding keywords) - if grep -q "\$[A-Za-z_][A-Za-z0-9_]*\s*[+][+]\s*\$[A-Za-z_][A-Za-z0-9_]*" "$COMPONENT"; then - info "Uses string concatenation (verify not used to hide commands)" - fi -} - -check_signature() { - if [ -f "${COMPONENT}.sig" ]; then - ok "Signature file present: ${COMPONENT}.sig" - else - error "No signature file found (required for Hunt-level components)" - fi -} - -check_pedigree() { - info "Checking pedigree section..." - - if ! grep -q "pedigree.*=" "$COMPONENT"; then - error "Missing pedigree section" - return - fi - - # Check for required pedigree fields - if ! grep -q "component_type" "$COMPONENT"; then - warn "Missing component_type in pedigree" - fi - - if ! grep -q "description" "$COMPONENT"; then - warn "Missing description in pedigree" - fi - - if ! grep -q "author" "$COMPONENT"; then - warn "Missing author in pedigree" - fi - - # Check for side_effects documentation (Hunt level) - if grep -q "'Hunt" "$COMPONENT"; then - if ! grep -q "side_effects\|warnings" "$COMPONENT"; then - warn "Hunt component missing side_effects or warnings documentation" - fi - fi -} - -main() { - if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then - usage - exit 0 - fi - - COMPONENT="$1" - - if [ ! -f "$COMPONENT" ]; then - error "File not found: $COMPONENT" - exit 2 - fi - - echo "═══════════════════════════════════════════════════════════" - echo " k9-scan v$VERSION - Static Security Analysis" - echo "═══════════════════════════════════════════════════════════" - echo "" - echo "Scanning: $COMPONENT" - echo "" - - # Run all checks - check_magic_number - check_security_level - check_pedigree - check_suspicious_files - check_dangerous_commands - check_network_exfiltration - check_obfuscation - check_signature - - echo "" - echo "═══════════════════════════════════════════════════════════" - printf " Results: ${GREEN}OK: %d${NC} | ${YELLOW}WARNINGS: %d${NC} | ${RED}ERRORS: %d${NC}\n" \ - $(($(wc -l < "$COMPONENT") - WARNINGS - ERRORS)) "$WARNINGS" "$ERRORS" - echo "═══════════════════════════════════════════════════════════" - echo "" - - if [ "$ERRORS" -gt 0 ]; then - echo "${RED}❌ FAILED${NC}: Found $ERRORS errors - DO NOT RUN this component" >&2 - echo "Review errors above and verify component source." >&2 - exit 2 - elif [ "$WARNINGS" -gt 0 ]; then - echo "${YELLOW}⚠️ WARNINGS${NC}: Found $WARNINGS warnings - review recommended" >&2 - echo "Review warnings above before running this component." >&2 - exit 1 - else - echo "${GREEN}✓ PASSED${NC}: No security issues detected" >&2 - echo "Component appears safe, but always verify signatures before running." >&2 - exit 0 - fi -} - -main "$@" diff --git a/k9-svc/k9-sign/.gitignore b/k9-svc/k9-sign/.gitignore deleted file mode 100644 index 075bdcff..00000000 --- a/k9-svc/k9-sign/.gitignore +++ /dev/null @@ -1,14 +0,0 @@ -# Rust build artifacts -/target/ -Cargo.lock - -# IDE -.vscode/ -.idea/ -*.swp -*.swo -*~ - -# OS -.DS_Store -Thumbs.db diff --git a/k9-svc/k9-sign/Cargo.toml b/k9-svc/k9-sign/Cargo.toml deleted file mode 100644 index bddf5430..00000000 --- a/k9-svc/k9-sign/Cargo.toml +++ /dev/null @@ -1,40 +0,0 @@ -[package] -name = "k9-sign" -version = "1.0.0" -edition = "2021" -authors = ["Jonathan D.A. Jewell "] -license = "AGPL-3.0-or-later" -description = "Ed25519 signing and verification for K9 Hunt-level components" -repository = "https://github.com/hyperpolymath/standards/tree/main/k9-svc" - -[dependencies] -# Ed25519 cryptography -ed25519-dalek = { version = "2.1", features = ["rand_core"] } -signature = "2.2" -rand = "0.8" - -# Base64 encoding/decoding -base64 = "0.22" - -# Command-line argument parsing -clap = { version = "4.5", features = ["derive"] } - -# Error handling -anyhow = "1.0" -thiserror = "1.0" - -# File I/O and path handling -dirs = "5.0" - -# SHA-256 for fingerprints -sha2 = "0.10" -hex = "0.4" - -[dev-dependencies] -tempfile = "3.10" - -[profile.release] -lto = true -codegen-units = 1 -strip = true -opt-level = "z" # Optimize for size diff --git a/k9-svc/k9-sign/MIGRATION.adoc b/k9-svc/k9-sign/MIGRATION.adoc deleted file mode 100644 index 8262d2cd..00000000 --- a/k9-svc/k9-sign/MIGRATION.adoc +++ /dev/null @@ -1,493 +0,0 @@ -== Migration Guide: sign.sh → k9-sign - -*Target audience:* Existing K9 users migrating from sign.sh to k9-sign - -''''' - -=== Why Migrate? - -[width="100%",cols="34%,33%,33%",options="header",] -|=== -|Feature |sign.sh |k9-sign -|*Memory safety* |❌ Shell script vulnerabilities |✅ Rust guarantees -|*Injection attacks* |❌ Command injection possible |✅ Eliminated -|*Performance* |Shell + fork/exec overhead |Pure Rust (10-20x faster) -|*Binary size* |~11KB + OpenSSL dependency |756KB self-contained -|*Error handling* |Can be ignored |Enforced by Result -|*Tests* |None |15 comprehensive tests -|=== - -*TL;DR:* k9-sign eliminates entire classes of vulnerabilities while -being significantly faster. - -''''' - -=== Breaking Changes - -==== 1. Key Format (NOT Compatible) - -*sign.sh keys:* - Format: OpenSSL PEM (base64-encoded ASN.1) - Size: -~100 bytes (with headers) - Extension: `+.key+` and `+.pub+` - -*k9-sign keys:* - Format: Raw Ed25519 bytes - Size: 32 bytes (private), -32 bytes (public) - Extension: `+.key+` and `+.pub+` - -⚠️ *You MUST regenerate all keys.* Old keys cannot be converted. - -==== 2. Signature File Extension - -*sign.sh:* - -[source,bash] ----- -./sign.sh sign component.k9.ncl -# Creates: component.k9.ncl.sig ----- - -*k9-sign:* - -[source,bash] ----- -k9-sign sign component.k9.ncl -# Creates: component.k9.ncl.sig ----- - -✅ *No change needed* - both use `+.sig+` extension. - -==== 3. Command Syntax (Mostly Compatible) - -[width="100%",cols="38%,31%,31%",options="header",] -|=== -|Operation |sign.sh |k9-sign -|Generate key |`+./sign.sh keygen [name]+` |`+k9-sign keygen [name]+` - -|Sign file |`+./sign.sh sign [key]+` -|`+k9-sign sign [key]+` - -|Verify |`+./sign.sh verify +` |`+k9-sign verify +` - -|Trust key |`+./sign.sh trust +` |`+k9-sign trust +` - -|List keys |`+./sign.sh list+` |`+k9-sign list+` -|=== - -✅ *Commands are identical* - just change the binary name. - -''''' - -=== Migration Steps - -==== Step 1: Install k9-sign - -[source,bash] ----- -cd k9-svc/k9-sign -./install.sh --user -# Or for system-wide: ./install.sh --system ----- - -*Verify installation:* - -[source,bash] ----- -k9-sign --version -# Should output: k9-sign 1.0.0 ----- - -==== Step 2: Generate New Keys - -[source,bash] ----- -# Generate primary keypair -k9-sign keygen primary - -# Output: -# K9: Generating Ed25519 keypair 'primary'... -# K9: Keypair generated: -# Private: ~/.config/k9/keys/primary.key (keep secret!) -# Public: ~/.config/k9/keys/primary.pub (share this) ----- - -⚠️ *IMPORTANT:* Your old sign.sh keys are still at -`+~/.config/k9/keys/*.key+` but are *incompatible*. Rename them to avoid -confusion: - -[source,bash] ----- -cd ~/.config/k9/keys -mkdir old-signsh-keys -mv *.key *.pub old-signsh-keys/ 2>/dev/null || true ----- - -==== Step 3: Trust Your New Public Key - -[source,bash] ----- -# Trust your own key (for testing) -k9-sign trust ~/.config/k9/keys/primary.pub - -# Verify it's trusted -k9-sign list -# Should show: -# Trusted keys (/home/user/.config/k9/keys/trusted): -# - primary (sha256:abc123...) ----- - -==== Step 4: Re-sign All Components - -⚠️ *You must re-sign ALL Hunt-level components with new keys.* - -[source,bash] ----- -# Find all K9 components -find . -name "*.k9.ncl" -type f - -# Re-sign each one -for file in *.k9.ncl; do - # Remove old signature - rm -f "${file}.sig" - - # Sign with new key - k9-sign sign "$file" primary - - echo "Re-signed: $file" -done ----- - -*Verify signatures:* - -[source,bash] ----- -for file in *.k9.ncl; do - k9-sign verify "$file" && echo "✓ $file" || echo "✗ $file" -done ----- - -==== Step 5: Distribute New Public Keys - -*Your users need your NEW public key.* - -[arabic] -. *Publish new key:* -+ -[source,bash] ----- -# Copy to your keys website/repo -cp ~/.config/k9/keys/primary.pub ~/my-website/keys/primary-2026.pub - -# Or commit to Git -git add keys/primary-2026.pub -git commit -m "Add k9-sign public key (Ed25519)" -git push ----- -. *Announce key rotation:* -+ -.... -Subject: K9 Signing Key Rotation - Action Required - -We've migrated from sign.sh to k9-sign (memory-safe Rust). - -New public key: https://example.com/keys/primary-2026.pub -Fingerprint: sha256:abc123... - -Please: -1. Install k9-sign: https://github.com/hyperpolymath/k9-svc/tree/main/k9-sign -2. Trust new key: k9-sign trust primary-2026.pub -3. Re-download signed components - -Old sign.sh keys are deprecated as of 2026-01-30. -.... - -==== Step 6: Update Workflows - -*CI/CD pipelines:* - -[source,yaml] ----- -# Before (sign.sh) -- name: Sign release - run: | - ./sign.sh sign release.k9.ncl production - -# After (k9-sign) -- name: Sign release - run: | - k9-sign sign release.k9.ncl production ----- - -*Update `+must+` script integration:* - -The `+must+` script already uses k9-sign if available, falling back to -sign.sh: - -[source,bash] ----- -./must verify component.k9.ncl -# Will use k9-sign if installed, otherwise sign.sh ----- - -==== Step 7: Test Migration - -[source,bash] ----- -# Create test component -cat > test.k9.ncl <<'EOF' -K9! -leash = 'Hunt -pedigree = { - schema_version = "1.0.0", - component_type = "test" -} -EOF - -# Sign with new key -k9-sign sign test.k9.ncl primary - -# Verify -k9-sign verify test.k9.ncl -# Should output: K9: ✓ Signature VALID (key: primary) - -# Authorize -k9-sign authorize test.k9.ncl -# Should output: K9: ✓ Component authorized for Hunt-level execution ----- - -==== Step 8: Remove sign.sh (Optional) - -After successful migration and 90-day transition period: - -[source,bash] ----- -# Verify k9-sign is working -k9-sign --version - -# Backup sign.sh -mv sign.sh sign.sh.deprecated - -# Remove old keys (already backed up in step 2) -rm -rf ~/.config/k9/keys/old-signsh-keys/ - -# Update documentation to reference k9-sign only ----- - -''''' - -=== Transition Period (Recommended: 90 Days) - -*Month 1-2:* - Install k9-sign alongside sign.sh - Generate new keys, -keep old keys - Re-sign all components with k9-sign - Both signature -types valid - -*Month 3:* - Announce old keys will be deprecated - Stop signing with -sign.sh - Only k9-sign signatures valid - -*Month 4+:* - Remove sign.sh completely - Delete old keys - k9-sign is -the only supported tool - -''''' - -=== Troubleshooting - -==== "`Private key not found`" after migration - -*Problem:* k9-sign can’t find keys at `+~/.config/k9/keys/+` - -*Solution:* - -[source,bash] ----- -# Check keys exist -ls -la ~/.config/k9/keys/ - -# If empty, generate new keys -k9-sign keygen primary - -# If old sign.sh keys present, they're incompatible - generate new ones ----- - -==== "`Signature INVALID`" for old components - -*Problem:* Components signed with sign.sh fail verification with k9-sign - -*Solution:* Re-sign with k9-sign: - -[source,bash] ----- -rm component.k9.ncl.sig -k9-sign sign component.k9.ncl ----- - -==== "`Invalid key size`" when trusting old keys - -*Problem:* Trying to trust sign.sh public key with k9-sign - -*Solution:* Old keys are incompatible. Generate new k9-sign keys: - -[source,bash] ----- -k9-sign keygen new-key -k9-sign trust ~/.config/k9/keys/new-key.pub ----- - -==== CI/CD pipeline fails after migration - -*Problem:* Automated signing in CI uses sign.sh - -*Solution:* Update CI config: - -[source,yaml] ----- -# Install k9-sign in CI -- name: Install k9-sign - run: | - cd k9-svc/k9-sign - cargo build --release - sudo cp target/release/k9-sign /usr/local/bin/ - -# Update signing step -- name: Sign release - run: k9-sign sign release.k9.ncl production ----- - -''''' - -=== Compatibility Matrix - -[width="100%",cols="31%,24%,24%,21%",options="header",] -|=== -|Component |sign.sh |k9-sign |Status -|*Key format* |PEM |Raw bytes |❌ Incompatible - -|*Key size* |Variable |32 bytes |❌ Incompatible - -|*Signature format* |Binary |Binary |✅ Compatible - -|*Signature size* |64 bytes |64 bytes |✅ Compatible - -|*Signature file ext* |`+.sig+` |`+.sig+` |✅ Compatible - -|*Command syntax* |`+./sign.sh cmd+` |`+k9-sign cmd+` |✅ Compatible - -|*Key storage* |`+~/.config/k9/keys/+` |`+~/.config/k9/keys/+` |✅ -Compatible -|=== - -*Summary:* Commands and file formats are compatible, but keys must be -regenerated. - -''''' - -=== Performance Comparison - -==== Benchmarks (1000 operations) - -[cols=",,,",options="header",] -|=== -|Operation |sign.sh |k9-sign |Speedup -|*Keygen* |5.2s |0.8s |*6.5x faster* -|*Sign (1KB)* |12.3s |1.1s |*11.2x faster* -|*Sign (1MB)* |18.7s |2.3s |*8.1x faster* -|*Verify* |15.1s |0.9s |*16.8x faster* -|=== - -*Why k9-sign is faster:* - No fork/exec overhead (pure Rust, no shell) - -No OpenSSL subprocess calls - Optimized Ed25519 implementation - Binary -already loaded in memory - -''''' - -=== Security Comparison - -==== Vulnerability Classes - -[cols=",,",options="header",] -|=== -|Attack Vector |sign.sh |k9-sign -|*Command injection* |❌ Possible |✅ Eliminated -|*Path traversal* |❌ Possible |✅ Safe path handling -|*Buffer overflow* |❌ Possible (OpenSSL) |✅ Impossible (Rust) -|*Use-after-free* |❌ Possible |✅ Impossible (Rust) -|*Race conditions* |❌ TOCTOU bugs |✅ Minimized -|*Error handling* |❌ Can be ignored |✅ Enforced -|=== - -*Risk reduction:* ~95% of signature-related vulnerabilities eliminated. - -''''' - -=== Rollback Plan - -If you need to rollback to sign.sh: - -[source,bash] ----- -# 1. Restore sign.sh -mv sign.sh.deprecated sign.sh -chmod +x sign.sh - -# 2. Restore old keys -mv ~/.config/k9/keys/old-signsh-keys/* ~/.config/k9/keys/ - -# 3. Re-sign components with sign.sh -./sign.sh sign component.k9.ncl primary - -# 4. Announce rollback to users ----- - -*Note:* Rollback should only be necessary if critical bugs are found. -All k9-sign tests pass and it’s been thoroughly validated. - -''''' - -=== FAQ - -*Q: Can I use both sign.sh and k9-sign during transition?* A: Yes! -Generate new k9-sign keys with a different name: - -[source,bash] ----- -k9-sign keygen k9sign-primary -# Keep sign.sh keys as-is -# Both can coexist in ~/.config/k9/keys/ ----- - -*Q: Will old signatures still verify after migration?* A: No. Signatures -are tied to keys, and old sign.sh keys are incompatible with k9-sign. -You must re-sign all components. - -*Q: What if I lose my new k9-sign private key?* A: Same as before - -you’ll need to generate a new keypair and re-sign everything. *Back up -your private keys securely!* - -*Q: Can I convert sign.sh keys to k9-sign format?* A: No. Different key -formats are fundamentally incompatible. You must generate new keys. - -*Q: Is k9-sign stable enough for production?* A: Yes. It has: - 15 -comprehensive tests (100% pass) - Memory-safe Rust implementation - -Audited cryptography library (ed25519-dalek) - Used in production by -K9-SVC maintainers - -''''' - -=== Support - -* *Issues:* -https://github.com/hyperpolymath/standards/tree/main/k9-svc/issues -* *Docs:* `+../docs/SECURITY-BEST-PRACTICES.adoc+` -* *Email:* j.d.a.jewell@open.ac.uk - -''''' - -*Migration checklist:* - -* [ ] Install k9-sign -* [ ] Generate new keys -* [ ] Trust new keys -* [ ] Re-sign all components -* [ ] Distribute new public keys -* [ ] Update CI/CD -* [ ] Test thoroughly -* [ ] Announce to users -* [ ] Remove sign.sh after 90 days - -Good luck with your migration! 🚀 diff --git a/k9-svc/k9-sign/README.adoc b/k9-svc/k9-sign/README.adoc deleted file mode 100644 index 5117971b..00000000 --- a/k9-svc/k9-sign/README.adoc +++ /dev/null @@ -1,212 +0,0 @@ -== k9-sign - -*Memory-safe Ed25519 signing and verification for K9 Hunt-level -components* - -This is a Rust rewrite of `+sign.sh+`, eliminating: - Shell injection -vulnerabilities - Buffer overflow risks - Path traversal attacks - Race -conditions in file operations - -=== Security Improvements Over sign.sh - -[width="100%",cols="18%,42%,40%",options="header",] -|=== -|Issue |sign.sh (Shell) |k9-sign (Rust) -|*Memory safety* |❌ Shell scripts have no memory safety |✅ Rust -guarantees memory safety - -|*Injection attacks* |❌ Command injection via unsanitized input |✅ No -shell execution, all operations in-process - -|*Buffer overflows* |❌ Possible with OpenSSL piping |✅ Impossible -(Rust’s borrow checker) - -|*Path traversal* |❌ Shell globbing can be exploited |✅ Safe path -handling with std::path - -|*Race conditions* |❌ TOCTOU bugs in file operations |✅ Atomic file -operations where possible - -|*Error handling* |❌ Errors can be silently ignored |✅ Result types -force error handling - -|*Type safety* |❌ Everything is strings |✅ Strong typing throughout - -|*Binary size* |~11KB (shell script) |756KB (self-contained binary) -|=== - -=== Installation - -[source,bash] ----- -cd k9-svc/k9-sign -cargo build --release -sudo cp target/release/k9-sign /usr/local/bin/ ----- - -=== Usage - -==== Generate a keypair - -[source,bash] ----- -k9-sign keygen [name] ----- - -Default name is "`primary`". Keys stored in `+~/.config/k9/keys/+`. - -==== Sign a component - -[source,bash] ----- -k9-sign sign component.k9.ncl [key-name] ----- - -Creates `+component.k9.ncl.sig+` and displays base64 signature for -embedding. - -==== Verify a signature - -[source,bash] ----- -k9-sign verify component.k9.ncl ----- - -Checks signature against all trusted keys. - -==== Trust a public key - -[source,bash] ----- -k9-sign trust ~/.config/k9/keys/primary.pub ----- - -Copies key to `+~/.config/k9/keys/trusted/+`. - -==== List keys - -[source,bash] ----- -k9-sign list ----- - -Shows your keys and trusted keys with SHA-256 fingerprints. - -==== Full Hunt authorization - -[source,bash] ----- -k9-sign authorize component.k9.ncl ----- - -Complete authorization check: verifies Hunt level, signature presence, -and signature validity. - -=== Example Workflow - -[source,bash] ----- -# 1. Generate your keypair -k9-sign keygen my-key - -# 2. Trust your own key (for testing) -k9-sign trust ~/.config/k9/keys/my-key.pub - -# 3. Sign a Hunt component -k9-sign sign examples/deploy.k9.ncl my-key - -# 4. Verify the signature -k9-sign verify examples/deploy.k9.ncl - -# 5. Full authorization (checks everything) -k9-sign authorize examples/deploy.k9.ncl ----- - -=== Cryptography - -* *Algorithm:* Ed25519 (EdDSA on Curve25519) -* *Library:* `+ed25519-dalek+` (pure Rust, audited) -* *Key size:* 32 bytes (256 bits) -* *Signature size:* 64 bytes (512 bits) -* *Security level:* ~128 bits (equivalent to RSA-3072) - -=== Advantages of Ed25519 - -* *Fast:* 10x faster than RSA for signing, 20x faster for verification -* *Small:* Keys and signatures are tiny (32 and 64 bytes) -* *Secure:* Immune to timing attacks, no RNG required for signing -* *Simple:* No parameter choices (unlike RSA/ECDSA) -* *Proven:* Used by SSH, Signal, Tor, and many others - -=== Comparison to OpenSSL (used by sign.sh) - -[width="100%",cols="18%,35%,47%",options="header",] -|=== -|Feature |OpenSSL (sign.sh) |ed25519-dalek (k9-sign) -|*Memory safety* |C (unsafe) |Rust (safe) -|*Dependencies* |External OpenSSL binary |Self-contained library -|*Attack surface* |Full OpenSSL (>400k LOC) |Minimal (crypto only) -|*Audit status* |OpenSSL audited |ed25519-dalek audited -|*Performance* |Shell overhead + fork/exec |Pure Rust (no syscalls) -|=== - -=== Migration from sign.sh - -`+k9-sign+` is a drop-in replacement for `+sign.sh+`: - -[source,bash] ----- -# Old (sign.sh) -./sign.sh keygen my-key -./sign.sh sign component.k9.ncl my-key -./sign.sh verify component.k9.ncl - -# New (k9-sign) -k9-sign keygen my-key -k9-sign sign component.k9.ncl my-key -k9-sign verify component.k9.ncl ----- - -*Key format compatibility:* - -❌ *NOT compatible* - k9-sign uses raw Ed25519 keys (32 bytes), while -sign.sh uses OpenSSL PEM format. - -*Migration path:* - -[arabic] -. Generate new keys with `+k9-sign keygen+` -. Re-sign all components with new keys -. Distribute new public keys to users -. Remove old sign.sh and OpenSSL dependency - -=== Testing - -[source,bash] ----- -# Unit tests -cargo test - -# Integration test -cargo build --release -./target/release/k9-sign keygen test-key -./target/release/k9-sign trust ~/.config/k9/keys/test-key.pub -echo "Test data" > test.txt -./target/release/k9-sign sign test.txt test-key -./target/release/k9-sign verify test.txt ----- - -=== License - -PMPL-1.0-or-later - -=== Author - -Jonathan D.A. Jewell j.d.a.jewell@open.ac.uk - -=== See Also - -* link:../docs/SECURITY-BEST-PRACTICES.adoc[K9-SVC Security Best -Practices] -* link:../docs/SECURITY-ROADMAP.adoc[K9-SVC Security Roadmap] -* link:../sign.sh[sign.sh (original shell implementation)] diff --git a/k9-svc/k9-sign/install.sh b/k9-svc/k9-sign/install.sh deleted file mode 100755 index e91bcae2..00000000 --- a/k9-svc/k9-sign/install.sh +++ /dev/null @@ -1,290 +0,0 @@ -#!/bin/bash -# SPDX-License-Identifier: MPL-2.0 -# install.sh - Install k9-sign system-wide or user-local - -set -euo pipefail - -VERSION="1.0.0" -SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" - -# Colors -RED='\033[0;31m' -GREEN='\033[0;32m' -YELLOW='\033[1;33m' -BLUE='\033[0;34m' -NC='\033[0m' # No Color - -info() { - echo -e "${BLUE}ℹ️ ${NC}$1" -} - -success() { - echo -e "${GREEN}✓${NC} $1" -} - -warn() { - echo -e "${YELLOW}⚠️ ${NC}$1" -} - -error() { - echo -e "${RED}❌ ${NC}$1" >&2 -} - -usage() { - cat </dev/null 2>&1; then - error "Cargo not found. Install Rust from https://rustup.rs/" - echo "" - echo "Quick install:" -# WARNING: Pipe-to-shell is unsafe — download and verify first -# WARNING: Pipe-to-shell is unsafe — download and verify first - echo " curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh" - exit 1 - fi - - info "Rust toolchain found:" - cargo --version - rustc --version -} - -build_binary() { - info "Building k9-sign in release mode..." - echo "" - - cd "$SCRIPT_DIR" - - # Clean previous builds (optional) - if [ -d target/release ]; then - warn "Cleaning previous release build..." - cargo clean --release - fi - - # Build with optimizations - if ! cargo build --release; then - error "Build failed. Check error messages above." - exit 1 - fi - - BINARY_PATH="$SCRIPT_DIR/target/release/k9-sign" - - if [ ! -f "$BINARY_PATH" ]; then - error "Binary not found at $BINARY_PATH" - exit 1 - fi - - BINARY_SIZE=$(du -h "$BINARY_PATH" | cut -f1) - success "Build complete! Binary size: $BINARY_SIZE" - echo "" -} - -run_tests() { - info "Running test suite..." - echo "" - - cd "$SCRIPT_DIR" - - if cargo test --release -- --test-threads=1; then - success "All tests passed!" - echo "" - else - error "Tests failed. Aborting installation." - exit 1 - fi -} - -install_binary() { - local install_dir="$1" - local binary_path="$SCRIPT_DIR/target/release/k9-sign" - local dest="$install_dir/k9-sign" - - # Create install directory if needed - if [ ! -d "$install_dir" ]; then - info "Creating directory: $install_dir" - mkdir -p "$install_dir" - fi - - # Check if we need sudo - local use_sudo="" - if [ ! -w "$install_dir" ]; then - warn "Need elevated privileges for $install_dir" - use_sudo="sudo" - fi - - # Check if binary already exists - if [ -f "$dest" ]; then - warn "k9-sign already installed at $dest" - local old_version="" - if old_version=$("$dest" --version 2>/dev/null | head -1); then - echo " Current: $old_version" - fi - echo " New: k9-sign $VERSION" - read -p "Overwrite? [y/N] " -n 1 -r - echo - if [[ ! $REPLY =~ ^[Yy]$ ]]; then - info "Installation cancelled." - exit 0 - fi - fi - - # Install - info "Installing k9-sign to $dest..." - if [ -n "$use_sudo" ]; then - $use_sudo cp "$binary_path" "$dest" - $use_sudo chmod 755 "$dest" - else - cp "$binary_path" "$dest" - chmod 755 "$dest" - fi - - success "Installed to $dest" - echo "" -} - -verify_installation() { - local binary_path="$1" - - info "Verifying installation..." - - if ! command -v k9-sign >/dev/null 2>&1; then - warn "k9-sign not in PATH" - echo "" - echo "Add to PATH by adding this to your shell profile (~/.bashrc or ~/.zshrc):" - echo " export PATH=\"$(dirname "$binary_path"):\$PATH\"" - echo "" - echo "Or run directly:" - echo " $binary_path --version" - echo "" - else - success "k9-sign is in PATH" - k9-sign --version - echo "" - fi - - info "Quick test:" - echo "" - echo " k9-sign keygen test-key" - echo " k9-sign list" - echo "" -} - -main() { - local install_mode="user" - local install_prefix="" - local build_only=false - - # Parse arguments - while [ $# -gt 0 ]; do - case "$1" in - --system) - install_mode="system" - shift - ;; - --user) - install_mode="user" - shift - ;; - --prefix) - install_prefix="$2" - shift 2 - ;; - --build-only) - build_only=true - shift - ;; - --help|-h) - usage - exit 0 - ;; - *) - error "Unknown option: $1" - usage - exit 1 - ;; - esac - done - - echo "╔══════════════════════════════════════════════════════════╗" - echo "║ k9-sign Installer v$VERSION ║" - echo "╚══════════════════════════════════════════════════════════╝" - echo "" - - # Determine install directory - local install_dir="" - if [ -n "$install_prefix" ]; then - install_dir="$install_prefix/bin" - info "Install mode: Custom prefix" - info "Install directory: $install_dir" - elif [ "$install_mode" = "system" ]; then - install_dir="/usr/local/bin" - info "Install mode: System-wide" - info "Install directory: $install_dir" - else - install_dir="$HOME/.local/bin" - info "Install mode: User-local" - info "Install directory: $install_dir" - fi - echo "" - - # Check prerequisites - check_rust - echo "" - - # Build - build_binary - - # Test - run_tests - - # Install or just build - if [ "$build_only" = true ]; then - info "Build-only mode, skipping installation." - info "Binary available at: $SCRIPT_DIR/target/release/k9-sign" - exit 0 - fi - - install_binary "$install_dir" - - # Verify - verify_installation "$install_dir/k9-sign" - - success "Installation complete!" - echo "" - echo "Next steps:" - echo " 1. Generate a keypair: k9-sign keygen" - echo " 2. Sign a component: k9-sign sign file.k9.ncl" - echo " 3. Verify signature: k9-sign verify file.k9.ncl" - echo "" - echo "Documentation: $(dirname "$SCRIPT_DIR")/docs/SECURITY-BEST-PRACTICES.adoc" - echo "Report issues: https://github.com/hyperpolymath/standards/tree/main/k9-svc/issues" -} - -main "$@" diff --git a/k9-svc/k9-sign/src/main.rs b/k9-svc/k9-sign/src/main.rs deleted file mode 100644 index 0e6768e7..00000000 --- a/k9-svc/k9-sign/src/main.rs +++ /dev/null @@ -1,507 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -//! k9-sign - Ed25519 signing and verification for K9 Hunt-level components -//! -//! This is a memory-safe Rust rewrite of sign.sh, eliminating: -//! - Shell injection vulnerabilities -//! - Buffer overflow risks -//! - Path traversal attacks -//! - Race conditions in file operations -//! -//! Uses ed25519-dalek for cryptographic operations instead of shelling out to OpenSSL. - -#![forbid(unsafe_code)] -use anyhow::{Context, Result}; -use base64::{engine::general_purpose::STANDARD as BASE64, Engine}; -use clap::{Parser, Subcommand}; -use ed25519_dalek::{Signature, Signer, SigningKey, Verifier, VerifyingKey}; -use rand::rngs::OsRng; -use sha2::{Digest, Sha256}; -use std::fs; -use std::path::{Path, PathBuf}; - -#[cfg(test)] -mod tests; - -const VERSION: &str = env!("CARGO_PKG_VERSION"); - -/// K9 Signing Tool - Ed25519 signatures for Hunt-level components -#[derive(Parser)] -#[command(name = "k9-sign")] -#[command(version = VERSION)] -#[command(about = "Ed25519 signing and verification for K9 components", long_about = None)] -struct Cli { - #[command(subcommand)] - command: Commands, -} - -#[derive(Subcommand)] -enum Commands { - /// Generate new Ed25519 keypair - Keygen { - /// Key name (default: primary) - #[arg(default_value = "primary")] - name: String, - }, - /// Sign a component file - Sign { - /// File to sign - file: PathBuf, - /// Key name to use (default: primary) - #[arg(default_value = "primary")] - key: String, - }, - /// Verify a component's signature - Verify { - /// File to verify - file: PathBuf, - }, - /// Full Hunt authorization check - Authorize { - /// File to authorize - file: PathBuf, - }, - /// Add public key to trusted keys - Trust { - /// Path to public key file - pubkey: PathBuf, - }, - /// Remove key from trusted keys - Untrust { - /// Key name to remove - name: String, - }, - /// List all keys - List, -} - -/// K9 key management directories -struct KeyDirs { - keys: PathBuf, - trusted: PathBuf, -} - -impl KeyDirs { - fn new() -> Result { - Self::with_config_dir(None) - } - - #[cfg(test)] - fn with_config_dir(config_dir: Option) -> Result { - let config = match config_dir { - Some(dir) => dir.join("k9"), - None => dirs::config_dir() - .context("Could not determine config directory")? - .join("k9"), - }; - - let keys = config.join("keys"); - let trusted = keys.join("trusted"); - - Ok(KeyDirs { keys, trusted }) - } - - #[cfg(not(test))] - fn with_config_dir(_config_dir: Option) -> Result { - Self::new() - } - - fn ensure_created(&self) -> Result<()> { - fs::create_dir_all(&self.keys).context("Failed to create keys directory")?; - fs::create_dir_all(&self.trusted).context("Failed to create trusted directory")?; - - // Set permissions to 700 (owner only) - #[cfg(unix)] - { - use std::os::unix::fs::PermissionsExt; - let perms = fs::Permissions::from_mode(0o700); - fs::set_permissions(&self.keys, perms).context("Failed to set directory permissions")?; - } - - Ok(()) - } - - fn private_key_path(&self, name: &str) -> PathBuf { - self.keys.join(format!("{}.key", name)) - } - - fn public_key_path(&self, name: &str) -> PathBuf { - self.keys.join(format!("{}.pub", name)) - } - - fn trusted_key_path(&self, name: &str) -> PathBuf { - self.trusted.join(format!("{}.pub", name)) - } -} - -/// Generate a new Ed25519 keypair -pub(crate) fn cmd_keygen(name: &str) -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - let privkey_path = dirs.private_key_path(name); - let pubkey_path = dirs.public_key_path(name); - - if privkey_path.exists() { - anyhow::bail!( - "Key '{}' already exists at {:?}\nDelete it first if you want to regenerate.", - name, - privkey_path - ); - } - - println!("K9: Generating Ed25519 keypair '{}'...", name); - - // Generate keypair using OS random number generator - let signing_key = SigningKey::generate(&mut OsRng); - let verifying_key = signing_key.verifying_key(); - - // Write private key (32 bytes raw) - fs::write(&privkey_path, signing_key.to_bytes()) - .context("Failed to write private key")?; - - // Set private key permissions to 600 (owner read/write only) - #[cfg(unix)] - { - use std::os::unix::fs::PermissionsExt; - let perms = fs::Permissions::from_mode(0o600); - fs::set_permissions(&privkey_path, perms) - .context("Failed to set private key permissions")?; - } - - // Write public key (32 bytes raw) - fs::write(&pubkey_path, verifying_key.to_bytes()) - .context("Failed to write public key")?; - - println!("K9: Keypair generated:"); - println!(" Private: {:?} (keep secret!)", privkey_path); - println!(" Public: {:?} (share this)", pubkey_path); - println!(); - println!("K9: To trust this key for verification:"); - println!(" k9-sign trust {:?}", pubkey_path); - - Ok(()) -} - -/// Sign a file with a private key -pub(crate) fn cmd_sign(file: &Path, key_name: &str) -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - if !file.exists() { - anyhow::bail!("File not found: {:?}", file); - } - - let privkey_path = dirs.private_key_path(key_name); - if !privkey_path.exists() { - anyhow::bail!( - "Private key not found: {:?}\nGenerate one with: k9-sign keygen {}", - privkey_path, - key_name - ); - } - - println!("K9: Signing {:?} with key '{}'...", file, key_name); - - // Read private key - let key_bytes = fs::read(&privkey_path).context("Failed to read private key")?; - let signing_key = SigningKey::from_bytes( - key_bytes - .as_slice() - .try_into() - .context("Invalid private key length")?, - ); - - // Read file to sign - let file_data = fs::read(file).context("Failed to read file to sign")?; - - // Create signature - let signature = signing_key.sign(&file_data); - - // Write binary signature (append .sig to filename) - let sig_path = PathBuf::from(format!("{}.sig", file.display())); - fs::write(&sig_path, signature.to_bytes()).context("Failed to write signature")?; - - // Create base64 version for embedding - let sig_b64 = BASE64.encode(signature.to_bytes()); - - println!("K9: Signature created: {:?}", sig_path); - println!(); - println!("K9: To embed in component, add to security section:"); - println!(" signature = \"{}\",", sig_b64); - println!(); - println!("K9: To verify:"); - println!(" k9-sign verify {:?}", file); - - Ok(()) -} - -/// Verify a file's signature against trusted keys -pub(crate) fn cmd_verify(file: &Path) -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - if !file.exists() { - anyhow::bail!("File not found: {:?}", file); - } - - let sig_path = PathBuf::from(format!("{}.sig", file.display())); - if !sig_path.exists() { - anyhow::bail!( - "Signature not found: {:?}\nSign the file first with: k9-sign sign {:?}", - sig_path, - file - ); - } - - // Read file and signature - let file_data = fs::read(file).context("Failed to read file")?; - let sig_bytes = fs::read(&sig_path).context("Failed to read signature")?; - let signature = Signature::from_bytes( - sig_bytes - .as_slice() - .try_into() - .context("Invalid signature length")?, - ); - - // Try each trusted key - let mut verified = false; - let trusted_keys = fs::read_dir(&dirs.trusted) - .context("Failed to read trusted keys directory")?; - - for entry in trusted_keys { - let entry = entry?; - let path = entry.path(); - - if path.extension().and_then(|s| s.to_str()) != Some("pub") { - continue; - } - - let key_name = path.file_stem().and_then(|s| s.to_str()).unwrap_or("unknown"); - - // Read public key - let pubkey_bytes = match fs::read(&path) { - Ok(bytes) => bytes, - Err(_) => continue, - }; - - let verifying_key = match VerifyingKey::from_bytes( - pubkey_bytes - .as_slice() - .try_into() - .unwrap_or(&[0u8; 32]), - ) { - Ok(key) => key, - Err(_) => continue, - }; - - // Try to verify - if verifying_key.verify(&file_data, &signature).is_ok() { - println!("K9: ✓ Signature VALID (key: {})", key_name); - verified = true; - break; - } - } - - if !verified { - eprintln!("K9: ✗ Signature INVALID or key not trusted"); - eprintln!(); - eprintln!("K9: Trusted keys in {:?}:", dirs.trusted); - - let trusted_keys = fs::read_dir(&dirs.trusted)?; - let mut found_any = false; - for entry in trusted_keys { - if let Ok(entry) = entry { - let path = entry.path(); - if path.extension().and_then(|s| s.to_str()) == Some("pub") { - if let Some(name) = path.file_stem().and_then(|s| s.to_str()) { - println!(" - {}", name); - found_any = true; - } - } - } - } - - if !found_any { - println!(" (none)"); - } - - anyhow::bail!("Signature verification failed"); - } - - Ok(()) -} - -/// Full Hunt authorization check -pub(crate) fn cmd_authorize(file: &Path) -> Result<()> { - println!("K9: Hunt Authorization for {:?}", file); - println!("─────────────────────────────────────"); - println!(); - - if !file.exists() { - anyhow::bail!("File not found: {:?}", file); - } - - // Read file to check security level - let content = fs::read_to_string(file).context("Failed to read file")?; - - if content.contains("leash = 'Hunt") || content.contains("trust_level.*'Hunt") { - println!("K9: Security level: 'Hunt (full execution)"); - } else { - println!("K9: This file is not Hunt-level. No authorization needed."); - return Ok(()); - } - - // Check for signature - let sig_path = PathBuf::from(format!("{}.sig", file.display())); - if !sig_path.exists() { - println!(); - println!("K9: ⚠️ No signature found."); - println!("K9: Sign the file first: k9-sign sign {:?}", file); - anyhow::bail!("Missing signature"); - } - - // Verify signature - println!(); - cmd_verify(file)?; - - println!(); - println!("K9: ✓ Component authorized for Hunt-level execution."); - println!("K9: You may now run its recipes."); - - Ok(()) -} - -/// Add a public key to trusted keys -pub(crate) fn cmd_trust(pubkey_path: &Path) -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - if !pubkey_path.exists() { - anyhow::bail!("Public key not found: {:?}", pubkey_path); - } - - // Validate it's a valid Ed25519 public key - let pubkey_bytes = fs::read(pubkey_path).context("Failed to read public key")?; - if pubkey_bytes.len() != 32 { - anyhow::bail!( - "Invalid public key size: {} bytes (expected 32)", - pubkey_bytes.len() - ); - } - - // Verify it's valid Ed25519 - VerifyingKey::from_bytes( - pubkey_bytes - .as_slice() - .try_into() - .context("Invalid public key")?, - ) - .context("Not a valid Ed25519 public key")?; - - let key_name = pubkey_path - .file_stem() - .and_then(|s| s.to_str()) - .context("Could not determine key name")?; - - let dest = dirs.trusted_key_path(key_name); - - fs::copy(pubkey_path, &dest).context("Failed to copy public key")?; - - println!("K9: Trusted key added: {}", key_name); - println!("K9: Location: {:?}", dest); - - Ok(()) -} - -/// Remove a key from trusted keys -pub(crate) fn cmd_untrust(name: &str) -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - let keyfile = dirs.trusted_key_path(name); - - if !keyfile.exists() { - anyhow::bail!("Trusted key not found: {}", name); - } - - fs::remove_file(&keyfile).context("Failed to remove key")?; - - println!("K9: Removed trusted key: {}", name); - - Ok(()) -} - -/// List all keys -pub(crate) fn cmd_list() -> Result<()> { - let dirs = KeyDirs::new()?; - dirs.ensure_created()?; - - println!("K9: Key Management"); - println!("─────────────────────────────────────"); - println!(); - println!("Your keys ({:?}):", dirs.keys); - - let mut found_keys = false; - if let Ok(entries) = fs::read_dir(&dirs.keys) { - for entry in entries { - if let Ok(entry) = entry { - let path = entry.path(); - if path.extension().and_then(|s| s.to_str()) == Some("key") { - if let Some(name) = path.file_stem().and_then(|s| s.to_str()) { - println!(" - {}", name); - found_keys = true; - } - } - } - } - } - - if !found_keys { - println!(" (none - run 'k9-sign keygen' to create)"); - } - - println!(); - println!("Trusted keys ({:?}):", dirs.trusted); - - let mut found_trusted = false; - if let Ok(entries) = fs::read_dir(&dirs.trusted) { - for entry in entries { - if let Ok(entry) = entry { - let path = entry.path(); - if path.extension().and_then(|s| s.to_str()) == Some("pub") { - if let Some(name) = path.file_stem().and_then(|s| s.to_str()) { - // Show key fingerprint - if let Ok(key_bytes) = fs::read(&path) { - let mut hasher = Sha256::new(); - hasher.update(&key_bytes); - let hash = hasher.finalize(); - let fp = hex::encode(&hash[..8]); - println!(" - {} (sha256:{}...)", name, fp); - found_trusted = true; - } - } - } - } - } - } - - if !found_trusted { - println!(" (none - run 'k9-sign trust ' to add)"); - } - - Ok(()) -} - -fn main() -> Result<()> { - let cli = Cli::parse(); - - match cli.command { - Commands::Keygen { name } => cmd_keygen(&name), - Commands::Sign { file, key } => cmd_sign(&file, &key), - Commands::Verify { file } => cmd_verify(&file), - Commands::Authorize { file } => cmd_authorize(&file), - Commands::Trust { pubkey } => cmd_trust(&pubkey), - Commands::Untrust { name } => cmd_untrust(&name), - Commands::List => cmd_list(), - } -} diff --git a/k9-svc/k9-sign/src/tests.rs b/k9-svc/k9-sign/src/tests.rs deleted file mode 100644 index a8ea1cba..00000000 --- a/k9-svc/k9-sign/src/tests.rs +++ /dev/null @@ -1,358 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -//! Comprehensive tests for k9-sign cryptographic operations - -#[cfg(test)] -mod tests { - use super::super::*; - use std::fs; - use tempfile::TempDir; - - /// Create a temporary test directory and KeyDirs for testing - fn setup_test_env() -> (TempDir, KeyDirs) { - let dir = TempDir::new().expect("Failed to create temp dir"); - let keys_dir = KeyDirs::with_config_dir(Some(dir.path().to_path_buf())) - .expect("Failed to create KeyDirs"); - keys_dir.ensure_created().expect("Failed to ensure dirs"); - (dir, keys_dir) - } - - /// Create a temporary test directory (deprecated, use setup_test_env) - fn setup_test_dir() -> TempDir { - TempDir::new().expect("Failed to create temp dir") - } - - /// Create a test file with content - fn create_test_file(dir: &TempDir, name: &str, content: &[u8]) -> PathBuf { - let path = dir.path().join(name); - fs::write(&path, content).expect("Failed to write test file"); - path - } - - #[test] - fn test_keygen_creates_keypair() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - // Override K9 directories for testing - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - let result = cmd_keygen(key_name); - assert!(result.is_ok(), "Keygen should succeed"); - - let keys_dir = dir.path().join("k9/keys"); - let privkey = keys_dir.join(format!("{}.key", key_name)); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - - assert!(privkey.exists(), "Private key should exist"); - assert!(pubkey.exists(), "Public key should exist"); - - // Check key sizes (Ed25519 is 32 bytes) - let priv_bytes = fs::read(&privkey).expect("Failed to read private key"); - let pub_bytes = fs::read(&pubkey).expect("Failed to read public key"); - - assert_eq!(priv_bytes.len(), 32, "Private key should be 32 bytes"); - assert_eq!(pub_bytes.len(), 32, "Public key should be 32 bytes"); - } - - #[test] - fn test_keygen_prevents_overwrite() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate once - cmd_keygen(key_name).expect("First keygen should succeed"); - - // Try to generate again - let result = cmd_keygen(key_name); - assert!(result.is_err(), "Second keygen should fail"); - } - - #[test] - fn test_sign_and_verify_roundtrip() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair - cmd_keygen(key_name).expect("Keygen failed"); - - // Create test file - let test_file = create_test_file(&dir, "test.txt", b"Test data for signing"); - - // Sign the file - let result = cmd_sign(&test_file, key_name); - assert!(result.is_ok(), "Sign should succeed"); - - // Check signature file exists - let sig_file = test_file.with_extension("txt.sig"); - assert!(sig_file.exists(), "Signature file should exist"); - - // Trust the key - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - cmd_trust(&pubkey).expect("Trust should succeed"); - - // Verify the signature - let result = cmd_verify(&test_file); - assert!(result.is_ok(), "Verify should succeed"); - } - - #[test] - fn test_verify_fails_with_wrong_signature() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair and trust it - cmd_keygen(key_name).expect("Keygen failed"); - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - cmd_trust(&pubkey).expect("Trust should succeed"); - - // Create and sign test file - let test_file = create_test_file(&dir, "test.txt", b"Original content"); - cmd_sign(&test_file, key_name).expect("Sign failed"); - - // Modify the file (breaks signature) - fs::write(&test_file, b"Modified content").expect("Failed to modify file"); - - // Verify should fail - let result = cmd_verify(&test_file); - assert!(result.is_err(), "Verify should fail for modified content"); - } - - #[test] - fn test_verify_fails_without_trusted_key() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair (but don't trust it) - cmd_keygen(key_name).expect("Keygen failed"); - - // Create and sign test file - let test_file = create_test_file(&dir, "test.txt", b"Test data"); - cmd_sign(&test_file, key_name).expect("Sign failed"); - - // Verify should fail (key not trusted) - let result = cmd_verify(&test_file); - assert!(result.is_err(), "Verify should fail without trusted key"); - } - - #[test] - fn test_trust_validates_key_size() { - let dir = setup_test_dir(); - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Create invalid key (wrong size) - let invalid_key = create_test_file(&dir, "invalid.pub", b"too short"); - - let result = cmd_trust(&invalid_key); - assert!(result.is_err(), "Trust should reject invalid key size"); - } - - #[test] - fn test_untrust_removes_key() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate and trust a key - cmd_keygen(key_name).expect("Keygen failed"); - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - cmd_trust(&pubkey).expect("Trust failed"); - - // Verify key is trusted - let trusted_dir = keys_dir.join("trusted"); - let trusted_key = trusted_dir.join(format!("{}.pub", key_name)); - assert!(trusted_key.exists(), "Trusted key should exist"); - - // Untrust the key - cmd_untrust(key_name).expect("Untrust failed"); - - // Verify key is removed - assert!(!trusted_key.exists(), "Trusted key should be removed"); - } - - #[test] - fn test_authorize_detects_hunt_level() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair and trust it - cmd_keygen(key_name).expect("Keygen failed"); - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - cmd_trust(&pubkey).expect("Trust should succeed"); - - // Create Hunt-level component - let hunt_content = b"K9!\nleash = 'Hunt\nsome config data"; - let hunt_file = create_test_file(&dir, "hunt.k9.ncl", hunt_content); - - // Sign it - cmd_sign(&hunt_file, key_name).expect("Sign failed"); - - // Authorize should succeed - let result = cmd_authorize(&hunt_file); - assert!(result.is_ok(), "Authorize should succeed for signed Hunt component"); - } - - #[test] - fn test_authorize_accepts_non_hunt_without_signature() { - let dir = setup_test_dir(); - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Create Kennel-level component (no signature needed) - let kennel_content = b"K9!\nleash = 'Kennel\nsome config data"; - let kennel_file = create_test_file(&dir, "kennel.k9.ncl", kennel_content); - - // Authorize should succeed without signature - let result = cmd_authorize(&kennel_file); - assert!(result.is_ok(), "Authorize should succeed for non-Hunt component"); - } - - #[test] - fn test_signature_is_deterministic() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair - cmd_keygen(key_name).expect("Keygen failed"); - - // Create test file - let test_file = create_test_file(&dir, "test.txt", b"Deterministic test"); - - // Sign twice - cmd_sign(&test_file, key_name).expect("First sign failed"); - let sig1 = fs::read(test_file.with_extension("txt.sig")).expect("Failed to read sig1"); - - fs::remove_file(test_file.with_extension("txt.sig")).expect("Failed to remove sig"); - - cmd_sign(&test_file, key_name).expect("Second sign failed"); - let sig2 = fs::read(test_file.with_extension("txt.sig")).expect("Failed to read sig2"); - - // Ed25519 signatures are deterministic - assert_eq!(sig1, sig2, "Signatures should be deterministic"); - } - - #[test] - fn test_different_keys_produce_different_signatures() { - let dir = setup_test_dir(); - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate two keypairs - cmd_keygen("key1").expect("Keygen 1 failed"); - cmd_keygen("key2").expect("Keygen 2 failed"); - - // Create test file - let test_file = create_test_file(&dir, "test.txt", b"Test data"); - - // Sign with first key - cmd_sign(&test_file, "key1").expect("Sign with key1 failed"); - let sig1 = fs::read(test_file.with_extension("txt.sig")).expect("Failed to read sig1"); - - // Sign with second key - fs::remove_file(test_file.with_extension("txt.sig")).expect("Failed to remove sig"); - cmd_sign(&test_file, "key2").expect("Sign with key2 failed"); - let sig2 = fs::read(test_file.with_extension("txt.sig")).expect("Failed to read sig2"); - - // Signatures should be different - assert_ne!(sig1, sig2, "Different keys should produce different signatures"); - } - - #[test] - fn test_list_shows_keys() { - let dir = setup_test_dir(); - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate some keys - cmd_keygen("key1").expect("Keygen failed"); - cmd_keygen("key2").expect("Keygen failed"); - - // Trust one of them - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join("key1.pub"); - cmd_trust(&pubkey).expect("Trust failed"); - - // List should succeed (we can't easily test output, but verify it doesn't panic) - let result = cmd_list(); - assert!(result.is_ok(), "List should succeed"); - } - - #[test] - fn test_private_key_permissions_are_restricted() { - #[cfg(unix)] - { - use std::os::unix::fs::PermissionsExt; - - let dir = setup_test_dir(); - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - cmd_keygen("test-key").expect("Keygen failed"); - - let keys_dir = dir.path().join("k9/keys"); - let privkey = keys_dir.join("test-key.key"); - - let metadata = fs::metadata(&privkey).expect("Failed to get metadata"); - let mode = metadata.permissions().mode(); - - // Check that only owner can read/write (0o600) - assert_eq!(mode & 0o777, 0o600, "Private key should have 0o600 permissions"); - } - } - - #[test] - fn test_empty_file_can_be_signed_and_verified() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - // Generate keypair and trust it - cmd_keygen(key_name).expect("Keygen failed"); - let keys_dir = dir.path().join("k9/keys"); - let pubkey = keys_dir.join(format!("{}.pub", key_name)); - cmd_trust(&pubkey).expect("Trust should succeed"); - - // Create empty file - let test_file = create_test_file(&dir, "empty.txt", b""); - - // Sign and verify - cmd_sign(&test_file, key_name).expect("Sign empty file failed"); - let result = cmd_verify(&test_file); - assert!(result.is_ok(), "Verify empty file should succeed"); - } - - #[test] - fn test_large_file_can_be_signed() { - let dir = setup_test_dir(); - let key_name = "test-key"; - - std::env::set_var("XDG_CONFIG_HOME", dir.path()); - - cmd_keygen(key_name).expect("Keygen failed"); - - // Create 1MB file - let large_data = vec![0xAA; 1024 * 1024]; - let test_file = create_test_file(&dir, "large.bin", &large_data); - - // Sign should handle large files - let result = cmd_sign(&test_file, key_name); - assert!(result.is_ok(), "Sign should handle large files"); - - // Signature should still be 64 bytes - let sig = fs::read(test_file.with_extension("bin.sig")).expect("Failed to read sig"); - assert_eq!(sig.len(), 64, "Signature should be 64 bytes regardless of file size"); - } -} diff --git a/k9-svc/lsp/Cargo.lock b/k9-svc/lsp/Cargo.lock deleted file mode 100644 index 26cdf215..00000000 --- a/k9-svc/lsp/Cargo.lock +++ /dev/null @@ -1,882 +0,0 @@ -# This file is automatically @generated by Cargo. -# It is not intended for manual editing. -version = 4 - -[[package]] -name = "aho-corasick" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301" -dependencies = [ - "memchr", -] - -[[package]] -name = "async-trait" -version = "0.1.89" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "auto_impl" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ffdcb70bdbc4d478427380519163274ac86e52916e10f0a8889adf0f96d3fee7" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "bitflags" -version = "1.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a" - -[[package]] -name = "bitflags" -version = "2.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" - -[[package]] -name = "bytes" -version = "1.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33" - -[[package]] -name = "cfg-if" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" - -[[package]] -name = "dashmap" -version = "5.5.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856" -dependencies = [ - "cfg-if", - "hashbrown", - "lock_api", - "once_cell", - "parking_lot_core", -] - -[[package]] -name = "displaydoc" -version = "0.2.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "errno" -version = "0.3.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" -dependencies = [ - "libc", - "windows-sys", -] - -[[package]] -name = "form_urlencoded" -version = "1.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf" -dependencies = [ - "percent-encoding", -] - -[[package]] -name = "futures" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d" -dependencies = [ - "futures-channel", - "futures-core", - "futures-io", - "futures-sink", - "futures-task", - "futures-util", -] - -[[package]] -name = "futures-channel" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d" -dependencies = [ - "futures-core", - "futures-sink", -] - -[[package]] -name = "futures-core" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d" - -[[package]] -name = "futures-io" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718" - -[[package]] -name = "futures-macro" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e835b70203e41293343137df5c0664546da5745f82ec9b84d40be8336958447b" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "futures-sink" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893" - -[[package]] -name = "futures-task" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393" - -[[package]] -name = "futures-util" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6" -dependencies = [ - "futures-channel", - "futures-core", - "futures-io", - "futures-macro", - "futures-sink", - "futures-task", - "memchr", - "pin-project-lite", - "slab", -] - -[[package]] -name = "hashbrown" -version = "0.14.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1" - -[[package]] -name = "httparse" -version = "1.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87" - -[[package]] -name = "icu_collections" -version = "2.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43" -dependencies = [ - "displaydoc", - "potential_utf", - "yoke", - "zerofrom", - "zerovec", -] - -[[package]] -name = "icu_locale_core" -version = "2.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6" -dependencies = [ - "displaydoc", - "litemap", - "tinystr", - "writeable", - "zerovec", -] - -[[package]] -name = "icu_normalizer" -version = "2.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599" -dependencies = [ - "icu_collections", - "icu_normalizer_data", - "icu_properties", - "icu_provider", - "smallvec", - "zerovec", -] - -[[package]] -name = "icu_normalizer_data" -version = "2.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a" - -[[package]] -name = "icu_properties" -version = "2.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec" -dependencies = [ - "icu_collections", - "icu_locale_core", - "icu_properties_data", - "icu_provider", - "zerotrie", - "zerovec", -] - -[[package]] -name = "icu_properties_data" -version = "2.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af" - -[[package]] -name = "icu_provider" -version = "2.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614" -dependencies = [ - "displaydoc", - "icu_locale_core", - "writeable", - "yoke", - "zerofrom", - "zerotrie", - "zerovec", -] - -[[package]] -name = "idna" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de" -dependencies = [ - "idna_adapter", - "smallvec", - "utf8_iter", -] - -[[package]] -name = "idna_adapter" -version = "1.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344" -dependencies = [ - "icu_normalizer", - "icu_properties", -] - -[[package]] -name = "itoa" -version = "1.0.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2" - -[[package]] -name = "k9-lsp" -version = "0.1.0" -dependencies = [ - "regex", - "serde", - "serde_json", - "tokio", - "tower-lsp", -] - -[[package]] -name = "libc" -version = "0.2.183" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d" - -[[package]] -name = "litemap" -version = "0.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77" - -[[package]] -name = "lock_api" -version = "0.4.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "224399e74b87b5f3557511d98dff8b14089b3dadafcab6bb93eab67d3aace965" -dependencies = [ - "scopeguard", -] - -[[package]] -name = "lsp-types" -version = "0.94.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c66bfd44a06ae10647fe3f8214762e9369fd4248df1350924b4ef9e770a85ea1" -dependencies = [ - "bitflags 1.3.2", - "serde", - "serde_json", - "serde_repr", - "url", -] - -[[package]] -name = "memchr" -version = "2.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" - -[[package]] -name = "mio" -version = "1.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a69bcab0ad47271a0234d9422b131806bf3968021e5dc9328caf2d4cd58557fc" -dependencies = [ - "libc", - "wasi", - "windows-sys", -] - -[[package]] -name = "once_cell" -version = "1.21.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" - -[[package]] -name = "parking_lot" -version = "0.12.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93857453250e3077bd71ff98b6a65ea6621a19bb0f559a85248955ac12c45a1a" -dependencies = [ - "lock_api", - "parking_lot_core", -] - -[[package]] -name = "parking_lot_core" -version = "0.9.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2621685985a2ebf1c516881c026032ac7deafcda1a2c9b7850dc81e3dfcb64c1" -dependencies = [ - "cfg-if", - "libc", - "redox_syscall", - "smallvec", - "windows-link", -] - -[[package]] -name = "percent-encoding" -version = "2.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" - -[[package]] -name = "pin-project" -version = "1.1.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f1749c7ed4bcaf4c3d0a3efc28538844fb29bcdd7d2b67b2be7e20ba861ff517" -dependencies = [ - "pin-project-internal", -] - -[[package]] -name = "pin-project-internal" -version = "1.1.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9b20ed30f105399776b9c883e68e536ef602a16ae6f596d2c473591d6ad64c6" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "pin-project-lite" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd" - -[[package]] -name = "potential_utf" -version = "0.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77" -dependencies = [ - "zerovec", -] - -[[package]] -name = "proc-macro2" -version = "1.0.106" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "quote" -version = "1.0.45" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" -dependencies = [ - "proc-macro2", -] - -[[package]] -name = "redox_syscall" -version = "0.5.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d" -dependencies = [ - "bitflags 2.11.0", -] - -[[package]] -name = "regex" -version = "1.12.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276" -dependencies = [ - "aho-corasick", - "memchr", - "regex-automata", - "regex-syntax", -] - -[[package]] -name = "regex-automata" -version = "0.4.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f" -dependencies = [ - "aho-corasick", - "memchr", - "regex-syntax", -] - -[[package]] -name = "regex-syntax" -version = "0.8.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a" - -[[package]] -name = "scopeguard" -version = "1.2.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49" - -[[package]] -name = "serde" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" -dependencies = [ - "serde_core", - "serde_derive", -] - -[[package]] -name = "serde_core" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" -dependencies = [ - "serde_derive", -] - -[[package]] -name = "serde_derive" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "serde_json" -version = "1.0.149" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86" -dependencies = [ - "itoa", - "memchr", - "serde", - "serde_core", - "zmij", -] - -[[package]] -name = "serde_repr" -version = "0.1.20" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "175ee3e80ae9982737ca543e96133087cbd9a485eecc3bc4de9c1a37b47ea59c" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "signal-hook-registry" -version = "1.4.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c4db69cba1110affc0e9f7bcd48bbf87b3f4fc7c61fc9155afd4c469eb3d6c1b" -dependencies = [ - "errno", - "libc", -] - -[[package]] -name = "slab" -version = "0.4.12" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5" - -[[package]] -name = "smallvec" -version = "1.15.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03" - -[[package]] -name = "socket2" -version = "0.6.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e" -dependencies = [ - "libc", - "windows-sys", -] - -[[package]] -name = "stable_deref_trait" -version = "1.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596" - -[[package]] -name = "syn" -version = "2.0.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" -dependencies = [ - "proc-macro2", - "quote", - "unicode-ident", -] - -[[package]] -name = "synstructure" -version = "0.13.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "tinystr" -version = "0.8.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869" -dependencies = [ - "displaydoc", - "zerovec", -] - -[[package]] -name = "tokio" -version = "1.50.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "27ad5e34374e03cfffefc301becb44e9dc3c17584f414349ebe29ed26661822d" -dependencies = [ - "bytes", - "libc", - "mio", - "parking_lot", - "pin-project-lite", - "signal-hook-registry", - "socket2", - "tokio-macros", - "windows-sys", -] - -[[package]] -name = "tokio-macros" -version = "2.6.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5c55a2eff8b69ce66c84f85e1da1c233edc36ceb85a2058d11b0d6a3c7e7569c" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "tokio-util" -version = "0.7.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098" -dependencies = [ - "bytes", - "futures-core", - "futures-sink", - "pin-project-lite", - "tokio", -] - -[[package]] -name = "tower" -version = "0.4.13" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c" -dependencies = [ - "futures-core", - "futures-util", - "pin-project", - "pin-project-lite", - "tower-layer", - "tower-service", -] - -[[package]] -name = "tower-layer" -version = "0.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e" - -[[package]] -name = "tower-lsp" -version = "0.20.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d4ba052b54a6627628d9b3c34c176e7eda8359b7da9acd497b9f20998d118508" -dependencies = [ - "async-trait", - "auto_impl", - "bytes", - "dashmap", - "futures", - "httparse", - "lsp-types", - "memchr", - "serde", - "serde_json", - "tokio", - "tokio-util", - "tower", - "tower-lsp-macros", - "tracing", -] - -[[package]] -name = "tower-lsp-macros" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "84fd902d4e0b9a4b27f2f440108dc034e1758628a9b702f8ec61ad66355422fa" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "tower-service" -version = "0.3.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3" - -[[package]] -name = "tracing" -version = "0.1.44" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100" -dependencies = [ - "pin-project-lite", - "tracing-attributes", - "tracing-core", -] - -[[package]] -name = "tracing-attributes" -version = "0.1.31" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "tracing-core" -version = "0.1.36" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a" -dependencies = [ - "once_cell", -] - -[[package]] -name = "unicode-ident" -version = "1.0.24" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" - -[[package]] -name = "url" -version = "2.5.8" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed" -dependencies = [ - "form_urlencoded", - "idna", - "percent-encoding", - "serde", - "serde_derive", -] - -[[package]] -name = "utf8_iter" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be" - -[[package]] -name = "wasi" -version = "0.11.1+wasi-snapshot-preview1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" - -[[package]] -name = "windows-link" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" - -[[package]] -name = "windows-sys" -version = "0.61.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" -dependencies = [ - "windows-link", -] - -[[package]] -name = "writeable" -version = "0.6.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9" - -[[package]] -name = "yoke" -version = "0.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954" -dependencies = [ - "stable_deref_trait", - "yoke-derive", - "zerofrom", -] - -[[package]] -name = "yoke-derive" -version = "0.8.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d" -dependencies = [ - "proc-macro2", - "quote", - "syn", - "synstructure", -] - -[[package]] -name = "zerofrom" -version = "0.1.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5" -dependencies = [ - "zerofrom-derive", -] - -[[package]] -name = "zerofrom-derive" -version = "0.1.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502" -dependencies = [ - "proc-macro2", - "quote", - "syn", - "synstructure", -] - -[[package]] -name = "zerotrie" -version = "0.2.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851" -dependencies = [ - "displaydoc", - "yoke", - "zerofrom", -] - -[[package]] -name = "zerovec" -version = "0.11.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002" -dependencies = [ - "yoke", - "zerofrom", - "zerovec-derive", -] - -[[package]] -name = "zerovec-derive" -version = "0.11.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "zmij" -version = "1.0.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" diff --git a/k9-svc/lsp/Cargo.toml b/k9-svc/lsp/Cargo.toml deleted file mode 100644 index 3c83dbde..00000000 --- a/k9-svc/lsp/Cargo.toml +++ /dev/null @@ -1,30 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cargo.toml — K9 Language Server Protocol (LSP) server -# -# Provides diagnostics (linting), completions, and hover documentation -# for .k9 and .k9.ncl files (K9 Self-Validating Components). - -[package] -name = "k9-lsp" -version = "0.1.0" -edition = "2021" -authors = ["Jonathan D.A. Jewell "] -license = "AGPL-3.0-or-later" -description = "Language Server Protocol server for K9 Self-Validating Components" -repository = "https://github.com/hyperpolymath/standards" -homepage = "https://github.com/hyperpolymath/standards/tree/main/k9-svc/lsp" -readme = "README.adoc" -keywords = ["k9", "lsp", "nickel", "svc", "language-server"] -categories = ["development-tools", "text-editors"] - -[dependencies] -tower-lsp = "0.20" -tokio = { version = "1", features = ["full"] } -serde = { version = "1", features = ["derive"] } -serde_json = "1" -regex = "1" - -[[bin]] -name = "k9-lsp" -path = "src/main.rs" diff --git a/k9-svc/lsp/README.adoc b/k9-svc/lsp/README.adoc deleted file mode 100644 index 29a8b983..00000000 --- a/k9-svc/lsp/README.adoc +++ /dev/null @@ -1,147 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= K9 LSP Server -:author: Jonathan D.A. Jewell -:revdate: 2026-03-16 -:toc: left -:toclevels: 2 -:icons: font -:source-highlighter: rouge - -Language Server Protocol (LSP) server for K9 Self-Validating Component files -(`.k9` and `.k9.ncl`). - -== Overview - -The K9 LSP server provides real-time feedback when editing K9 files in any -LSP-compatible editor (VS Code, Neovim, Helix, Emacs, etc.). It communicates -over stdio using JSON-RPC, the standard LSP transport. - -=== Features - -Diagnostics (linting):: -Ten diagnostic rules covering magic numbers, SPDX headers, security level -validation, pedigree completeness, Nickel syntax, and recipe hygiene. - -Completions:: -Context-aware completions for pedigree fields, security settings, trust level -values, recipe names, and Nickel standard library imports. - -Hover:: -Documentation on hover for security levels, pedigree fields, and contract types. - -== Building - -[source,bash] ----- -cd lsp/ -cargo build --release ----- - -The binary is produced at `target/release/k9-lsp`. - -== Usage - -The LSP server is designed to be launched by your editor, not run directly. - -=== VS Code - -See the link:../editors/vscode/[VS Code extension] for integration. Add to -your `settings.json`: - -[source,json] ----- -{ - "k9.lsp.path": "/path/to/k9-lsp" -} ----- - -=== Neovim (nvim-lspconfig) - -[source,lua] ----- -local lspconfig = require('lspconfig') -local configs = require('lspconfig.configs') - -configs.k9_lsp = { - default_config = { - cmd = { '/path/to/k9-lsp' }, - filetypes = { 'k9', 'nickel' }, - root_dir = lspconfig.util.root_pattern('pedigree.ncl', 'Justfile', '.git'), - settings = {}, - }, -} - -lspconfig.k9_lsp.setup({}) ----- - -=== Helix - -Add to `~/.config/helix/languages.toml`: - -[source,toml] ----- -[[language]] -name = "k9" -scope = "source.k9" -file-types = ["k9", "k9.ncl"] -language-servers = ["k9-lsp"] - -[language-server.k9-lsp] -command = "/path/to/k9-lsp" ----- - -== Diagnostics Reference - -[cols="1,1,2,1"] -|=== -| Code | Severity | Description | Trigger - -| K9-D001 | Warning | Missing K9! magic number | No `K9!` or `magic_number` in file -| K9-D002 | Warning | Missing SPDX header | No `SPDX-License-Identifier` in first 10 lines -| K9-D003 | Error | Invalid security level | `trust_level` is not 'Kennel, 'Yard, or 'Hunt -| K9-D004 | Warning | Security level mismatch | `'Hunt` declared but no `signature` field -| K9-D005 | Error | Missing pedigree fields | `name` or `version` absent from pedigree -| K9-D006 | Error | Unclosed Nickel records | Unbalanced `{` / `}` -| K9-D007 | Warning | Invalid contract annotation | `\|` followed by unrecognised type -| K9-D008 | Info | Non-standard recipe tool | Recipe command uses unknown executable -| K9-D009 | Warning | Hunt without subprocess | `'Hunt` but `allow_subprocess` not `true` -| K9-D010 | Info | Deprecated Kennel YAML syntax | YAML-style `key: value` instead of `key = value` -|=== - -== Related Resources - -K9 Specification:: -link:../SPEC.adoc[SPEC.adoc] — The full K9 SVC specification. - -Pedigree Contract:: -link:../pedigree.ncl[pedigree.ncl] — The Nickel contract defining component structure. - -Pandoc Adapters:: -link:../pandoc/README.adoc[pandoc/README.adoc] — Pandoc reader/writer for K9 files. - -TextMate Grammar:: -link:../editors/k9.tmLanguage.json[editors/k9.tmLanguage.json] — Syntax highlighting grammar. - -Notepad++ UDL:: -link:../editors/k9-notepadpp.xml[editors/k9-notepadpp.xml] — Notepad++ User Defined Language. - -VS Code Extension:: -link:../editors/vscode/[editors/vscode/] — VS Code extension for K9 files. - -== Architecture - -[source] ----- -lsp/ -├── Cargo.toml # Workspace-independent build configuration -├── README.adoc # This file -└── src/ - ├── main.rs # Entry point, stdio transport, LSP trait impl - ├── diagnostics.rs # 10 diagnostic checks (K9-D001 through K9-D010) - ├── completions.rs # Context-aware completion provider - └── hover.rs # Hover documentation provider ----- - -== License - -PMPL-1.0-or-later. See link:../LICENSE[LICENSE]. diff --git a/k9-svc/lsp/src/completions.rs b/k9-svc/lsp/src/completions.rs deleted file mode 100644 index 383af80b..00000000 --- a/k9-svc/lsp/src/completions.rs +++ /dev/null @@ -1,292 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// -// completions.rs — K9 completion provider -// -// Provides context-aware completions for: -// 1. Pedigree fields (name, version, description, author, spdx_license) -// 2. Security fields (trust_level, allow_network, etc.) -// 3. Trust level values ('Kennel, 'Yard, 'Hunt) after trust_level = -// 4. Recipe names (install, validate, deploy, migrate, rollback) -// 5. Nickel standard library imports (std.contract, std.string, etc.) - -use tower_lsp::lsp_types::*; - -/// Get the line at the given position from the document text. -/// -/// Returns the line content and the character offset of the cursor within it. -fn line_at(text: &str, position: Position) -> Option<(&str, usize)> { - let line_idx = position.line as usize; - let col = position.character as usize; - text.lines().nth(line_idx).map(|l| (l, col)) -} - -/// Determine the completion context and return appropriate items. -/// -/// Analyses the current line to decide which category of completions -/// to offer: trust level values, pedigree fields, security fields, -/// recipe names, or Nickel imports. -pub fn complete(text: &str, position: Position) -> Vec { - let (line, col) = match line_at(text, position) { - Some(v) => v, - None => return Vec::new(), - }; - - let prefix = &line[..col.min(line.len())]; - - // Context: after trust_level = → offer trust level values. - if prefix.contains("trust_level") && prefix.contains('=') { - return trust_level_completions(); - } - - // Context: after "import" or starts with "import" → Nickel std imports. - if prefix.trim_start().starts_with("import") || prefix.contains("std.") { - return nickel_import_completions(); - } - - // Context: inside a security block (heuristic: line has security-related prefix). - if is_in_block(text, position, "security") { - return security_field_completions(); - } - - // Context: inside a recipes block. - if is_in_block(text, position, "recipes") { - return recipe_completions(); - } - - // Context: inside a metadata block or at top level → pedigree fields. - if is_in_block(text, position, "metadata") { - return pedigree_field_completions(); - } - - // Default: offer all top-level completions. - let mut items = Vec::new(); - items.extend(pedigree_field_completions()); - items.extend(security_field_completions()); - items.extend(recipe_completions()); - items -} - -/// Heuristic check: is the cursor inside a block named `block_name`? -/// -/// Scans backwards from the cursor position looking for `block_name = {` -/// or `block_name = {\n` and checks that the brace depth indicates we -/// are still inside that block. -fn is_in_block(text: &str, position: Position, block_name: &str) -> bool { - let lines: Vec<&str> = text.lines().collect(); - let cursor_line = position.line as usize; - let mut depth: i32 = 0; - - // Scan backwards from cursor line. - for i in (0..=cursor_line.min(lines.len().saturating_sub(1))).rev() { - let line = lines[i]; - let trimmed = line.trim(); - - // Skip comments. - if trimmed.starts_with('#') { - continue; - } - - // Count braces (simplified — does not handle strings). - for ch in line.chars().rev() { - match ch { - '}' => depth += 1, - '{' => depth -= 1, - _ => {} - } - } - - // If we found an opening brace that matches our block name, we're inside it. - if depth < 0 && trimmed.contains(block_name) && trimmed.contains('=') { - return true; - } - } - - false -} - -// ───────────────────────────────────────────────────────────────────── -// Completion item builders -// ───────────────────────────────────────────────────────────────────── - -/// Pedigree / metadata field completions. -fn pedigree_field_completions() -> Vec { - vec![ - make_field_completion( - "name", - "Component name (lowercase, hyphenated)", - "name = \"${1:my-component}\",", - ), - make_field_completion( - "version", - "SemVer version with optional stability suffix", - "version = \"${1:1.0.0-alpha}\",", - ), - make_field_completion( - "description", - "Human-readable component purpose", - "description = \"${1:A K9 component}\",", - ), - make_field_completion( - "author", - "Component author name and email", - "author = \"${1:Jonathan D.A. Jewell }\",", - ), - make_field_completion( - "spdx_license", - "SPDX license identifier for the component", - "spdx_license = \"${1:PMPL-1.0-or-later}\",", - ), - ] -} - -/// Security field completions. -fn security_field_completions() -> Vec { - vec![ - make_field_completion( - "trust_level", - "Execution permission tier: 'Kennel, 'Yard, or 'Hunt", - "trust_level = ${1:'Yard},", - ), - make_field_completion( - "allow_network", - "Whether the component can fetch external resources", - "allow_network = ${1:false},", - ), - make_field_completion( - "allow_filesystem_write", - "Whether the component can modify the host filesystem", - "allow_filesystem_write = ${1:false},", - ), - make_field_completion( - "allow_subprocess", - "Whether the component can spawn child processes", - "allow_subprocess = ${1:false},", - ), - make_field_completion( - "signature", - "Cryptographic handshake for Hunt level (required for 'Hunt)", - "signature = \"${1}\",", - ), - ] -} - -/// Trust level value completions. -fn trust_level_completions() -> Vec { - vec![ - CompletionItem { - label: "'Kennel".to_string(), - kind: Some(CompletionItemKind::ENUM_MEMBER), - detail: Some("Pure data — no execution, read-only, safe anywhere".to_string()), - documentation: Some(Documentation::MarkupContent(MarkupContent { - kind: MarkupKind::Markdown, - value: "**Kennel** — Pure Data\n\n\ - No execution permitted. Read-only access. Safe to open \ - on any platform including constrained environments (Edge, ASIC)." - .to_string(), - })), - insert_text: Some("'Kennel".to_string()), - insert_text_format: Some(InsertTextFormat::PLAIN_TEXT), - ..Default::default() - }, - CompletionItem { - label: "'Yard".to_string(), - kind: Some(CompletionItemKind::ENUM_MEMBER), - detail: Some("Validation only — Nickel evaluation, no I/O".to_string()), - documentation: Some(Documentation::MarkupContent(MarkupContent { - kind: MarkupKind::Markdown, - value: "**Yard** — Validation Only\n\n\ - Nickel evaluation is permitted for contract checking. \ - No filesystem, network, or subprocess access." - .to_string(), - })), - insert_text: Some("'Yard".to_string()), - insert_text_format: Some(InsertTextFormat::PLAIN_TEXT), - ..Default::default() - }, - CompletionItem { - label: "'Hunt".to_string(), - kind: Some(CompletionItemKind::ENUM_MEMBER), - detail: Some("Full execution — requires cryptographic handshake".to_string()), - documentation: Some(Documentation::MarkupContent(MarkupContent { - kind: MarkupKind::Markdown, - value: "**Hunt** — Full Execution\n\n\ - Complete must-just-nickel triad execution. Requires a valid \ - cryptographic handshake via the `signature` field. Can access \ - network, filesystem, and spawn subprocesses." - .to_string(), - })), - insert_text: Some("'Hunt".to_string()), - insert_text_format: Some(InsertTextFormat::PLAIN_TEXT), - ..Default::default() - }, - ] -} - -/// Recipe name completions. -fn recipe_completions() -> Vec { - vec![ - make_field_completion( - "install", - "Installation recipe — runs during component setup", - "install = \"${1:just install}\",", - ), - make_field_completion( - "validate", - "Self-validation recipe — checks component integrity", - "validate = \"${1:just validate}\",", - ), - make_field_completion( - "deploy", - "Deployment recipe — Podman or native deployment", - "deploy = \"${1:just deploy}\",", - ), - make_field_completion( - "migrate", - "Version migration recipe — zero-deprecation upgrade", - "migrate = \"${1:just migrate}\",", - ), - make_field_completion( - "rollback", - "Rollback recipe — revert to previous version", - "rollback = \"${1:just rollback}\",", - ), - ] -} - -/// Nickel standard library import completions. -fn nickel_import_completions() -> Vec { - let imports = [ - ("std.contract", "Contract combinators and utilities"), - ("std.string", "String manipulation functions"), - ("std.number", "Numeric operations"), - ("std.array", "Array/list operations"), - ("std.record", "Record manipulation functions"), - ("std.function", "Function combinators"), - ("std.io", "I/O operations (restricted by security level)"), - ("std.enum", "Enum tag utilities"), - ]; - - imports - .iter() - .map(|(name, desc)| CompletionItem { - label: name.to_string(), - kind: Some(CompletionItemKind::MODULE), - detail: Some(desc.to_string()), - insert_text: Some(format!("import \"{}\"", name)), - insert_text_format: Some(InsertTextFormat::PLAIN_TEXT), - ..Default::default() - }) - .collect() -} - -/// Helper to build a field completion item with snippet insertion. -fn make_field_completion(label: &str, detail: &str, snippet: &str) -> CompletionItem { - CompletionItem { - label: label.to_string(), - kind: Some(CompletionItemKind::FIELD), - detail: Some(detail.to_string()), - insert_text: Some(snippet.to_string()), - insert_text_format: Some(InsertTextFormat::SNIPPET), - ..Default::default() - } -} diff --git a/k9-svc/lsp/src/diagnostics.rs b/k9-svc/lsp/src/diagnostics.rs deleted file mode 100644 index cda1f6eb..00000000 --- a/k9-svc/lsp/src/diagnostics.rs +++ /dev/null @@ -1,558 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// -// diagnostics.rs — K9 diagnostic checks (linting) -// -// Implements 10 diagnostic rules for K9 Self-Validating Component files: -// -// 1. Missing K9! magic number → warning (K9-D001) -// 2. Missing SPDX header → warning (K9-D002) -// 3. Invalid security level → error (K9-D003) -// 4. Security level mismatch → warning (K9-D004) -// 5. Missing pedigree fields (name/version) → error (K9-D005) -// 6. Unclosed Nickel records → error (K9-D006) -// 7. Invalid contract annotations → warning (K9-D007) -// 8. Non-standard recipe tool references → info (K9-D008) -// 9. Hunt without allow_subprocess=true → warning (K9-D009) -// 10. Deprecated Kennel YAML syntax → info (K9-D010) - -use std::sync::LazyLock; -use regex::Regex; -use tower_lsp::lsp_types::*; - -// Literal patterns, compiled once. -// -// These were built by calling Regex::new on a literal and unwrapping the -// result, inside the functions below. -// An LSP recompiles those on EVERY request — every keystroke — and `unwrap` -// panics the handler task if a literal is ever malformed. `LazyLock` compiles -// each pattern once, and `expect` states the invariant: the pattern is a -// compile-time constant, so a failure is a programming error, not a runtime -// condition. -static TRUST_LEVEL_RE: LazyLock = - LazyLock::new(|| Regex::new(r"trust_level\s*=\s*'(\w+)").expect("TRUST_LEVEL_RE is a valid literal pattern")); - -static ENUM_RE: LazyLock = - LazyLock::new(|| Regex::new(r"\[\|\s*((?:'[A-Za-z]+\s*,?\s*)*)\|]").expect("ENUM_RE is a valid literal pattern")); - -static VARIANT_RE: LazyLock = - LazyLock::new(|| Regex::new(r"\|\s+([a-zA-Z_]\w*)").expect("VARIANT_RE is a valid literal pattern")); - -static RECIPE_RE: LazyLock = - LazyLock::new(|| Regex::new(r#"(install|validate|deploy|migrate|rollback)\s*=\s*"([^"]*)""#).expect("RECIPE_RE is a valid literal pattern")); - -static YAML_RE: LazyLock = - LazyLock::new(|| Regex::new(r"^\s*([a-z_]+)\s*:\s+\S").expect("YAML_RE is a valid literal pattern")); - - -/// Source identifier attached to all K9 diagnostics. -const SOURCE: &str = "k9-lsp"; - -/// Run all diagnostic checks against the given document text. -/// -/// Returns a vector of LSP `Diagnostic` items ready to be published. -pub fn diagnose(text: &str) -> Vec { - let mut diags = Vec::new(); - let lines: Vec<&str> = text.lines().collect(); - - check_magic_number(text, &lines, &mut diags); - check_spdx_header(text, &lines, &mut diags); - check_invalid_security_level(text, &lines, &mut diags); - check_security_level_mismatch(text, &lines, &mut diags); - check_missing_pedigree_fields(text, &lines, &mut diags); - check_unclosed_records(text, &lines, &mut diags); - check_invalid_contract_annotations(text, &lines, &mut diags); - check_nonstandard_recipe_tools(text, &lines, &mut diags); - check_hunt_without_subprocess(text, &lines, &mut diags); - check_deprecated_kennel_yaml(text, &lines, &mut diags); - - diags -} - -// ───────────────────────────────────────────────────────────────────── -// D001: Missing K9! magic number -// ───────────────────────────────────────────────────────────────────── - -/// Every .k9 file should begin with the `K9!` magic number (possibly after -/// comments/SPDX headers). Warns if it is absent anywhere in the file. -fn check_magic_number(text: &str, _lines: &[&str], diags: &mut Vec) { - if !text.contains("K9!") && !text.contains("magic_number") { - diags.push(Diagnostic { - range: Range::new(Position::new(0, 0), Position::new(0, 0)), - severity: Some(DiagnosticSeverity::WARNING), - code: Some(NumberOrString::String("K9-D001".to_string())), - source: Some(SOURCE.to_string()), - message: "Missing K9! magic number. K9 files should contain the \ - magic number 'K9!' or reference magic_number in their pedigree." - .to_string(), - ..Default::default() - }); - } -} - -// ───────────────────────────────────────────────────────────────────── -// D002: Missing SPDX header -// ───────────────────────────────────────────────────────────────────── - -/// Checks that the file contains an SPDX-License-Identifier comment. -fn check_spdx_header(_text: &str, lines: &[&str], diags: &mut Vec) { - // Look in the first 10 lines for an SPDX header. - let has_spdx = lines - .iter() - .take(10) - .any(|l| l.contains("SPDX-License-Identifier")); - - if !has_spdx { - diags.push(Diagnostic { - range: Range::new(Position::new(0, 0), Position::new(0, 0)), - severity: Some(DiagnosticSeverity::WARNING), - code: Some(NumberOrString::String("K9-D002".to_string())), - source: Some(SOURCE.to_string()), - message: "Missing SPDX-License-Identifier header. Add a comment like: \ - # SPDX-License-Identifier: AGPL-3.0-or-later" - .to_string(), - ..Default::default() - }); - } -} - -// ───────────────────────────────────────────────────────────────────── -// D003: Invalid security level -// ───────────────────────────────────────────────────────────────────── - -/// Security levels must be one of 'Kennel, 'Yard, or 'Hunt. -/// Flags any trust_level assignment using an unrecognised value. -fn check_invalid_security_level(text: &str, lines: &[&str], diags: &mut Vec) { - let re = &*TRUST_LEVEL_RE; - for (i, line) in lines.iter().enumerate() { - if let Some(caps) = re.captures(line) { - // One binding, not three lookups; `continue` rather than unwrap so a - // malformed line costs one diagnostic instead of the whole document. - let Some(m1) = caps.get(1) else { continue; }; - let level = m1.as_str(); - if !matches!(level, "Kennel" | "Yard" | "Hunt") { - let start = m1.start() as u32; - let end = m1.end() as u32; - diags.push(Diagnostic { - range: Range::new( - Position::new(i as u32, start), - Position::new(i as u32, end), - ), - severity: Some(DiagnosticSeverity::ERROR), - code: Some(NumberOrString::String("K9-D003".to_string())), - source: Some(SOURCE.to_string()), - message: format!( - "Invalid security level '{}'. Must be 'Kennel, 'Yard, or 'Hunt.", - level - ), - ..Default::default() - }); - } - } - } - // Also check the enum-style definition for invalid variants. - let enum_re = &*ENUM_RE; - // This intentionally does not flag the SecurityLevel type definition itself, - // only trust_level assignments. - let _ = (text, enum_re); // suppress unused warning; reserved for future expansion -} - -// ───────────────────────────────────────────────────────────────────── -// D004: Security level mismatch -// ───────────────────────────────────────────────────────────────────── - -/// Hunt level requires a signature field. Warn if trust_level is 'Hunt -/// but there is no signature field anywhere in the document. -fn check_security_level_mismatch(text: &str, lines: &[&str], diags: &mut Vec) { - let has_hunt = lines - .iter() - .any(|l| l.contains("trust_level") && l.contains("'Hunt")); - - if has_hunt && !text.contains("signature") { - // Find the line with trust_level = 'Hunt for accurate positioning. - for (i, line) in lines.iter().enumerate() { - if line.contains("trust_level") && line.contains("'Hunt") { - diags.push(Diagnostic { - range: Range::new(Position::new(i as u32, 0), Position::new(i as u32, line.len() as u32)), - severity: Some(DiagnosticSeverity::WARNING), - code: Some(NumberOrString::String("K9-D004".to_string())), - source: Some(SOURCE.to_string()), - message: "Security level mismatch: 'Hunt requires a 'signature' field \ - for cryptographic handshake verification." - .to_string(), - ..Default::default() - }); - } - } - } -} - -// ───────────────────────────────────────────────────────────────────── -// D005: Missing pedigree fields (name, version required) -// ───────────────────────────────────────────────────────────────────── - -/// The `name` and `version` fields are mandatory in a K9 pedigree. -/// Flags if either is missing from the document. -fn check_missing_pedigree_fields(_text: &str, lines: &[&str], diags: &mut Vec) { - let has_name = lines.iter().any(|l| { - let trimmed = l.trim(); - trimmed.starts_with("name") && trimmed.contains('=') - }); - let has_version = lines.iter().any(|l| { - let trimmed = l.trim(); - trimmed.starts_with("version") && trimmed.contains('=') - }); - - // Only flag if the file looks like a pedigree (contains metadata or K9Pedigree). - let looks_like_pedigree = lines - .iter() - .any(|l| l.contains("metadata") || l.contains("K9Pedigree") || l.contains("pedigree")); - - if looks_like_pedigree { - if !has_name { - diags.push(Diagnostic { - range: Range::new(Position::new(0, 0), Position::new(0, 0)), - severity: Some(DiagnosticSeverity::ERROR), - code: Some(NumberOrString::String("K9-D005".to_string())), - source: Some(SOURCE.to_string()), - message: "Missing required pedigree field 'name'. Every K9 component \ - must declare a name in its metadata." - .to_string(), - ..Default::default() - }); - } - if !has_version { - diags.push(Diagnostic { - range: Range::new(Position::new(0, 0), Position::new(0, 0)), - severity: Some(DiagnosticSeverity::ERROR), - code: Some(NumberOrString::String("K9-D005".to_string())), - source: Some(SOURCE.to_string()), - message: "Missing required pedigree field 'version'. Every K9 component \ - must declare a version in its metadata." - .to_string(), - ..Default::default() - }); - } - } -} - -// ───────────────────────────────────────────────────────────────────── -// D006: Unclosed Nickel records -// ───────────────────────────────────────────────────────────────────── - -/// Counts `{` and `}` to detect unclosed records. Ignores braces inside -/// strings and comments. -fn check_unclosed_records(_text: &str, lines: &[&str], diags: &mut Vec) { - let mut depth: i32 = 0; - let mut open_positions: Vec<(u32, u32)> = Vec::new(); - - for (i, line) in lines.iter().enumerate() { - // Skip comment lines entirely. - let trimmed = line.trim(); - if trimmed.starts_with('#') { - continue; - } - - let mut in_string = false; - for (j, ch) in line.chars().enumerate() { - match ch { - '"' => in_string = !in_string, - '#' if !in_string => break, // rest of line is a comment - '{' if !in_string => { - depth += 1; - open_positions.push((i as u32, j as u32)); - } - '}' if !in_string => { - depth -= 1; - if depth >= 0 { - open_positions.pop(); - } - } - _ => {} - } - } - } - - if depth > 0 { - // Report unclosed brace(s) at the position of the last unmatched '{'. - for &(line_num, col) in &open_positions { - diags.push(Diagnostic { - range: Range::new( - Position::new(line_num, col), - Position::new(line_num, col + 1), - ), - severity: Some(DiagnosticSeverity::ERROR), - code: Some(NumberOrString::String("K9-D006".to_string())), - source: Some(SOURCE.to_string()), - message: "Unclosed Nickel record: '{' without matching '}'.".to_string(), - ..Default::default() - }); - } - } else if depth < 0 { - // More closing braces than opening — report on the last line. - let last_line = if lines.is_empty() { 0 } else { (lines.len() - 1) as u32 }; - diags.push(Diagnostic { - range: Range::new(Position::new(last_line, 0), Position::new(last_line, 0)), - severity: Some(DiagnosticSeverity::ERROR), - code: Some(NumberOrString::String("K9-D006".to_string())), - source: Some(SOURCE.to_string()), - message: "Extra closing '}' without matching '{'.".to_string(), - ..Default::default() - }); - } -} - -// ───────────────────────────────────────────────────────────────────── -// D007: Invalid contract annotations -// ───────────────────────────────────────────────────────────────────── - -/// Nickel contract annotations use `| Type` syntax. Flags `|` followed -/// by something that does not look like a valid type (e.g. starts with -/// a lowercase letter that is not a known built-in). -fn check_invalid_contract_annotations(_text: &str, lines: &[&str], diags: &mut Vec) { - // Known Nickel built-in contract types and K9-specific types. - let known_types = [ - "String", "Number", "Bool", "Array", "Dyn", - "Metadata", "Target", "Security", "Validation", "Recipes", - "K9Pedigree", "SecurityLevel", "Architecture", - "default", "optional", "force", "priority", "doc", - ]; - - let re = &*VARIANT_RE; - for (i, line) in lines.iter().enumerate() { - // Skip comment lines. - if line.trim().starts_with('#') { - continue; - } - // Skip lines that look like enum definitions [| ... |]. - if line.contains("[|") || line.contains("|]") { - continue; - } - - for caps in re.captures_iter(line) { - // One binding, not three lookups; `continue` rather than unwrap so a - // malformed line costs one diagnostic instead of the whole document. - let Some(m1) = caps.get(1) else { continue; }; - let type_name = m1.as_str(); - // Valid if it starts with uppercase (user-defined type) or is a known name. - let is_valid = type_name.chars().next().is_some_and(|c| c.is_uppercase()) - || known_types.contains(&type_name); - - if !is_valid { - let start = m1.start() as u32; - let end = m1.end() as u32; - diags.push(Diagnostic { - range: Range::new( - Position::new(i as u32, start), - Position::new(i as u32, end), - ), - severity: Some(DiagnosticSeverity::WARNING), - code: Some(NumberOrString::String("K9-D007".to_string())), - source: Some(SOURCE.to_string()), - message: format!( - "Possibly invalid contract annotation '| {}'. Expected a type \ - name (e.g. String, Bool) or contract (e.g. default, optional).", - type_name - ), - ..Default::default() - }); - } - } - } -} - -// ───────────────────────────────────────────────────────────────────── -// D008: Non-standard recipe tool references -// ───────────────────────────────────────────────────────────────────── - -/// Recipe fields (install, validate, deploy, migrate) should reference -/// standard K9 tools (just, nickel, podman, echo, etc.). Flags references -/// to non-standard executables as informational. -fn check_nonstandard_recipe_tools(_text: &str, lines: &[&str], diags: &mut Vec) { - let recipe_re = &*RECIPE_RE; - let standard_tools = [ - "just", "nickel", "podman", "echo", "sh", "bash", "curl", "wget", - "tar", "cp", "mv", "rm", "mkdir", "chmod", "chown", "cat", "grep", - "sed", "awk", "test", "true", "false", "exit", "command", - ]; - - for (i, line) in lines.iter().enumerate() { - if let Some(caps) = recipe_re.captures(line) { - // One binding, not three lookups; `continue` rather than unwrap so a - // malformed line costs one diagnostic instead of the whole document. - let Some(m2) = caps.get(2) else { continue; }; - let command_str = m2.as_str(); - // Extract the first word (the tool being invoked). - let first_word = command_str.split_whitespace().next().unwrap_or(""); - // Strip any leading path. - let tool = first_word.rsplit('/').next().unwrap_or(first_word); - - if !tool.is_empty() && !standard_tools.contains(&tool) { - let start = m2.start() as u32; - let end = m2.end() as u32; - diags.push(Diagnostic { - range: Range::new( - Position::new(i as u32, start), - Position::new(i as u32, end), - ), - severity: Some(DiagnosticSeverity::INFORMATION), - code: Some(NumberOrString::String("K9-D008".to_string())), - source: Some(SOURCE.to_string()), - message: format!( - "Recipe references non-standard tool '{}'. Standard tools include: \ - just, nickel, podman, echo, sh.", - tool - ), - ..Default::default() - }); - } - } - } -} - -// ───────────────────────────────────────────────────────────────────── -// D009: Hunt-level without allow_subprocess=true -// ───────────────────────────────────────────────────────────────────── - -/// 'Hunt level grants full triad execution, which typically requires -/// subprocess spawning. Warns if trust_level is 'Hunt but -/// allow_subprocess is not explicitly set to true. -fn check_hunt_without_subprocess(text: &str, lines: &[&str], diags: &mut Vec) { - let has_hunt = lines - .iter() - .any(|l| l.contains("trust_level") && l.contains("'Hunt")); - - let has_subprocess_true = text.contains("allow_subprocess = true") - || text.contains("allow_subprocess= true") - || text.contains("allow_subprocess =true") - || text.contains("allow_subprocess=true"); - - if has_hunt && !has_subprocess_true { - for (i, line) in lines.iter().enumerate() { - if line.contains("trust_level") && line.contains("'Hunt") { - diags.push(Diagnostic { - range: Range::new( - Position::new(i as u32, 0), - Position::new(i as u32, line.len() as u32), - ), - severity: Some(DiagnosticSeverity::WARNING), - code: Some(NumberOrString::String("K9-D009".to_string())), - source: Some(SOURCE.to_string()), - message: "Inconsistent security: 'Hunt level typically requires \ - allow_subprocess = true for full triad execution." - .to_string(), - ..Default::default() - }); - break; - } - } - } -} - -// ───────────────────────────────────────────────────────────────────── -// D010: Deprecated Kennel YAML syntax suggestion -// ───────────────────────────────────────────────────────────────────── - -/// Detects YAML-like syntax (key: value instead of key = value) which -/// suggests the author may be using deprecated Kennel YAML style. -fn check_deprecated_kennel_yaml(_text: &str, lines: &[&str], diags: &mut Vec) { - // Match lines that look like YAML key-value pairs (word: value) - // but are NOT inside strings and NOT comment lines and NOT Nickel - // record type annotations. - let yaml_re = &*YAML_RE; - for (i, line) in lines.iter().enumerate() { - let trimmed = line.trim(); - // Skip comments, empty lines, and AsciiDoc-style headers. - if trimmed.is_empty() || trimmed.starts_with('#') || trimmed.starts_with('=') { - continue; - } - // Skip lines inside strings (heuristic: skip if line has quotes before colon). - if trimmed.starts_with('"') { - continue; - } - - if yaml_re.is_match(line) { - let col_start = line.find(':').unwrap_or(0) as u32; - diags.push(Diagnostic { - range: Range::new( - Position::new(i as u32, col_start), - Position::new(i as u32, col_start + 1), - ), - severity: Some(DiagnosticSeverity::INFORMATION), - code: Some(NumberOrString::String("K9-D010".to_string())), - source: Some(SOURCE.to_string()), - message: "Possible deprecated Kennel YAML syntax. K9 uses Nickel syntax: \ - use '=' for assignment instead of ':'." - .to_string(), - ..Default::default() - }); - } - } -} - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn test_missing_magic_number() { - let text = "# just a comment\nname = \"test\"\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D001".to_string())))); - } - - #[test] - fn test_has_magic_number_via_field() { - let text = "# SPDX-License-Identifier: AGPL-3.0-or-later\nmagic_number = \"K9!\"\n"; - let diags = diagnose(text); - assert!(!diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D001".to_string())))); - } - - #[test] - fn test_missing_spdx() { - let text = "K9!\nname = \"test\"\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D002".to_string())))); - } - - #[test] - fn test_invalid_security_level() { - let text = "trust_level = 'Cage\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D003".to_string())))); - } - - #[test] - fn test_valid_security_level() { - let text = "trust_level = 'Yard\n"; - let diags = diagnose(text); - assert!(!diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D003".to_string())))); - } - - #[test] - fn test_hunt_without_signature() { - let text = "trust_level = 'Hunt\nallow_subprocess = true\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D004".to_string())))); - } - - #[test] - fn test_unclosed_record() { - let text = "metadata = {\n name = \"test\"\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D006".to_string())))); - } - - #[test] - fn test_balanced_records() { - let text = "metadata = {\n name = \"test\"\n}\n"; - let diags = diagnose(text); - assert!(!diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D006".to_string())))); - } - - #[test] - fn test_hunt_without_subprocess() { - let text = "trust_level = 'Hunt\nsignature = \"abc\"\nallow_subprocess = false\n"; - let diags = diagnose(text); - assert!(diags.iter().any(|d| d.code == Some(NumberOrString::String("K9-D009".to_string())))); - } -} diff --git a/k9-svc/lsp/src/hover.rs b/k9-svc/lsp/src/hover.rs deleted file mode 100644 index 969188d4..00000000 --- a/k9-svc/lsp/src/hover.rs +++ /dev/null @@ -1,361 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// -// hover.rs — K9 hover documentation provider -// -// Provides contextual documentation when the user hovers over: -// 1. Security levels ('Kennel, 'Yard, 'Hunt) — what each permits -// 2. Pedigree fields (name, version, description, etc.) -// 3. Contract type names (String, Bool, SecurityLevel, etc.) - -use tower_lsp::lsp_types::*; - -/// Extract the word under the cursor at the given position. -/// -/// A "word" here includes alphanumeric characters, underscores, and a -/// leading apostrophe (for Nickel enum tags like 'Kennel). -fn word_at(text: &str, position: Position) -> Option { - let line = text.lines().nth(position.line as usize)?; - let col = position.character as usize; - - if col > line.len() { - return None; - } - - let chars: Vec = line.chars().collect(); - - // Find word boundaries around the cursor. - let mut start = col; - while start > 0 { - let prev = chars[start - 1]; - if prev.is_alphanumeric() || prev == '_' || prev == '\'' { - start -= 1; - } else { - break; - } - } - - let mut end = col; - while end < chars.len() { - let ch = chars[end]; - if ch.is_alphanumeric() || ch == '_' { - end += 1; - } else { - break; - } - } - - if start == end { - return None; - } - - Some(chars[start..end].iter().collect()) -} - -/// Return hover documentation for the word at the given position. -/// -/// Matches against known K9 security levels, pedigree fields, and -/// contract types to provide relevant documentation. -pub fn hover_at(text: &str, position: Position) -> Option { - let word = word_at(text, position)?; - let docs = match word.as_str() { - // ─── Security Levels ───────────────────────────────────── - "'Kennel" | "Kennel" => Some(( - "Security Level: Kennel (Pure Data)", - "**`'Kennel`** — Pure Data\n\n\ - The safest execution level. No code execution is permitted.\n\n\ - | Permission | Allowed |\n\ - |---|---|\n\ - | Read data | Yes |\n\ - | Nickel evaluation | No |\n\ - | Filesystem write | No |\n\ - | Network access | No |\n\ - | Subprocess spawning | No |\n\n\ - Use `'Kennel` for configuration files, data manifests, and any \ - component that should be safe to open on constrained environments \ - (Edge devices, ASICs).\n\n\ - _See: SPEC.adoc § Security Model — The Leash System_", - )), - "'Yard" | "Yard" => Some(( - "Security Level: Yard (Validation Only)", - "**`'Yard`** — Validation Only\n\n\ - Permits Nickel contract evaluation for type checking and validation, \ - but no side effects.\n\n\ - | Permission | Allowed |\n\ - |---|---|\n\ - | Read data | Yes |\n\ - | Nickel evaluation | Yes |\n\ - | Filesystem write | No |\n\ - | Network access | No |\n\ - | Subprocess spawning | No |\n\n\ - Use `'Yard` for components that need self-validation via Nickel \ - contracts but should not perform I/O operations. This is the default \ - security level.\n\n\ - _See: SPEC.adoc § Security Model — The Leash System_", - )), - "'Hunt" | "Hunt" => Some(( - "Security Level: Hunt (Full Execution)", - "**`'Hunt`** — Full Execution\n\n\ - Grants complete must-just-nickel triad execution. **Requires a valid \ - cryptographic handshake** via the `signature` field.\n\n\ - | Permission | Allowed |\n\ - |---|---|\n\ - | Read data | Yes |\n\ - | Nickel evaluation | Yes |\n\ - | Filesystem write | Yes (if allow_filesystem_write = true) |\n\ - | Network access | Yes (if allow_network = true) |\n\ - | Subprocess spawning | Yes (if allow_subprocess = true) |\n\n\ - Use `'Hunt` for deployment components that need to execute Just \ - recipes, spawn containers, or modify the filesystem. Always pair \ - with a `signature` field and explicit permission flags.\n\n\ - _See: SPEC.adoc § Security Model — The Leash System_", - )), - - // ─── Pedigree Fields ───────────────────────────────────── - "name" => Some(( - "Pedigree Field: name", - "**`name`** — Component Name\n\n\ - The unique identifier for this K9 component. Must be lowercase \ - and hyphenated (e.g. `my-component`).\n\n\ - **Required:** Yes\n\ - **Type:** `String`\n\n\ - _See: pedigree.ncl § Metadata_", - )), - "version" => Some(( - "Pedigree Field: version", - "**`version`** — Component Version\n\n\ - SemVer version string with optional stability suffix \ - (e.g. `1.0.0-alpha`, `2.3.1`).\n\n\ - **Required:** Yes (defaults to `1.0.0-alpha`)\n\ - **Type:** `String`\n\n\ - _See: pedigree.ncl § Metadata_", - )), - "description" => Some(( - "Pedigree Field: description", - "**`description`** — Component Description\n\n\ - Human-readable purpose of this component.\n\n\ - **Required:** No (optional)\n\ - **Type:** `String`\n\n\ - _See: pedigree.ncl § Metadata_", - )), - "breed" => Some(( - "Pedigree Field: breed", - "**`breed`** — MIME Type Identifier\n\n\ - The MIME type for this component. Defaults to \ - `application/vnd.k9+nickel`.\n\n\ - **Required:** No (has default)\n\ - **Type:** `String`\n\n\ - _See: pedigree.ncl § Metadata_", - )), - "magic_number" => Some(( - "Pedigree Field: magic_number", - "**`magic_number`** — Binary Signature\n\n\ - The magic number for kernel-level file identification. \ - Must be `K9!` (bytes `0x4B 0x39 0x21`).\n\n\ - **Required:** No (defaults to `K9!`)\n\ - **Type:** `String`\n\n\ - _See: SPEC.adoc § L1: The Scent (Identity)_", - )), - "trust_level" => Some(( - "Security Field: trust_level", - "**`trust_level`** — Execution Permission Tier\n\n\ - Controls what operations this component is allowed to perform.\n\n\ - | Value | Meaning |\n\ - |---|---|\n\ - | `'Kennel` | Pure data, no execution |\n\ - | `'Yard` | Nickel evaluation only (default) |\n\ - | `'Hunt` | Full triad execution (requires signature) |\n\n\ - **Type:** `SecurityLevel` (`[| 'Kennel, 'Yard, 'Hunt |]`)\n\n\ - _See: pedigree.ncl § Security_", - )), - "allow_network" => Some(( - "Security Field: allow_network", - "**`allow_network`** — Network Access Permission\n\n\ - Whether the component can fetch external resources. \ - Only meaningful at `'Hunt` level.\n\n\ - **Default:** `false`\n\ - **Type:** `Bool`\n\n\ - _See: pedigree.ncl § Security_", - )), - "allow_filesystem_write" => Some(( - "Security Field: allow_filesystem_write", - "**`allow_filesystem_write`** — Filesystem Write Permission\n\n\ - Whether the component can modify the host filesystem. \ - Only meaningful at `'Hunt` level.\n\n\ - **Default:** `false`\n\ - **Type:** `Bool`\n\n\ - _See: pedigree.ncl § Security_", - )), - "allow_subprocess" => Some(( - "Security Field: allow_subprocess", - "**`allow_subprocess`** — Subprocess Spawning Permission\n\n\ - Whether the component can spawn child processes. \ - Typically required for `'Hunt` level components that execute \ - Just recipes or Podman containers.\n\n\ - **Default:** `false`\n\ - **Type:** `Bool`\n\n\ - _See: pedigree.ncl § Security_", - )), - "signature" => Some(( - "Security Field: signature", - "**`signature`** — Cryptographic Handshake\n\n\ - Required for `'Hunt` level components. Contains a cryptographic \ - signature used to verify the component's authenticity before \ - granting full execution permissions.\n\n\ - **Required:** Yes (for `'Hunt` level)\n\ - **Type:** `String` (optional)\n\n\ - _See: pedigree.ncl § Security_", - )), - "checksum" => Some(( - "Validation Field: checksum", - "**`checksum`** — Payload Integrity Hash\n\n\ - SHA256 hash of the component payload for integrity verification.\n\n\ - **Required:** Yes\n\ - **Type:** `String`\n\n\ - _See: pedigree.ncl § Validation_", - )), - "hunt_authorized" => Some(( - "Validation Field: hunt_authorized", - "**`hunt_authorized`** — Hunt Execution Authorization\n\n\ - Computed field indicating whether this component's `'Hunt` level \ - execution has been authorized via a valid signature.\n\n\ - **Default:** `false`\n\ - **Type:** `Bool`\n\n\ - _See: pedigree.ncl § Validation_", - )), - - // ─── Contract Types ───────────────────────────────────── - "SecurityLevel" => Some(( - "Contract: SecurityLevel", - "**`SecurityLevel`** — Enum Contract\n\n\ - ```nickel\n\ - let SecurityLevel = [| 'Kennel, 'Yard, 'Hunt |] in\n\ - ```\n\n\ - Defines the three execution permission tiers for K9 components.\n\n\ - _See: pedigree.ncl_", - )), - "Architecture" => Some(( - "Contract: Architecture", - "**`Architecture`** — Enum Contract\n\n\ - ```nickel\n\ - let Architecture = [| 'Linux, 'Minix, 'MacOS, 'Android, 'PC, 'ASIC, 'Unknown |] in\n\ - ```\n\n\ - Defines the target deployment architectures supported by K9.\n\n\ - _See: pedigree.ncl_", - )), - "K9Pedigree" => Some(( - "Contract: K9Pedigree", - "**`K9Pedigree`** — Root Contract\n\n\ - ```nickel\n\ - K9Pedigree = {\n\ - \x20 metadata | Metadata,\n\ - \x20 target | Target,\n\ - \x20 security | Security,\n\ - \x20 validation | Validation,\n\ - \x20 recipes | Recipes,\n\ - }\n\ - ```\n\n\ - The top-level contract that every `.k9` component must satisfy. \ - Combines all five pedigree sections.\n\n\ - _See: pedigree.ncl § K9Pedigree_", - )), - "Metadata" => Some(( - "Contract: Metadata", - "**`Metadata`** — Identity Section\n\n\ - Contains component identification fields: `name`, `version`, \ - `breed`, `magic_number`, and `description`.\n\n\ - _See: pedigree.ncl § Metadata_", - )), - "Target" => Some(( - "Contract: Target", - "**`Target`** — Environment Section\n\n\ - Specifies the deployment target: `os` (Architecture), `is_edge`, \ - `requires_podman`, and `min_memory_mb`.\n\n\ - _See: pedigree.ncl § Target_", - )), - "Security" => Some(( - "Contract: Security", - "**`Security`** — Leash Section\n\n\ - Defines the security posture: `trust_level`, `allow_network`, \ - `allow_filesystem_write`, `allow_subprocess`, and `signature`.\n\n\ - _See: pedigree.ncl § Security_", - )), - "Validation" => Some(( - "Contract: Validation", - "**`Validation`** — Self-Check Section\n\n\ - Contains integrity verification fields: `checksum`, \ - `pedigree_version`, and `hunt_authorized`.\n\n\ - _See: pedigree.ncl § Validation_", - )), - "Recipes" => Some(( - "Contract: Recipes", - "**`Recipes`** — Deployment Section\n\n\ - Defines Just recipe commands: `install`, `validate`, `deploy`, \ - and `migrate`.\n\n\ - _See: pedigree.ncl § Recipes_", - )), - - _ => None, - }; - - docs.map(|(label, content)| Hover { - contents: HoverContents::Markup(MarkupContent { - kind: MarkupKind::Markdown, - value: format!("### {}\n\n{}", label, content), - }), - range: None, - }) -} - -#[cfg(test)] -mod tests { - use super::*; - - #[test] - fn test_hover_kennel() { - let text = "trust_level = 'Kennel\n"; - let hover = hover_at(text, Position::new(0, 16)); - assert!(hover.is_some()); - } - - #[test] - fn test_hover_yard() { - let text = "trust_level = 'Yard\n"; - let hover = hover_at(text, Position::new(0, 16)); - assert!(hover.is_some()); - } - - #[test] - fn test_hover_hunt() { - let text = "trust_level = 'Hunt\n"; - let hover = hover_at(text, Position::new(0, 16)); - assert!(hover.is_some()); - } - - #[test] - fn test_hover_pedigree_field() { - let text = "name = \"hello\"\n"; - let hover = hover_at(text, Position::new(0, 2)); - assert!(hover.is_some()); - } - - #[test] - fn test_hover_contract_type() { - let text = "metadata | Metadata,\n"; - let hover = hover_at(text, Position::new(0, 14)); - assert!(hover.is_some()); - } - - #[test] - fn test_hover_unknown_word() { - let text = "foobar = 42\n"; - let hover = hover_at(text, Position::new(0, 3)); - assert!(hover.is_none()); - } - - #[test] - fn test_word_at_basic() { - let text = "trust_level = 'Hunt\n"; - assert_eq!(word_at(text, Position::new(0, 3)), Some("trust_level".to_string())); - assert_eq!(word_at(text, Position::new(0, 16)), Some("'Hunt".to_string())); - } -} diff --git a/k9-svc/lsp/src/main.rs b/k9-svc/lsp/src/main.rs deleted file mode 100644 index 522d7c34..00000000 --- a/k9-svc/lsp/src/main.rs +++ /dev/null @@ -1,197 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// -// main.rs — Entry point for the K9 LSP server -// -// Starts the Language Server Protocol server over stdio transport. -// Provides diagnostics, completions, and hover for .k9 and .k9.ncl files. -// -// Usage: -// k9-lsp # Start LSP server on stdin/stdout -// k9-lsp --help # Show usage information - -#![forbid(unsafe_code)] -mod completions; -mod diagnostics; -mod hover; - -use std::collections::HashMap; -use std::sync::Mutex; - -use tower_lsp::jsonrpc::Result; -use tower_lsp::lsp_types::*; -use tower_lsp::{Client, LanguageServer, LspService, Server}; - -/// K9 Language Server backend. -/// -/// Maintains a map of open document URIs to their current text content, -/// and provides diagnostics, completions, and hover documentation for -/// K9 Self-Validating Component files. -struct K9Backend { - /// LSP client handle for sending notifications (diagnostics, etc.). - client: Client, - /// In-memory store of open document contents, keyed by URI string. - // ⚠ Locked with `unwrap_or_else(|e| e.into_inner())`, never `unwrap()`. - // - // `Mutex::lock` fails only when the mutex is POISONED — i.e. some other - // request handler panicked while holding it. Unwrapping there converts one - // panicked request into a permanently dead language server: every - // subsequent request panics on the same poisoned lock, and the editor - // loses completions, hover and diagnostics for the rest of the session. - // - // Recovering the guard is right for THIS data specifically: it is a cache - // of document text keyed by URI. The worst a panic mid-update can leave is - // one stale or partial entry, which the next didChange overwrites wholesale. - // There is no invariant across entries to violate. - documents: Mutex>, -} - -#[tower_lsp::async_trait] -impl LanguageServer for K9Backend { - /// Called when the client initialises the server. - /// - /// Advertises capabilities: text document sync (full), completions, - /// hover, and diagnostic support. - async fn initialize(&self, _: InitializeParams) -> Result { - Ok(InitializeResult { - capabilities: ServerCapabilities { - text_document_sync: Some(TextDocumentSyncCapability::Kind( - TextDocumentSyncKind::FULL, - )), - completion_provider: Some(CompletionOptions { - trigger_characters: Some(vec![ - "=".to_string(), - "'".to_string(), - "|".to_string(), - ".".to_string(), - ]), - resolve_provider: Some(false), - ..Default::default() - }), - hover_provider: Some(HoverProviderCapability::Simple(true)), - ..Default::default() - }, - ..Default::default() - }) - } - - /// Called after the client confirms initialisation. - async fn initialized(&self, _: InitializedParams) { - self.client - .log_message(MessageType::INFO, "K9 LSP server initialized") - .await; - } - - /// Called when the client shuts down. - async fn shutdown(&self) -> Result<()> { - Ok(()) - } - - /// Called when a document is opened — stores content and publishes diagnostics. - async fn did_open(&self, params: DidOpenTextDocumentParams) { - let uri = params.text_document.uri.to_string(); - let text = params.text_document.text.clone(); - - { - let mut docs = self.documents.lock().unwrap_or_else(|e| e.into_inner()); - docs.insert(uri.clone(), text.clone()); - } - - let diags = diagnostics::diagnose(&text); - self.client - .publish_diagnostics(params.text_document.uri, diags, None) - .await; - } - - /// Called when a document is modified — updates content and re-publishes diagnostics. - async fn did_change(&self, params: DidChangeTextDocumentParams) { - let uri = params.text_document.uri.to_string(); - // Full sync: the last content change contains the entire document. - if let Some(change) = params.content_changes.into_iter().last() { - let text = change.text.clone(); - { - let mut docs = self.documents.lock().unwrap_or_else(|e| e.into_inner()); - docs.insert(uri, text.clone()); - } - - let diags = diagnostics::diagnose(&text); - self.client - .publish_diagnostics(params.text_document.uri, diags, None) - .await; - } - } - - /// Called when a document is closed — removes it from the in-memory store. - async fn did_close(&self, params: DidCloseTextDocumentParams) { - let mut docs = self.documents.lock().unwrap_or_else(|e| e.into_inner()); - docs.remove(¶ms.text_document.uri.to_string()); - } - - /// Provides context-aware completions for K9 pedigree fields, security - /// levels, recipe names, and Nickel standard library imports. - async fn completion(&self, params: CompletionParams) -> Result> { - let uri = params.text_document_position.text_document.uri.to_string(); - let position = params.text_document_position.position; - - let docs = self.documents.lock().unwrap_or_else(|e| e.into_inner()); - let text = match docs.get(&uri) { - Some(t) => t.clone(), - None => return Ok(None), - }; - - let items = completions::complete(&text, position); - Ok(Some(CompletionResponse::Array(items))) - } - - /// Provides hover documentation for security levels, pedigree fields, - /// and contract types. - async fn hover(&self, params: HoverParams) -> Result> { - let uri = params - .text_document_position_params - .text_document - .uri - .to_string(); - let position = params.text_document_position_params.position; - - let docs = self.documents.lock().unwrap_or_else(|e| e.into_inner()); - let text = match docs.get(&uri) { - Some(t) => t.clone(), - None => return Ok(None), - }; - - Ok(hover::hover_at(&text, position)) - } -} - -/// Main entry point — starts the K9 LSP server on stdio transport. -/// -/// The server communicates via JSON-RPC over stdin/stdout, which is the -/// standard transport for editor integrations (VS Code, Neovim, etc.). -#[tokio::main] -async fn main() { - // Handle --help / --version flags before starting the server. - let args: Vec = std::env::args().collect(); - if args.iter().any(|a| a == "--help" || a == "-h") { - eprintln!("k9-lsp — Language Server Protocol server for K9 SVC files"); - eprintln!(); - eprintln!("Usage: k9-lsp"); - eprintln!(" Starts the LSP server on stdin/stdout (JSON-RPC)."); - eprintln!(); - eprintln!("Typically invoked by your editor, not directly."); - eprintln!("See README.adoc for integration instructions."); - std::process::exit(0); - } - if args.iter().any(|a| a == "--version" || a == "-V") { - eprintln!("k9-lsp {}", env!("CARGO_PKG_VERSION")); - std::process::exit(0); - } - - let stdin = tokio::io::stdin(); - let stdout = tokio::io::stdout(); - - let (service, socket) = LspService::new(|client| K9Backend { - client, - documents: Mutex::new(HashMap::new()), - }); - - Server::new(stdin, stdout, socket).serve(service).await; -} diff --git a/k9-svc/manifest.scm b/k9-svc/manifest.scm deleted file mode 100644 index dd942c7f..00000000 --- a/k9-svc/manifest.scm +++ /dev/null @@ -1,24 +0,0 @@ -;;; SPDX-License-Identifier: MPL-2.0 -;;; manifest.scm — Generic Guix manifest for RSR-compliant projects -;;; -;;; Usage: -;;; guix shell -m manifest.scm -;;; - -(specifications->manifest - '(;; Core development tools - "git" - "just" - "nickel" - "curl" - "bash" - "coreutils" - - ;; Documentation - "asciidoctor" - "pandoc" - - ;; Common build dependencies - "openssl" - "zlib" - "pkg-config")) diff --git a/k9-svc/mime/k9.magic b/k9-svc/mime/k9.magic deleted file mode 100644 index f1a8ab94..00000000 --- a/k9-svc/mime/k9.magic +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Magic file for file(1) command - K9 SVC detection -# Install: sudo cp k9.magic /etc/magic.d/ && sudo update-magic -# Or user: cat k9.magic >> ~/.magic && file --compile ~/.magic - -# K9 Self-Validating Component -0 string K9! K9 Self-Validating Component ->3 byte 0x0A \b, newline follows ->3 byte 0x20 \b, space follows -!:mime application/vnd.k9+nickel -!:ext k9/k9.ncl diff --git a/k9-svc/mime/k9.uti.plist b/k9-svc/mime/k9.uti.plist deleted file mode 100644 index 3682bf33..00000000 --- a/k9-svc/mime/k9.uti.plist +++ /dev/null @@ -1,35 +0,0 @@ - - - - - - - UTImportedTypeDeclarations - - - UTTypeIdentifier - org.k9-svc.component - UTTypeConformsTo - - public.data - public.text - public.source-code - - UTTypeDescription - K9 Self-Validating Component - UTTypeIconFile - k9-icon - UTTypeTagSpecification - - public.filename-extension - - k9 - k9.ncl - - public.mime-type - application/vnd.k9+nickel - - - - - diff --git a/k9-svc/mime/k9.xml b/k9-svc/mime/k9.xml deleted file mode 100644 index f1bc3813..00000000 --- a/k9-svc/mime/k9.xml +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - K9 Self-Validating Component - K9 Self-Validating Component (Alpha Breed) - K9 Selbstvalidierende Komponente - Composant K9 auto-validant - Componente K9 autovalidante - K9 SVC - K9 Self-Validating Component - - - - - - - - - diff --git a/k9-svc/mime/mime.types b/k9-svc/mime/mime.types deleted file mode 100644 index ffbd6820..00000000 --- a/k9-svc/mime/mime.types +++ /dev/null @@ -1,5 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MIME types entry for K9 SVC (for systems using /etc/mime.types) -# Append to /etc/mime.types or ~/.mime.types - -application/vnd.k9+nickel k9 k9.ncl diff --git a/k9-svc/must b/k9-svc/must deleted file mode 100755 index 8acc081b..00000000 --- a/k9-svc/must +++ /dev/null @@ -1,331 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# must - Environment shim for the k9 SVC triad -# Usage: ./must [command] -# -# The "must" in must-just-nickel. Detects architecture, ensures -# dependencies, then hands off to Just for orchestration. - -set -eu - -K9_VERSION="1.0.0-alpha" -K9_MAGIC="K9!" -K9_ALLOW_ROOT="${K9_ALLOW_ROOT:-false}" -K9_DRY_RUN="${K9_DRY_RUN:-false}" - -# ───────────────────────────────────────────────────────────── -# L0: Security Checks -# ───────────────────────────────────────────────────────────── - -check_root() { - # Refuse to run as root unless explicitly allowed - if [ "$(id -u)" -eq 0 ]; then - if [ "$K9_ALLOW_ROOT" != "true" ]; then - echo "╔══════════════════════════════════════════════════════════╗" >&2 - echo "║ ⚠️ SECURITY WARNING: K9 refuses to run as root ║" >&2 - echo "╚══════════════════════════════════════════════════════════╝" >&2 - echo "" >&2 - echo "Running K9 components as root is dangerous because:" >&2 - echo " • Hunt-level components have full system access" >&2 - echo " • Malicious components can compromise your entire system" >&2 - echo " • Even signed components can have bugs" >&2 - echo "" >&2 - echo "If you absolutely must run as root:" >&2 - echo " export K9_ALLOW_ROOT=true" >&2 - echo " ./must run " >&2 - echo "" >&2 - echo "Or use --allow-root flag:" >&2 - echo " ./must --allow-root run " >&2 - echo "" >&2 - echo "See: docs/SECURITY-BEST-PRACTICES.adoc" >&2 - exit 1 - else - echo "⚠️ WARNING: Running K9 as ROOT (explicitly allowed)" >&2 - echo "This is DANGEROUS. Proceed with extreme caution." >&2 - sleep 2 # Force user to see warning - fi - fi -} - -security_warning() { - # Display security warning for Hunt-level components - local component="$1" - echo "╔══════════════════════════════════════════════════════════╗" >&2 - echo "║ ⚠️ SECURITY: Hunt-level component detected ║" >&2 - echo "╚══════════════════════════════════════════════════════════╝" >&2 - echo "" >&2 - echo "Component: $component" >&2 - echo "" >&2 - echo "Hunt components have FULL SYSTEM ACCESS. Before running:" >&2 - echo " ✓ Verify signature: ./must verify $component" >&2 - echo " ✓ Review Just recipes: just --list --justfile $component" >&2 - echo " ✓ Run in dry-run mode: ./must --dry-run run $component" >&2 - echo " ✓ Check for red flags: ./must scan $component" >&2 - echo "" >&2 - echo "See: docs/SECURITY-BEST-PRACTICES.adoc" >&2 - echo "" >&2 -} - -# ───────────────────────────────────────────────────────────── -# L1: The Scent - Environment Detection -# ───────────────────────────────────────────────────────────── - -detect_os() { - case "$(uname -s)" in - Linux) - if [ -f /etc/minix-release ]; then - echo "Minix" - elif [ -f /system/build.prop ]; then - echo "Android" - else - echo "Linux" - fi - ;; - Darwin) echo "MacOS" ;; - MINIX) echo "Minix" ;; - *) echo "Unknown" ;; - esac -} - -detect_arch() { - case "$(uname -m)" in - x86_64|amd64) echo "x86_64" ;; - aarch64|arm64) echo "aarch64" ;; - armv7l) echo "armv7" ;; - riscv64) echo "riscv64" ;; - *) echo "$(uname -m)" ;; - esac -} - -is_edge() { - # Edge detection: low memory or known embedded platforms - if [ -f /proc/meminfo ]; then - mem_kb=$(grep MemTotal /proc/meminfo | awk '{print $2}') - [ "$mem_kb" -lt 1048576 ] && return 0 # < 1GB - fi - return 1 -} - -has_podman() { - command -v podman >/dev/null 2>&1 -} - -# ───────────────────────────────────────────────────────────── -# L2: The Brain - Dependency Verification -# ───────────────────────────────────────────────────────────── - -ensure_nickel() { - if ! command -v nickel >/dev/null 2>&1; then - echo "K9: Nickel not found. Installing..." >&2 - case "$(detect_os)" in - Linux) - if command -v cargo >/dev/null 2>&1; then - cargo install nickel-lang-cli - else - echo "K9: Requires cargo or manual Nickel installation" >&2 - exit 1 - fi - ;; - MacOS) - if command -v brew >/dev/null 2>&1; then - brew install nickel - else - echo "K9: Requires Homebrew or manual Nickel installation" >&2 - exit 1 - fi - ;; - *) - echo "K9: Manual Nickel installation required for $(detect_os)" >&2 - exit 1 - ;; - esac - fi -} - -ensure_just() { - if ! command -v just >/dev/null 2>&1; then - echo "K9: Just not found. Installing..." >&2 - case "$(detect_os)" in - Linux) - if command -v cargo >/dev/null 2>&1; then - cargo install just - else - echo "K9: Requires cargo or manual Just installation" >&2 - exit 1 - fi - ;; - MacOS) - if command -v brew >/dev/null 2>&1; then - brew install just - else - echo "K9: Requires Homebrew or manual Just installation" >&2 - exit 1 - fi - ;; - *) - echo "K9: Manual Just installation required for $(detect_os)" >&2 - exit 1 - ;; - esac - fi -} - -# ───────────────────────────────────────────────────────────── -# L3: The Muscle - Handoff to Just -# ───────────────────────────────────────────────────────────── - -export_env() { - export K9_OS="$(detect_os)" - export K9_ARCH="$(detect_arch)" - export K9_VERSION - export K9_MAGIC - if is_edge; then - export K9_EDGE="true" - else - export K9_EDGE="false" - fi - if has_podman; then - export K9_HAS_PODMAN="true" - else - export K9_HAS_PODMAN="false" - fi -} - -main() { - # Parse flags first - while [ $# -gt 0 ]; do - case "$1" in - --allow-root) - K9_ALLOW_ROOT=true - shift - ;; - --dry-run) - K9_DRY_RUN=true - shift - ;; - *) - break - ;; - esac - done - - # Security check: refuse to run as root - check_root - - export_env - - case "${1:-status}" in - status) - echo "K9 Environment Report" - echo "────────────────────────" - echo "OS: $K9_OS" - echo "Arch: $K9_ARCH" - echo "Edge: $K9_EDGE" - echo "Podman: $K9_HAS_PODMAN" - echo "Version: $K9_VERSION" - echo "Allow Root: $K9_ALLOW_ROOT" - echo "Dry Run: $K9_DRY_RUN" - ;; - ensure) - echo "K9: Ensuring triad dependencies..." >&2 - ensure_nickel - ensure_just - echo "K9: Triad ready." >&2 - ;; - verify) - shift - if [ $# -eq 0 ]; then - echo "Usage: must verify " >&2 - exit 1 - fi - if [ ! -f ./sign.sh ]; then - echo "ERROR: sign.sh not found. Cannot verify signatures." >&2 - echo "Ensure you are in the k9-svc repository." >&2 - exit 1 - fi - ./sign.sh verify "$@" - ;; - scan) - shift - if [ $# -eq 0 ]; then - echo "Usage: must scan " >&2 - exit 1 - fi - if [ ! -f ./k9-scan ]; then - echo "ERROR: k9-scan not found. Basic static analysis unavailable." >&2 - echo "This is a Week 1 security feature. Creating basic scanner..." >&2 - exit 1 - fi - ./k9-scan "$@" - ;; - run) - shift - if [ $# -eq 0 ]; then - echo "Usage: must run [recipe]" >&2 - exit 1 - fi - component="$1" - if [ ! -f "$component" ]; then - echo "ERROR: Component file not found: $component" >&2 - exit 1 - fi - # Check if Hunt-level (contains Just recipes) - if grep -q '^\[.*\]' "$component" 2>/dev/null; then - security_warning "$component" - if [ "$K9_DRY_RUN" != "true" ]; then - printf "Continue with execution? [y/N] " >&2 - read -r response - case "$response" in - [yY]|[yY][eE][sS]) ;; - *) echo "Aborted." >&2; exit 1 ;; - esac - fi - fi - ensure_nickel - ensure_just - if [ "$K9_DRY_RUN" = "true" ]; then - echo "═══════════════════════════════════════════════════" >&2 - echo " DRY-RUN MODE: Preview only, no execution" >&2 - echo "═══════════════════════════════════════════════════" >&2 - echo "" >&2 - echo "Just recipes that would execute:" >&2 - just --list --justfile "$component" - echo "" >&2 - echo "⚠️ DRY-RUN MODE - Nothing was executed" >&2 - echo "To run for real: ./must run $component" >&2 - else - exec just --justfile "$@" - fi - ;; - *) - echo "K9 must shim v$K9_VERSION" - echo "Usage: must [options] [command] [args]" - echo "" - echo "Options:" - echo " --allow-root - Allow running as root (DANGEROUS)" - echo " --dry-run - Preview actions without execution" - echo "" - echo "Commands:" - echo " status - Show environment detection" - echo " ensure - Install Nickel and Just if missing" - echo " verify - Verify component signature" - echo " scan - Static analysis for security issues" - echo " run - Execute K9 component (Hunt level)" - echo "" - echo "Examples:" - echo " ./must status" - echo " ./must verify component.k9.ncl" - echo " ./must scan component.k9.ncl" - echo " ./must --dry-run run component.k9.ncl" - echo " ./must run component.k9.ncl [recipe]" - echo "" - echo "Security:" - echo " • Always verify signatures before running Hunt components" - echo " • Use dry-run mode to preview actions" - echo " • Never run as root unless absolutely required" - echo " • See: docs/SECURITY-BEST-PRACTICES.adoc" - ;; - esac -} - -main "$@" diff --git a/k9-svc/packaging/aur/.SRCINFO b/k9-svc/packaging/aur/.SRCINFO deleted file mode 100644 index 03ec47d5..00000000 --- a/k9-svc/packaging/aur/.SRCINFO +++ /dev/null @@ -1,17 +0,0 @@ -pkgbase = k9-svc - pkgdesc = Self-Validating Components - a file format that eats its own dog food - pkgver = 1.0.0 - pkgrel = 1 - url = https://github.com/hyperpolymath/standards/tree/main/k9-svc - arch = any - license = AGPL3 - makedepends = git - depends = nickel - depends = just - depends = openssl - optdepends = podman: container deployment - optdepends = asciidoctor: documentation generation - source = k9-svc-1.0.0.tar.gz::https://github.com/hyperpolymath/standards/tree/main/k9-svc/archive/v1.0.0.tar.gz - sha256sums = 82e51dec2891728d233392f6e84004e5d6060bf2c936dd47445d59ca66c09f94 - -pkgname = k9-svc diff --git a/k9-svc/packaging/aur/PKGBUILD b/k9-svc/packaging/aur/PKGBUILD deleted file mode 100644 index c8b8d550..00000000 --- a/k9-svc/packaging/aur/PKGBUILD +++ /dev/null @@ -1,74 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Maintainer: hyperpolymath -# AUR PKGBUILD for K9 SVC - -pkgname=k9-svc -pkgver=1.0.0 -pkgrel=1 -pkgdesc="Self-Validating Components - a file format that eats its own dog food" -arch=('any') -url="https://github.com/hyperpolymath/standards/tree/main/k9-svc" -license=('AGPL3') -depends=('nickel' 'just' 'openssl') -optdepends=( - 'podman: container deployment' - 'asciidoctor: documentation generation' -) -makedepends=('git') -source=("$pkgname-$pkgver.tar.gz::https://github.com/hyperpolymath/$pkgname/archive/v$pkgver.tar.gz") -sha256sums=('82e51dec2891728d233392f6e84004e5d6060bf2c936dd47445d59ca66c09f94') - -package() { - cd "$srcdir/$pkgname-$pkgver" - - # Install scripts - install -Dm755 must "$pkgdir/usr/bin/k9-must" - install -Dm755 sign.sh "$pkgdir/usr/bin/k9-sign" - - # Install schemas - install -Dm644 pedigree.ncl "$pkgdir/usr/share/k9/pedigree.ncl" - install -Dm644 register.ncl "$pkgdir/usr/share/k9/register.ncl" - install -Dm644 leash.ncl "$pkgdir/usr/share/k9/leash.ncl" - install -Dm644 justfile "$pkgdir/usr/share/k9/justfile" - - # Install examples - install -dm755 "$pkgdir/usr/share/k9/examples" - install -m644 examples/*.k9 "$pkgdir/usr/share/k9/examples/" 2>/dev/null || true - install -m644 examples/*.k9.ncl "$pkgdir/usr/share/k9/examples/" 2>/dev/null || true - - # Install assets - install -dm755 "$pkgdir/usr/share/k9/assets" - install -m644 assets/*.svg "$pkgdir/usr/share/k9/assets/" 2>/dev/null || true - - # Install MIME type - install -Dm644 mime/k9.xml "$pkgdir/usr/share/mime/packages/k9.xml" - - # Install documentation - install -Dm644 README.adoc "$pkgdir/usr/share/doc/$pkgname/README.adoc" - install -Dm644 SPEC.adoc "$pkgdir/usr/share/doc/$pkgname/SPEC.adoc" - install -Dm644 GUIDE.adoc "$pkgdir/usr/share/doc/$pkgname/GUIDE.adoc" - install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" - - # Create wrapper script - cat > "$pkgdir/usr/bin/k9" << 'EOF' -#!/bin/sh -# K9 SVC wrapper - runs just with K9 recipes -exec just --justfile /usr/share/k9/justfile "$@" -EOF - chmod 755 "$pkgdir/usr/bin/k9" -} - -post_install() { - # Update MIME database - update-mime-database /usr/share/mime &>/dev/null || true - echo "K9 SVC installed. Run 'k9 setup-mime' for user-level MIME setup." -} - -post_upgrade() { - post_install -} - -post_remove() { - # Update MIME database - update-mime-database /usr/share/mime &>/dev/null || true -} diff --git a/k9-svc/packaging/aur/SUBMIT.adoc b/k9-svc/packaging/aur/SUBMIT.adoc deleted file mode 100644 index 7f3d72e2..00000000 --- a/k9-svc/packaging/aur/SUBMIT.adoc +++ /dev/null @@ -1,81 +0,0 @@ -== AUR Submission Guide for k9-svc - -=== Prerequisites - -[arabic] -. An AUR account at https://aur.archlinux.org/ -. SSH key added to your AUR account -. `+git+` installed - -=== Submission Steps - -==== 1. Clone the AUR package base - -[source,bash] ----- -git clone ssh://aur@aur.archlinux.org/k9-svc.git aur-k9-svc -cd aur-k9-svc ----- - -If this fails (package doesn’t exist yet), it will create an empty repo. - -==== 2. Copy package files - -[source,bash] ----- -cp /path/to/k9-svc/packaging/aur/PKGBUILD . -cp /path/to/k9-svc/packaging/aur/.SRCINFO . ----- - -==== 3. Verify the PKGBUILD - -[source,bash] ----- -# Check PKGBUILD syntax -namcap PKGBUILD - -# Test build locally -makepkg -si ----- - -==== 4. Commit and push - -[source,bash] ----- -git add PKGBUILD .SRCINFO -git commit -m "Initial upload: k9-svc 1.0.0" -git push origin master ----- - -=== Updating the Package - -When releasing a new version: - -[arabic] -. Update `+pkgver+` in PKGBUILD -. Update `+sha256sums+` (run `+updpkgsums+`) -. Regenerate .SRCINFO: `+makepkg --printsrcinfo > .SRCINFO+` -. Commit and push - -=== Package Details - -* *Package name*: k9-svc -* *Version*: 1.0.0 -* *Dependencies*: nickel, just, openssl -* *Optional*: podman, asciidoctor -* *License*: PMPL-1.0-or-later - -=== Testing - -After installation, verify with: - -[source,bash] ----- -k9 status -k9 typecheck -k9 test ----- - -=== Maintainer - -hyperpolymath hyperpolymath@users.noreply.github.com diff --git a/k9-svc/packaging/homebrew/k9-svc.rb b/k9-svc/packaging/homebrew/k9-svc.rb deleted file mode 100644 index 64cc3b96..00000000 --- a/k9-svc/packaging/homebrew/k9-svc.rb +++ /dev/null @@ -1,72 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Homebrew formula for K9 SVC -# -# To install: -# brew tap hyperpolymath/k9 -# brew install k9-svc -# -# Or directly: -# brew install --HEAD hyperpolymath/k9/k9-svc - -class K9Svc < Formula - desc "Self-Validating Components - a file format that eats its own dog food" - homepage "https://github.com/hyperpolymath/standards/tree/main/k9-svc" - url "https://github.com/hyperpolymath/standards/tree/main/k9-svc/archive/refs/tags/v1.0.0.tar.gz" - sha256 "82e51dec2891728d233392f6e84004e5d6060bf2c936dd47445d59ca66c09f94" - license "PMPL-1.0-or-later" - head "https://github.com/hyperpolymath/k9-svc.git", branch: "main" - - depends_on "nickel" - depends_on "just" - depends_on "openssl@3" - - def install - # Install scripts - bin.install "must" => "k9-must" - bin.install "sign.sh" => "k9-sign" - - # Install schemas and support files - (share/"k9").install "pedigree.ncl" - (share/"k9").install "register.ncl" - (share/"k9").install "leash.ncl" - (share/"k9").install "justfile" - - # Install examples - (share/"k9/examples").install Dir["examples/*"] - - # Install assets - (share/"k9/assets").install Dir["assets/*.svg"] - - # Install documentation - doc.install "README.adoc" - doc.install "SPEC.adoc" - doc.install "GUIDE.adoc" - - # Create wrapper script - (bin/"k9").write <<~EOS - #!/bin/sh - # K9 SVC wrapper - runs just with K9 recipes - exec just --justfile #{share}/k9/justfile "$@" - EOS - end - - def post_install - # Note about MIME setup - ohai "K9 SVC installed!" - ohai "Run 'k9 setup-mime' to register MIME types" - end - - test do - # Test must shim - assert_match "K9 Environment", shell_output("#{bin}/k9-must status") - - # Test schema validation - system "nickel", "typecheck", "#{share}/k9/pedigree.ncl" - - # Test key generation (in temp dir) - ENV["XDG_CONFIG_HOME"] = testpath - system "#{bin}/k9-sign", "keygen", "test" - assert_predicate testpath/"k9/keys/test.key", :exist? - assert_predicate testpath/"k9/keys/test.pub", :exist? - end -end diff --git a/k9-svc/pandoc/.devcontainer/Containerfile b/k9-svc/pandoc/.devcontainer/Containerfile deleted file mode 100644 index b0a6fd1b..00000000 --- a/k9-svc/pandoc/.devcontainer/Containerfile +++ /dev/null @@ -1,32 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Dev Container image for {{PROJECT_NAME}} -# Base: Chainguard Wolfi (minimal, supply-chain-secure) -# Build: podman build -t {{PROJECT_NAME}}-dev -f .devcontainer/Containerfile . - -FROM cgr.dev/chainguard/wolfi-base:latest - -# Install common development tools -RUN apk update && apk add --no-cache \ - bash \ - curl \ - git \ - openssh-client \ - ca-certificates \ - build-base \ - posix-libc-utils \ - shadow \ - && rm -rf /var/cache/apk/* - -# Create non-root dev user (matches devcontainer.json remoteUser) -RUN groupadd -g 1000 nonroot || true \ - && useradd -m -u 1000 -g 1000 -s /bin/bash nonroot || true - -# Set workspace directory -WORKDIR /workspaces/{{PROJECT_NAME}} - -# Default shell -ENV SHELL=/bin/bash - -USER nonroot diff --git a/k9-svc/pandoc/.devcontainer/README.adoc b/k9-svc/pandoc/.devcontainer/README.adoc deleted file mode 100644 index 3bfb50e5..00000000 --- a/k9-svc/pandoc/.devcontainer/README.adoc +++ /dev/null @@ -1,27 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Dev Container Usage -:author: {{AUTHOR}} <{{AUTHOR_EMAIL}}> - -== Overview - -This dev container uses `cgr.dev/chainguard/wolfi-base` with git, curl, bash, and just pre-installed. Dev container features add git, just, and nickel automatically. - -== VS Code (Local) - -. Install the *Dev Containers* extension (`ms-vscode-remote.remote-containers`). -. Set `dev.containers.dockerPath` to `podman` in VS Code settings. -. Open the repo folder, then choose **Reopen in Container** from the command palette. - -== GitHub Codespaces - -. From the repository on GitHub, click **Code > Codespaces > New codespace**. -. The container builds automatically from this configuration. - -== Gitpod - -. Prefix the repo URL with `https://gitpod.io/#` to launch a workspace. -. Gitpod reads `devcontainer.json` and builds the environment. - -== Customization - -Replace `{{PROJECT_NAME}}` placeholders in both `devcontainer.json` and `Containerfile` with your actual project name. Run `just deps` to verify the environment after first launch. diff --git a/k9-svc/pandoc/.devcontainer/devcontainer.json b/k9-svc/pandoc/.devcontainer/devcontainer.json deleted file mode 100644 index a4b33e0a..00000000 --- a/k9-svc/pandoc/.devcontainer/devcontainer.json +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -// -// Dev Container configuration for {{PROJECT_NAME}} -// Works with: VS Code Dev Containers, GitHub Codespaces, Gitpod -// Container runtime: Podman (recommended) or any OCI-compliant runtime -{ - "name": "{{PROJECT_NAME}}", - - "build": { - "dockerfile": "Containerfile", - "context": ".." - }, - - "features": { - "ghcr.io/devcontainers/features/git:1": { - "ppa": false, - "version": "latest" - }, - "ghcr.io/jdx/devcontainer-features/just:1": {}, - "ghcr.io/nickel-lang/devcontainer-feature:0": {} - }, - - "postCreateCommand": "just deps", - - "remoteUser": "nonroot", - - "containerEnv": { - "EDITOR": "code --wait", - "LANG": "C.UTF-8" - }, - - "customizations": { - "vscode": { - "extensions": [ - "EditorConfig.EditorConfig", - "eamodio.gitlens", - "streetsidesoftware.code-spell-checker", - "timonwong.shellcheck", - "tamasfe.even-better-toml", - "skellock.just", - "redhat.vscode-yaml", - "DavidAnson.vscode-markdownlint", - "asciidoctor.asciidoctor-vscode", - "usernamehw.errorlens" - ], - "settings": { - "editor.formatOnSave": true, - "editor.insertSpaces": true, - "editor.tabSize": 2, - "files.trimTrailingWhitespace": true, - "files.insertFinalNewline": true, - "files.trimFinalNewlines": true, - "[makefile]": { - "editor.insertSpaces": false - } - } - }, - "codespaces": { - "openFiles": [ - "README.adoc" - ] - } - }, - - "forwardPorts": [], - - "shutdownAction": "stopContainer" -} diff --git a/k9-svc/pandoc/.editorconfig b/k9-svc/pandoc/.editorconfig deleted file mode 100644 index bcdbb4de..00000000 --- a/k9-svc/pandoc/.editorconfig +++ /dev/null @@ -1,65 +0,0 @@ -# RSR-template-repo - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - diff --git a/k9-svc/pandoc/.envrc b/k9-svc/pandoc/.envrc deleted file mode 100644 index 4ca685b4..00000000 --- a/k9-svc/pandoc/.envrc +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Activate development environment -# Install direnv: https://direnv.net/ - -# Load .tool-versions if asdf is available -if has asdf; then - use asdf -fi - -# Load Guix shell if guix.scm exists -if has guix && [ -f guix.scm ]; then - use guix -fi - -# Load Nix flake if flake.nix exists -if has nix && [ -f flake.nix ]; then - use flake -fi - -# Project environment variables -export PROJECT_NAME="{{PROJECT_NAME}}" -export RSR_TIER="infrastructure" -# export DATABASE_URL= -# export API_KEY= - -# Source .env if it exists (gitignored) -dotenv_if_exists diff --git a/k9-svc/pandoc/.gitattributes b/k9-svc/pandoc/.gitattributes deleted file mode 100644 index c95d5ebd..00000000 --- a/k9-svc/pandoc/.gitattributes +++ /dev/null @@ -1,55 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.a2ml text eol=lf linguist-language=TOML -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -Justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/k9-svc/pandoc/.github/.mailmap b/k9-svc/pandoc/.github/.mailmap deleted file mode 100644 index 0ada9de5..00000000 --- a/k9-svc/pandoc/.github/.mailmap +++ /dev/null @@ -1 +0,0 @@ -{{AUTHOR}} <{{AUTHOR_EMAIL}}> <{{AUTHOR_EMAIL_ALT}}> diff --git a/k9-svc/pandoc/.github/.nojekyll b/k9-svc/pandoc/.github/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/.github/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/.github/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 85b2f0f0..00000000 --- a/k9-svc/pandoc/.github/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: .github diff --git a/k9-svc/pandoc/.github/CODEOWNERS b/k9-svc/pandoc/.github/CODEOWNERS deleted file mode 100644 index 611b5a84..00000000 --- a/k9-svc/pandoc/.github/CODEOWNERS +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# CODEOWNERS - Define code review assignments -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners -# -# Replace {{OWNER}} with your GitHub username or team - -# Default owners for everything -* @{{OWNER}} - -# Security-sensitive files require explicit review -SECURITY.md @{{OWNER}} -.github/workflows/ @{{OWNER}} -Trustfile.a2ml @{{OWNER}} -.machine_readable/ @{{OWNER}} diff --git a/k9-svc/pandoc/.github/CODE_OF_CONDUCT.md b/k9-svc/pandoc/.github/CODE_OF_CONDUCT.md deleted file mode 100644 index 2777a724..00000000 --- a/k9-svc/pandoc/.github/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,327 +0,0 @@ -# Code of Conduct - - - -## Our Pledge - -We as members, contributors, and leaders pledge to make participation in {{PROJECT_NAME}} a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, colour, religion, or sexual identity and orientation. - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. - -We recognise that a thriving open source community requires **psychological safety** — an environment where people can contribute, ask questions, make mistakes, and learn without fear of ridicule or retaliation. - ---- - -## Our Standards - -### Expected Behaviour - -The following behaviours contribute to a positive environment: - -**Communication** -- Using welcoming and inclusive language -- Being respectful of differing viewpoints and experiences -- Giving and gracefully accepting constructive feedback -- Assuming good intent while addressing impact -- Communicating clearly and patiently, especially with newcomers - -**Collaboration** -- Focusing on what is best for the community -- Showing empathy and kindness toward other community members -- Being collaborative rather than competitive -- Mentoring and supporting less experienced contributors -- Celebrating others' contributions and successes - -**Professionalism** -- Accepting responsibility and apologising to those affected by our mistakes -- Learning from the experience and avoiding repetition -- Respecting others' time and attention -- Staying on topic in project spaces -- Following project guidelines and conventions - -**Accessibility** -- Using plain language and avoiding unnecessary jargon -- Providing alt text for images and transcripts for audio/video -- Being patient with those using assistive technologies -- Accommodating different communication styles and needs -- Recognising that not everyone communicates the same way - -### Unacceptable Behaviour - -The following behaviours are considered harassment and are unacceptable: - -**Harassment** -- The use of sexualised language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Deliberate intimidation, stalking, or following (online or in-person) -- Unwelcome physical contact or simulated physical contact (e.g., emoji) -- Sustained disruption of talks, events, or online discussions - -**Discrimination** -- Discriminatory jokes and language -- Posting or threatening to post others' personally identifying information ("doxing") -- Advocating for, or encouraging, any of the above behaviour -- Microaggressions — subtle, often unintentional, discriminatory comments or actions - -**Professional Misconduct** -- Publishing others' private information without explicit permission -- Misrepresenting affiliation or contributions -- Plagiarism or claiming credit for others' work -- Retaliating against anyone who reports a Code of Conduct violation -- Other conduct which could reasonably be considered inappropriate in a professional setting - -### Grey Areas - -Some situations require judgement. When uncertain: - -- **Intent vs Impact**: Good intentions do not excuse harmful impact. Focus on making things right. -- **Power Dynamics**: Those with more power (maintainers, employers, experienced contributors) must be especially mindful of their impact. -- **Cultural Differences**: What's acceptable varies by culture. When in doubt, err on the side of caution and ask. -- **Humour**: Jokes at others' expense are rarely funny to everyone. Punch up, not down. - ---- - -## Scope - -This Code of Conduct applies within all community spaces, including: - -**Online Spaces** -- Repository discussions, issues, and pull/merge requests -- Project chat channels (Matrix, Discord, Slack, IRC) -- Mailing lists and forums -- Social media when representing the project -- Video calls and virtual meetings - -**In-Person Spaces** -- Conferences, meetups, and events -- Workshops and training sessions -- Any gathering where you represent the project - -**Representation** -This Code of Conduct also applies when an individual is officially representing the community in public spaces. Examples include: - -- Using an official project email address -- Posting via an official social media account -- Acting as an appointed representative at an event -- Speaking on behalf of the project - ---- - -## Enforcement - -### Reporting - -If you experience or witness unacceptable behaviour, or have any other concerns, please report it as soon as possible. - -**How to Report** - -| Method | Details | Best For | -|--------|---------|----------| -| **Email** | {{CONDUCT_EMAIL}} | Detailed reports, sensitive matters | -| **Private Message** | Contact any maintainer directly | Quick questions, minor issues | -| **Anonymous Form** | [Link to form if available] | When you need anonymity | - -**What to Include** - -- Your contact information (unless anonymous) -- Names/usernames of those involved -- Description of what happened -- When and where it occurred -- Any witnesses -- Any supporting evidence (screenshots, links) -- How you would like us to respond (if you have a preference) - -**What Happens Next** - -1. You will receive acknowledgment within **{{RESPONSE_TIME}}** -2. The {{CONDUCT_TEAM}} will review the report -3. We may ask for additional information -4. We will determine appropriate action -5. We will inform you of the outcome (respecting others' privacy) - -### Confidentiality - -All reports will be handled with discretion: - -- Reporter identity is protected by default -- Details are shared only with those who need to know -- We will ask before naming you in any communication -- Anonymous reports are accepted and investigated - -### Conflicts of Interest - -If a {{CONDUCT_TEAM}} member is involved in an incident: - -- They will recuse themselves from the process -- Another maintainer or external party will handle the report -- We will disclose any potential conflicts - ---- - -## Enforcement Guidelines - -The {{CONDUCT_TEAM}} will follow these guidelines in determining consequences: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behaviour deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning providing clarity around the nature of the violation and an explanation of why the behaviour was inappropriate. A public apology may be requested. - -**Duration**: Immediate - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behaviour. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -**Duration**: 1-4 weeks - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behaviour. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -**Duration**: 1-6 months - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behaviour, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -**Duration**: Permanent (with appeal rights after 12 months) - -### Enforcement Across Perimeters - -For contributors with elevated access (Perimeter 2 or 1): - -| Level | Additional Consequence | -|-------|----------------------| -| Correction | Noted in contributor record | -| Warning | Access privileges may be temporarily reduced | -| Temporary Ban | Access reduced to Perimeter 3 for ban duration | -| Permanent Ban | All access revoked | - ---- - -## Appeals - -If you believe an enforcement decision was made in error: - -1. **Wait 7 days** after the decision (cooling-off period) -2. **Email** {{CONDUCT_EMAIL}} with subject line "Appeal: [Original Report ID]" -3. **Explain** why you believe the decision should be reconsidered -4. **Provide** any new information not previously available - -**Appeals Process** - -- Appeals are reviewed by a different {{CONDUCT_TEAM}} member than the original -- You will receive a response within 14 days -- The appeals decision is final -- You may only appeal once per incident - -**Grounds for Appeal** - -- Procedural errors in the original investigation -- New evidence not previously available -- Disproportionate response to the violation -- Misunderstanding of facts - ---- - -## Supporting Those Who Report - -We are committed to supporting those who report violations: - -**We Will** -- Believe and take all reports seriously -- Respect your privacy and confidentiality preferences -- Keep you informed of progress (if you wish) -- Take steps to protect you from retaliation -- Provide resources if you need support - -**We Will Not** -- Require you to confront the person directly -- Dismiss reports without investigation -- Reveal your identity without consent -- Tolerate retaliation against reporters -- Rush you to make decisions - ---- - -## Prevention - -Beyond enforcement, we actively work to prevent issues: - -**Onboarding** -- All contributors are expected to read this Code of Conduct -- Perimeter 2 applicants must confirm they've read and understood it -- Maintainers receive additional training on enforcement - -**Culture** -- We model the behaviour we expect -- We intervene early when we see potential issues -- We thank people for positive contributions -- We create opportunities for diverse voices - -**Review** -- This Code of Conduct is reviewed annually -- Community feedback is welcomed -- Changes are communicated clearly - ---- - -## Acknowledgments - -This Code of Conduct is adapted from: - -- [Contributor Covenant](https://www.contributor-covenant.org/), version 2.1 -- [Django Code of Conduct](https://www.djangoproject.com/conduct/) -- [Rust Code of Conduct](https://www.rust-lang.org/policies/code-of-conduct) -- [Python Community Code of Conduct](https://www.python.org/psf/conduct/) - -We thank these communities for their leadership in creating welcoming spaces. - ---- - -## Questions? - -If you have questions about this Code of Conduct: - -- Open a [Discussion](https://{{FORGE}}/{{OWNER}}/{{REPO}}/discussions) (for general questions) -- Email {{CONDUCT_EMAIL}} (for private questions) -- Contact any maintainer directly - ---- - -## Summary - -**Be kind. Be respectful. Be collaborative.** - -We're all here because we care about this project. Let's make it a place where everyone can do their best work. - ---- - -Last updated: {{CURRENT_YEAR}} · Based on Contributor Covenant 2.1 diff --git a/k9-svc/pandoc/.github/CONTRIBUTING.md b/k9-svc/pandoc/.github/CONTRIBUTING.md deleted file mode 100644 index 02758c67..00000000 --- a/k9-svc/pandoc/.github/CONTRIBUTING.md +++ /dev/null @@ -1,121 +0,0 @@ -# Clone the repository -git clone https://{{FORGE}}/{{OWNER}}/{{REPO}}.git -cd {{REPO}} - -# Using Nix (recommended for reproducibility) -nix develop - -# Or using toolbox/distrobox -toolbox create {{REPO}}-dev -toolbox enter {{REPO}}-dev -# Install dependencies manually - -# Verify setup -just check # or: cargo check / mix compile / etc. -just test # Run test suite -``` - -### Repository Structure -``` -{{REPO}}/ -├── src/ # Source code (Perimeter 1-2) -├── lib/ # Library code (Perimeter 1-2) -├── extensions/ # Extensions (Perimeter 2) -├── plugins/ # Plugins (Perimeter 2) -├── tools/ # Tooling (Perimeter 2) -├── docs/ # Documentation (Perimeter 3) -│ ├── architecture/ # ADRs, specs (Perimeter 2) -│ └── proposals/ # RFCs (Perimeter 3) -├── examples/ # Examples (Perimeter 3) -├── spec/ # Spec tests (Perimeter 3) -├── tests/ # Test suite (Perimeter 2-3) -├── .machine_readable/ # ALL machine-readable content (Perimeter 1) -│ ├── *.a2ml # State files (STATE, META, ECOSYSTEM, etc.) -│ ├── bot_directives/ # Bot configs -│ └── contractiles/ # Policy contracts (k9, dust, lust, must, trust) -├── .well-known/ # Protocol files (Perimeter 1-3) -├── .github/ # GitHub config (Perimeter 1) -│ ├── ISSUE_TEMPLATE/ -│ └── workflows/ -├── CHANGELOG.md -├── CODE_OF_CONDUCT.md -├── CONTRIBUTING.md # This file -├── GOVERNANCE.md -├── LICENSE -├── MAINTAINERS.md -├── README.adoc -├── SECURITY.md -├── flake.nix # Nix flake — fallback (Perimeter 1) -├── guix.scm # Guix package — primary (Perimeter 1) -└── Justfile # Task runner (Perimeter 1) -``` - ---- - -## How to Contribute - -### Reporting Bugs - -**Before reporting**: -1. Search existing issues -2. Check if it's already fixed in `{{MAIN_BRANCH}}` -3. Determine which perimeter the bug affects - -**When reporting**: - -Use the [bug report template](.github/ISSUE_TEMPLATE/bug_report.md) and include: - -- Clear, descriptive title -- Environment details (OS, versions, toolchain) -- Steps to reproduce -- Expected vs actual behaviour -- Logs, screenshots, or minimal reproduction - -### Suggesting Features - -**Before suggesting**: -1. Check the [roadmap](ROADMAP.md) if available -2. Search existing issues and discussions -3. Consider which perimeter the feature belongs to - -**When suggesting**: - -Use the [feature request template](.github/ISSUE_TEMPLATE/feature_request.md) and include: - -- Problem statement (what pain point does this solve?) -- Proposed solution -- Alternatives considered -- Which perimeter this affects - -### Your First Contribution - -Look for issues labelled: - -- [`good first issue`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/good%20first%20issue) — Simple Perimeter 3 tasks -- [`help wanted`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/help%20wanted) — Community help needed -- [`documentation`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/documentation) — Docs improvements -- [`perimeter-3`](https://{{FORGE}}/{{OWNER}}/{{REPO}}/labels/perimeter-3) — Community sandbox scope - ---- - -## Development Workflow - -### Branch Naming -``` -docs/short-description # Documentation (P3) -test/what-added # Test additions (P3) -feat/short-description # New features (P2) -fix/issue-number-description # Bug fixes (P2) -refactor/what-changed # Code improvements (P2) -security/what-fixed # Security fixes (P1-2) -``` - -### Commit Messages - -We follow [Conventional Commits](https://www.conventionalcommits.org/): -``` -(): - -[optional body] - -[optional footer] diff --git a/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/ideas.yml b/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/ideas.yml deleted file mode 100644 index ef912f85..00000000 --- a/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/ideas.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [enhancement] -body: - - type: textarea - attributes: - label: Idea - description: Describe your idea - validations: - required: true - - type: textarea - attributes: - label: Motivation - description: Why would this be useful? diff --git a/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/q-and-a.yml b/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/q-and-a.yml deleted file mode 100644 index df4ec200..00000000 --- a/k9-svc/pandoc/.github/DISCUSSION_TEMPLATE/q-and-a.yml +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -labels: [question] -body: - - type: textarea - attributes: - label: Question - description: What would you like to know? - validations: - required: true - - type: textarea - attributes: - label: Context - description: Any relevant background diff --git a/k9-svc/pandoc/.github/FUNDING.yml b/k9-svc/pandoc/.github/FUNDING.yml deleted file mode 100644 index c078261e..00000000 --- a/k9-svc/pandoc/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for {{OWNER}} projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: {{OWNER}} -ko_fi: {{OWNER}} -liberapay: {{OWNER}} diff --git a/k9-svc/pandoc/.github/GOVERNANCE.md b/k9-svc/pandoc/.github/GOVERNANCE.md deleted file mode 100644 index fcbcec0c..00000000 --- a/k9-svc/pandoc/.github/GOVERNANCE.md +++ /dev/null @@ -1,158 +0,0 @@ - - -# Project Governance - -This document describes the governance model for **{{PROJECT_NAME}}**. - ---- - -## Project Governance Model - -{{PROJECT_NAME}} follows a **Benevolent Dictator For Life (BDFL)** governance model. -This model is well-suited for solo maintainers and small project teams where rapid, -consistent decision-making is more valuable than formal consensus processes. - -The BDFL has final authority on all project decisions, including technical direction, -release schedules, contributor access, and community standards. - -> **Transition clause:** When the core team exceeds three active maintainers, this -> project should transition to a **consensus-based governance model** with documented -> voting procedures. That transition should itself be recorded as an Architecture -> Decision Record (ADR) in `docs/decisions/`. - ---- - -## Decision Making - -### Day-to-day decisions - -- The BDFL makes final decisions on all matters. -- Routine decisions (bug fixes, dependency updates, minor improvements) may be made - by any maintainer with commit access. -- Maintainers are expected to use good judgement and seek input on non-trivial changes. - -### Proposing changes - -- Contributors can propose changes by opening issues or pull requests. -- Significant changes (new features, breaking changes, architectural shifts) should - be discussed in an issue before implementation begins. -- The BDFL will provide a clear accept/reject decision with reasoning. - -### Architecture Decision Records (ADRs) - -- Significant technical decisions are documented as ADRs in `docs/decisions/`. -- ADR statuses: `proposed`, `accepted`, `deprecated`, `superseded`, `rejected`. -- ADRs provide a historical record of why decisions were made and what alternatives - were considered. -- See `.machine_readable/META.a2ml` for the machine-readable ADR index. - ---- - -## Roles - -### BDFL (Benevolent Dictator For Life) - -- The project creator and ultimate decision-maker. -- Sets the project's technical direction and long-term vision. -- Has final say on all matters, including maintainer appointments and removals. -- Responsible for ensuring the project adheres to RSR standards. - -### Maintainer - -- Has commit access to the repository. -- Reviews and merges pull requests. -- Triages issues and manages releases. -- Upholds code quality, security standards, and the Code of Conduct. -- Listed in [MAINTAINERS.md](MAINTAINERS.md). - -### Contributor - -- Anyone who submits pull requests, opens issues, or participates in discussions. -- Does not have direct commit access. -- Contributions are reviewed by maintainers before merging. -- All contributors must follow the [Code of Conduct](CODE_OF_CONDUCT.md). - -### Bot - -- Automated agents managed via your bot orchestration system. -- Perform automated code review, security scanning, dependency updates, and - standards enforcement. -- Bot actions are subject to the same quality and review standards as human - contributions. -- Configure your bots in `.machine_readable/bot_directives/`. - ---- - -## Becoming a Maintainer - -A contributor may be nominated to become a maintainer when they demonstrate: - -1. **Sustained quality contributions** -- a track record of well-crafted pull requests - that follow project conventions and require minimal revision. -2. **Understanding of RSR standards** -- familiarity with the Repository Structure - Requirements, security policies, and CI/CD workflows used across the project. -3. **Constructive participation** -- helpful issue triage, thoughtful code review - comments, and mentoring of other contributors. -4. **Reliability** -- consistent engagement over a meaningful period (typically 3+ - months of active contribution). - -### Process - -1. An existing maintainer nominates the candidate by opening a private discussion - with the BDFL. -2. The BDFL reviews the candidate's contribution history and community interactions. -3. The BDFL approves or declines the nomination, with reasoning provided to the - nominator. -4. If approved, the new maintainer is added to [MAINTAINERS.md](MAINTAINERS.md) and - granted appropriate repository access. - ---- - -## Removing a Maintainer - -A maintainer may be removed under the following circumstances: - -- **Inactivity**: No meaningful contributions or reviews for 12 or more consecutive - months. The maintainer will be contacted before removal and offered the option to - move to emeritus status voluntarily. -- **Code of Conduct violation**: Behaviour that violates the - [Code of Conduct](CODE_OF_CONDUCT.md), as determined through the enforcement - process described therein. -- **BDFL discretion**: The BDFL may remove a maintainer for other reasons (e.g., - repeated disregard for project standards, loss of trust). Reasoning will be - documented privately. - -Removed maintainers are moved to the Emeritus section of -[MAINTAINERS.md](MAINTAINERS.md) unless removal was due to a serious Code of Conduct -violation. - ---- - -## Code of Conduct - -All participants in this project are expected to follow the -[Code of Conduct](CODE_OF_CONDUCT.md). The Code of Conduct applies to all project -spaces, including issues, pull requests, discussions, and any forum where the project -is represented. - -Enforcement of the Code of Conduct is described in that document. The BDFL serves as -the final arbiter in conduct disputes. - ---- - -## Amendments - -This governance document may be amended by the BDFL at any time. All amendments will -be: - -1. Documented as an ADR in `docs/decisions/` explaining the rationale for the change. -2. Committed to the repository with a clear commit message. -3. Communicated to existing maintainers and contributors via the project's usual - channels. - -Substantive changes (e.g., changing the governance model itself) should be discussed -with the community before adoption, even though the BDFL retains final authority. - ---- - -Copyright (c) {{CURRENT_YEAR}} {{OWNER}}. Licensed under PMPL-1.0-or-later. diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/bug_report.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index ec2aa283..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,127 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Bug report issue template for {{OWNER}}/{{REPO}} -name: Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for taking the time to report a bug. Please fill out the sections below - so we can reproduce and fix the issue. - - - type: textarea - id: description - attributes: - label: Describe the bug - description: A clear and concise description of what the bug is. - placeholder: When I do X, Y happens instead of Z. - validations: - required: true - - - type: textarea - id: reproduction - attributes: - label: Steps to reproduce - description: Detailed steps to reproduce the behavior. - placeholder: | - 1. Go to '...' - 2. Run command '...' - 3. See error - value: | - 1. - 2. - 3. - validations: - required: true - - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - placeholder: I expected X to happen. - validations: - required: true - - - type: textarea - id: actual - attributes: - label: Actual behavior - description: What actually happened instead. - placeholder: Instead, Y happened. - validations: - required: true - - - type: textarea - id: screenshots - attributes: - label: Screenshots or logs - description: If applicable, add screenshots or paste error logs to help explain the problem. - placeholder: Paste screenshots or error output here. - render: text - validations: - required: false - - - type: dropdown - id: severity - attributes: - label: Severity - description: How severe is this bug? - options: - - Low (cosmetic, minor inconvenience) - - Medium (functionality impaired but workaround exists) - - High (major functionality broken) - - Critical (data loss, security issue, complete failure) - validations: - required: true - - - type: input - id: os - attributes: - label: Operating system - description: What OS are you using? - placeholder: "e.g. Fedora 43, macOS 15.3, Windows 11" - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: input - id: runtime - attributes: - label: Runtime / toolchain - description: Relevant runtime or toolchain version, if applicable. - placeholder: "e.g. Deno 2.1, Rust nightly 2026-02-10, Gleam 1.8" - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context about the problem here. - placeholder: Any other relevant information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I am using a supported version of this project - required: false - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/config.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index cb7a33cb..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Issue template chooser configuration for {{OWNER}}/{{REPO}} -blank_issues_enabled: true -contact_links: - - name: Discussions - url: https://github.com/{{OWNER}}/{{REPO}}/discussions - about: Ask questions, share ideas, or start a conversation in Discussions. - - name: Security Vulnerabilities - url: https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new - about: Report security vulnerabilities privately via GitHub Security Advisories. diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/custom.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/custom.yml deleted file mode 100644 index 6aa9e631..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/custom.yml +++ /dev/null @@ -1,76 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Custom issue template for {{OWNER}}/{{REPO}} -name: Other -description: Report an issue that does not fit the other categories -title: "" -labels: ["triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Use this template for issues that do not fit into bug reports, feature requests, - documentation, or questions. Please provide as much detail as possible. - - - type: dropdown - id: category - attributes: - label: Issue category - description: What best describes this issue? - options: - - Refactoring - - Technical debt - - Build / CI issue - - Dependency update - - Security concern - - Licensing question - - Ecosystem integration - - Other - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: Clearly describe what this issue is about. - placeholder: Provide a detailed description of the issue. - validations: - required: true - - - type: textarea - id: rationale - attributes: - label: Rationale - description: Why is this important? What is the impact of not addressing it? - placeholder: "This matters because..." - validations: - required: false - - - type: textarea - id: proposal - attributes: - label: Proposed approach - description: If you have a plan or approach in mind, describe it here. - placeholder: "I suggest we..." - validations: - required: false - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, links, or references. - placeholder: Any supplementary information. - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to address this - required: false diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/documentation.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/documentation.yml deleted file mode 100644 index 88e07205..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/documentation.yml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Documentation issue template for {{OWNER}}/{{REPO}} -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - description: What kind of documentation problem is this? - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Incomplete (partially documented) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: "README.adoc, section \"Installation\"" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What is the problem with the current documentation? - placeholder: Describe what is wrong or missing. - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should the documentation be fixed or improved? - placeholder: "The documentation should say..." - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I have searched existing issues to ensure this is not a duplicate - required: true - - label: I would be willing to submit a PR to fix this - required: false diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/feature_request.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/feature_request.yml deleted file mode 100644 index 6d88090c..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/feature_request.yml +++ /dev/null @@ -1,87 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Feature request issue template for {{OWNER}}/{{REPO}} -name: Feature Request -description: Suggest an idea or enhancement for this project -title: "[Feature]: " -labels: ["enhancement", "priority: unset", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Thank you for suggesting a feature. Please describe your idea clearly so we can - evaluate and prioritize it. - - - type: textarea - id: problem - attributes: - label: Problem statement - description: Is your feature request related to a problem? Describe the pain point. - placeholder: "I'm always frustrated when [...]. Currently there is no way to [...]." - validations: - required: true - - - type: textarea - id: solution - attributes: - label: Proposed solution - description: A clear and concise description of what you want to happen. - placeholder: "I'd like a command/option/feature that [...]." - validations: - required: true - - - type: textarea - id: alternatives - attributes: - label: Alternatives considered - description: Any alternative solutions or features you have considered. - placeholder: "I considered using X, but it doesn't work because [...]." - validations: - required: false - - - type: dropdown - id: category - attributes: - label: Category - description: What area does this feature relate to? - options: - - Core functionality - - Developer experience - - Performance - - Documentation - - CI/CD / Tooling - - Integration / Interop - - Security - - Accessibility - - Other - validations: - required: true - - - type: dropdown - id: priority - attributes: - label: Importance to you - description: How important is this feature for your use case? - options: - - Nice to have - - Important (would improve my workflow) - - Critical (blocking my use case) - validations: - required: true - - - type: textarea - id: additional - attributes: - label: Additional context - description: Add any other context, screenshots, mockups, or references about the feature request. - placeholder: Links, screenshots, related projects, etc. - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to implement this feature - required: false diff --git a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/question.yml b/k9-svc/pandoc/.github/ISSUE_TEMPLATE/question.yml deleted file mode 100644 index 48bb574e..00000000 --- a/k9-svc/pandoc/.github/ISSUE_TEMPLATE/question.yml +++ /dev/null @@ -1,60 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Question issue template for {{OWNER}}/{{REPO}} -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -assignees: [] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in - [Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) - for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: "How do I...?" - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question. - placeholder: "I'm trying to achieve X and I've tried Y..." - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I have already tried - description: What have you already looked at or attempted? - placeholder: "I've read the README and searched issues but..." - validations: - required: false - - - type: input - id: version - attributes: - label: Version - description: What version of this project are you using? - placeholder: "e.g. 1.2.3, commit abc1234, main branch" - validations: - required: false - - - type: checkboxes - id: checklist - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the available documentation - required: true diff --git a/k9-svc/pandoc/.github/MAINTAINERS b/k9-svc/pandoc/.github/MAINTAINERS deleted file mode 100644 index 145c4e96..00000000 --- a/k9-svc/pandoc/.github/MAINTAINERS +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# MAINTAINERS - Project maintainers and contact information -# -# Format: Name (role) -# Replace placeholders with actual maintainer information. - -{{AUTHOR}} <{{AUTHOR_EMAIL}}> (Lead Maintainer) - -# Additional maintainers: -# Name (role) diff --git a/k9-svc/pandoc/.github/README.adoc b/k9-svc/pandoc/.github/README.adoc deleted file mode 100644 index a97d2202..00000000 --- a/k9-svc/pandoc/.github/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .github Pillar diff --git a/k9-svc/pandoc/.github/SECURITY.md b/k9-svc/pandoc/.github/SECURITY.md deleted file mode 100644 index 7dd7b29e..00000000 --- a/k9-svc/pandoc/.github/SECURITY.md +++ /dev/null @@ -1,406 +0,0 @@ -# Security Policy - - - -We take security seriously. We appreciate your efforts to responsibly disclose vulnerabilities and will make every effort to acknowledge your contributions. - -## Table of Contents - -- [Reporting a Vulnerability](#reporting-a-vulnerability) -- [What to Include](#what-to-include) -- [Response Timeline](#response-timeline) -- [Disclosure Policy](#disclosure-policy) -- [Scope](#scope) -- [Safe Harbour](#safe-harbour) -- [Recognition](#recognition) -- [Security Updates](#security-updates) -- [Security Best Practices](#security-best-practices) - ---- - -## Reporting a Vulnerability - -### Preferred Method: GitHub Security Advisories - -The preferred method for reporting security vulnerabilities is through GitHub's Security Advisory feature: - -1. Navigate to [Report a Vulnerability](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) -2. Click **"Report a vulnerability"** -3. Complete the form with as much detail as possible -4. Submit — we'll receive a private notification - -This method ensures: - -- End-to-end encryption of your report -- Private discussion space for collaboration -- Coordinated disclosure tooling -- Automatic credit when the advisory is published - -### Alternative: Encrypted Email - -If you cannot use GitHub Security Advisories, you may email us directly: - -| | | -|---|---| -| **Email** | {{SECURITY_EMAIL}} | -| **PGP Key** | [Download Public Key]({{PGP_KEY_URL}}) | -| **Fingerprint** | `{{PGP_FINGERPRINT}}` | - -```bash -# Import our PGP key -curl -sSL {{PGP_KEY_URL}} | gpg --import - -# Verify fingerprint -gpg --fingerprint {{SECURITY_EMAIL}} - -# Encrypt your report -gpg --armor --encrypt --recipient {{SECURITY_EMAIL}} report.txt -``` - -> **⚠️ Important:** Do not report security vulnerabilities through public GitHub issues, pull requests, discussions, or social media. - ---- - -## What to Include - -A good vulnerability report helps us understand and reproduce the issue quickly. - -### Required Information - -- **Description**: Clear explanation of the vulnerability -- **Impact**: What an attacker could achieve (confidentiality, integrity, availability) -- **Affected versions**: Which versions/commits are affected -- **Reproduction steps**: Detailed steps to reproduce the issue - -### Helpful Additional Information - -- **Proof of concept**: Code, scripts, or screenshots demonstrating the vulnerability -- **Attack scenario**: Realistic attack scenario showing exploitability -- **CVSS score**: Your assessment of severity (use [CVSS 3.1 Calculator](https://www.first.org/cvss/calculator/3.1)) -- **CWE ID**: Common Weakness Enumeration identifier if known -- **Suggested fix**: If you have ideas for remediation -- **References**: Links to related vulnerabilities, research, or advisories - -### Example Report Structure - -```markdown -## Summary -[One-sentence description of the vulnerability] - -## Vulnerability Type -[e.g., SQL Injection, XSS, SSRF, Path Traversal, etc.] - -## Affected Component -[File path, function name, API endpoint, etc.] - -## Affected Versions -[Version range or specific commits] - -## Severity Assessment -- CVSS 3.1 Score: [X.X] -- CVSS Vector: [CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X] - -## Description -[Detailed technical description] - -## Steps to Reproduce -1. [First step] -2. [Second step] -3. [...] - -## Proof of Concept -[Code, curl commands, screenshots, etc.] - -## Impact -[What can an attacker achieve?] - -## Suggested Remediation -[Optional: your ideas for fixing] - -## References -[Links to related issues, CVEs, research] -``` - ---- - -## Response Timeline - -We commit to the following response times: - -| Stage | Timeframe | Description | -|-------|-----------|-------------| -| **Initial Response** | 48 hours | We acknowledge receipt and confirm we're investigating | -| **Triage** | 7 days | We assess severity, confirm the vulnerability, and estimate timeline | -| **Status Update** | Every 7 days | Regular updates on remediation progress | -| **Resolution** | 90 days | Target for fix development and release (complex issues may take longer) | -| **Disclosure** | 90 days | Public disclosure after fix is available (coordinated with you) | - -> **Note:** These are targets, not guarantees. Complex vulnerabilities may require more time. We'll communicate openly about any delays. - ---- - -## Disclosure Policy - -We follow **coordinated disclosure** (also known as responsible disclosure): - -1. **You report** the vulnerability privately -2. **We acknowledge** and begin investigation -3. **We develop** a fix and prepare a release -4. **We coordinate** disclosure timing with you -5. **We publish** security advisory and fix simultaneously -6. **You may publish** your research after disclosure - -### Our Commitments - -- We will not take legal action against researchers who follow this policy -- We will work with you to understand and resolve the issue -- We will credit you in the security advisory (unless you prefer anonymity) -- We will notify you before public disclosure -- We will publish advisories with sufficient detail for users to assess risk - -### Your Commitments - -- Report vulnerabilities promptly after discovery -- Give us reasonable time to address the issue before disclosure -- Do not access, modify, or delete data beyond what's necessary to demonstrate the vulnerability -- Do not degrade service availability (no DoS testing on production) -- Do not share vulnerability details with others until coordinated disclosure - -### Disclosure Timeline - -``` -Day 0 You report vulnerability -Day 1-2 We acknowledge receipt -Day 7 We confirm vulnerability and share initial assessment -Day 7-90 We develop and test fix -Day 90 Coordinated public disclosure - (earlier if fix is ready; later by mutual agreement) -``` - -If we cannot reach agreement on disclosure timing, we default to 90 days from your initial report. - ---- - -## Scope - -### In Scope ✅ - -The following are within scope for security research: - -- This repository (`{{OWNER}}/{{REPO}}`) and all its code -- Official releases and packages published from this repository -- Documentation that could lead to security issues -- Build and deployment configurations in this repository -- Dependencies (report here, we'll coordinate with upstream) - -### Out of Scope ❌ - -The following are **not** in scope: - -- Third-party services we integrate with (report directly to them) -- Social engineering attacks against maintainers -- Physical security -- Denial of service attacks against production infrastructure -- Spam, phishing, or other non-technical attacks -- Issues already reported or publicly known -- Theoretical vulnerabilities without proof of concept - -### Qualifying Vulnerabilities - -We're particularly interested in: - -- Remote code execution -- SQL injection, command injection, code injection -- Authentication/authorisation bypass -- Cross-site scripting (XSS) and cross-site request forgery (CSRF) -- Server-side request forgery (SSRF) -- Path traversal / local file inclusion -- Information disclosure (credentials, PII, secrets) -- Cryptographic weaknesses -- Deserialisation vulnerabilities -- Memory safety issues (buffer overflows, use-after-free, etc.) -- Supply chain vulnerabilities (dependency confusion, etc.) -- Significant logic flaws - -### Non-Qualifying Issues - -The following generally do not qualify as security vulnerabilities: - -- Missing security headers on non-sensitive pages -- Clickjacking on pages without sensitive actions -- Self-XSS (requires victim to paste code) -- Missing rate limiting (unless it enables a specific attack) -- Username/email enumeration (unless high-risk context) -- Missing cookie flags on non-sensitive cookies -- Software version disclosure -- Verbose error messages (unless exposing secrets) -- Best practice deviations without demonstrable impact - ---- - -## Safe Harbour - -We support security research conducted in good faith. - -### Our Promise - -If you conduct security research in accordance with this policy: - -- ✅ We will not initiate legal action against you -- ✅ We will not report your activity to law enforcement -- ✅ We will work with you in good faith to resolve issues -- ✅ We consider your research authorised under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and similar laws -- ✅ We waive any potential claim against you for circumvention of security controls - -### Good Faith Requirements - -To qualify for safe harbour, you must: - -- Comply with this security policy -- Report vulnerabilities promptly -- Avoid privacy violations (do not access others' data) -- Avoid service degradation (no destructive testing) -- Not exploit vulnerabilities beyond proof-of-concept -- Not use vulnerabilities for profit (beyond bug bounties where offered) - -> **⚠️ Important:** This safe harbour does not extend to third-party systems. Always check their policies before testing. - ---- - -## Recognition - -We believe in recognising security researchers who help us improve. - -### Hall of Fame - -Researchers who report valid vulnerabilities will be acknowledged in our [Security Acknowledgments](SECURITY-ACKNOWLEDGMENTS.md) (unless they prefer anonymity). - -Recognition includes: - -- Your name (or chosen alias) -- Link to your website/profile (optional) -- Brief description of the vulnerability class -- Date of report - -### What We Offer - -- ✅ Public credit in security advisories -- ✅ Acknowledgment in release notes -- ✅ Entry in our Hall of Fame -- ✅ Reference/recommendation letter upon request (for significant findings) - -### What We Don't Currently Offer - -- ❌ Monetary bug bounties -- ❌ Hardware or swag -- ❌ Paid security research contracts - -> **Note:** We're a community project with limited resources. Your contributions help everyone who uses this software. - ---- - -## Security Updates - -### Receiving Updates - -To stay informed about security updates: - -- **Watch this repository**: Click "Watch" → "Custom" → Select "Security alerts" -- **GitHub Security Advisories**: Published at [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- **Release notes**: Security fixes noted in [CHANGELOG](CHANGELOG.md) - -### Update Policy - -| Severity | Response | -|----------|----------| -| **Critical/High** | Patch release as soon as fix is ready | -| **Medium** | Included in next scheduled release (or earlier) | -| **Low** | Included in next scheduled release | - -### Supported Versions - - - -| Version | Supported | Notes | -|---------|-----------|-------| -| `main` branch | ✅ Yes | Latest development | -| Latest release | ✅ Yes | Current stable | -| Previous minor release | ✅ Yes | Security fixes backported | -| Older versions | ❌ No | Please upgrade | - ---- - -## Security Best Practices - -When using {{PROJECT_NAME}}, we recommend: - -### General - -- Keep dependencies up to date -- Use the latest stable release -- Subscribe to security notifications -- Review configuration against security documentation -- Follow principle of least privilege - -### For Contributors - -- Never commit secrets, credentials, or API keys -- Use signed commits (`git config commit.gpgsign true`) -- Review dependencies before adding them -- Run security linters locally before pushing -- Report any concerns about existing code - ---- - -## Additional Resources - -- [Our PGP Public Key]({{PGP_KEY_URL}}) -- [Security Advisories](https://github.com/{{OWNER}}/{{REPO}}/security/advisories) -- [Changelog](CHANGELOG.md) -- [Contributing Guidelines](CONTRIBUTING.md) -- [CVE Database](https://cve.mitre.org/) -- [CVSS Calculator](https://www.first.org/cvss/calculator/3.1) - ---- - -## Contact - -| Purpose | Contact | -|---------|---------| -| **Security issues** | [Report via GitHub](https://github.com/{{OWNER}}/{{REPO}}/security/advisories/new) or {{SECURITY_EMAIL}} | -| **General questions** | [GitHub Discussions](https://github.com/{{OWNER}}/{{REPO}}/discussions) | -| **Other enquiries** | See [README](README.md) for contact information | - ---- - -## Policy Changes - -This security policy may be updated from time to time. Significant changes will be: - -- Committed to this repository with a clear commit message -- Noted in the changelog -- Announced via GitHub Discussions (for major changes) - ---- - -*Thank you for helping keep {{PROJECT_NAME}} and its users safe.* 🛡️ - ---- - -Last updated: {{CURRENT_YEAR}} · Policy version: 1.0.0 diff --git a/k9-svc/pandoc/.github/SUPPORT b/k9-svc/pandoc/.github/SUPPORT deleted file mode 100644 index b06c59a3..00000000 --- a/k9-svc/pandoc/.github/SUPPORT +++ /dev/null @@ -1,7 +0,0 @@ -# Support - -For questions, help, and community discussion: - -- GitHub Discussions: https://github.com/{{OWNER}}/{{REPO}}/discussions -- GitHub Issues: https://github.com/{{OWNER}}/{{REPO}}/issues -- Documentation: See README.adoc in the root directory. diff --git a/k9-svc/pandoc/.github/copilot-instructions.md b/k9-svc/pandoc/.github/copilot-instructions.md deleted file mode 100644 index 6b44aec8..00000000 --- a/k9-svc/pandoc/.github/copilot-instructions.md +++ /dev/null @@ -1,57 +0,0 @@ - - - - -# Copilot Instructions - -## Before Writing Code - -- Read `0-AI-MANIFEST.a2ml` in the repo root for canonical file locations. -- State files (.a2ml) live in `.machine_readable/` ONLY, never the root. - -## License - -- SPDX: `PMPL-1.0-or-later` on all new files. -- Never use AGPL-3.0. -- Copyright: `{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## Code Style - -- Use descriptive variable names. -- Annotate and document all files. -- Add SPDX header to every source file. -- Use `just` for build/test/lint commands. - -## Banned Patterns - -- Idris2: no `believe_me`, no `assert_total` -- Haskell: no `unsafeCoerce`, no `unsafePerformIO` -- OCaml: no `Obj.magic` -- Coq: no `Admitted` -- Lean: no `sorry` -- Rust: no `transmute` unless FFI with `// SAFETY:` comment - -## Banned Languages - -- No TypeScript (use ReScript) -- No Node.js / npm / bun (use Deno) -- No Go (use Rust) -- No Python (use Julia or Rust) - -## Containers - -- Use Podman, never Docker. -- Name the file `Containerfile`, never `Dockerfile`. -- Base image: `cgr.dev/chainguard/wolfi-base:latest`. - -## ABI/FFI - -- ABI definitions in Idris2 (`src/interface/abi/`). -- FFI implementations in Zig (`src/interface/ffi/`). -- Generated C headers in `src/interface/generated/`. - -## State Files - -Never create these in the repo root: -STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -They belong in `.machine_readable/` only. diff --git a/k9-svc/pandoc/.github/dependabot.yml b/k9-svc/pandoc/.github/dependabot.yml deleted file mode 100644 index d5cd4e99..00000000 --- a/k9-svc/pandoc/.github/dependabot.yml +++ /dev/null @@ -1,48 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dependabot configuration for RSR-compliant repositories -# Covers common ecosystems - remove unused ones for your project - -version: 2 -updates: - # GitHub Actions - always include - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - # Rust/Cargo - - package-ecosystem: "cargo" - directory: "/" - schedule: - interval: "weekly" - ignore: - - dependency-name: "*" - update-types: ["version-update:semver-patch"] - - # Elixir/Mix - - package-ecosystem: "mix" - directory: "/" - schedule: - interval: "weekly" - - # Node.js/npm - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - - # Python/pip - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - - # Nix flakes - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/k9-svc/pandoc/.github/pull_request_template.md b/k9-svc/pandoc/.github/pull_request_template.md deleted file mode 100644 index 7e07d176..00000000 --- a/k9-svc/pandoc/.github/pull_request_template.md +++ /dev/null @@ -1,44 +0,0 @@ - -## Summary - - - -## Changes - - - -- - -## RSR Quality Checklist - - - -### Required - -- [ ] Tests pass (`just test` or equivalent) -- [ ] Code is formatted (`just fmt` or equivalent) -- [ ] Linter is clean (no new warnings or errors) -- [ ] No banned language patterns (no TypeScript, no npm/bun, no Go/Python) -- [ ] No `unsafe` blocks without `// SAFETY:` comments -- [ ] No banned functions (`believe_me`, `unsafeCoerce`, `Obj.magic`, `Admitted`, `sorry`) -- [ ] SPDX license headers present on all new/modified source files -- [ ] No secrets, credentials, or `.env` files included - -### As Applicable - -- [ ] `.machine_readable/STATE.a2ml` updated (if project state changed) -- [ ] `.machine_readable/ECOSYSTEM.a2ml` updated (if integrations changed) -- [ ] `.machine_readable/META.a2ml` updated (if architectural decisions changed) -- [ ] Documentation updated for user-facing changes -- [ ] `TOPOLOGY.md` updated (if architecture changed) -- [ ] `CHANGELOG` or release notes updated -- [ ] New dependencies reviewed for license compatibility (PMPL-1.0-or-later / MPL-2.0) -- [ ] ABI/FFI changes validated (`src/interface/abi/` and `src/interface/ffi/` consistent) - -## Testing - - - -## Screenshots - - diff --git a/k9-svc/pandoc/.github/workflows/codeql.yml b/k9-svc/pandoc/.github/workflows/codeql.yml deleted file mode 100644 index de07c8f3..00000000 --- a/k9-svc/pandoc/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/k9-svc/pandoc/.github/workflows/governance.yml b/k9-svc/pandoc/.github/workflows/governance.yml deleted file mode 100644 index f5f282cc..00000000 --- a/k9-svc/pandoc/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../.github/workflows/governance-reusable.yml diff --git a/k9-svc/pandoc/.github/workflows/hypatia-scan.yml b/k9-svc/pandoc/.github/workflows/hypatia-scan.yml deleted file mode 100644 index f120579d..00000000 --- a/k9-svc/pandoc/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/k9-svc/pandoc/.github/workflows/jekyll.yml b/k9-svc/pandoc/.github/workflows/jekyll.yml deleted file mode 100644 index 32e00a9f..00000000 --- a/k9-svc/pandoc/.github/workflows/jekyll.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll site to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup Ruby - # https://github.com/ruby/setup-ruby/releases/tag/v1.207.0 - uses: ruby/setup-ruby@09a7688d3b55cf0e976497ff046b70949eeaccfd # v1.207.0 - with: - ruby-version: '3.1' # Not needed with a .ruby-version file - bundler-cache: true # runs 'bundle install' and caches installed gems automatically - cache-version: 0 # Increment this number if you need to re-download cached gems - - name: Setup Pages - id: pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - # Outputs to the './_site' directory by default - run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}" - env: - JEKYLL_ENV: production - - name: Upload artifact - # Automatically uploads an artifact from the './_site' directory by default - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/k9-svc/pandoc/.github/workflows/mirror.yml b/k9-svc/pandoc/.github/workflows/mirror.yml deleted file mode 100644 index a20ae7da..00000000 --- a/k9-svc/pandoc/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/k9-svc/pandoc/.github/workflows/release.yml b/k9-svc/pandoc/.github/workflows/release.yml deleted file mode 100644 index df399227..00000000 --- a/k9-svc/pandoc/.github/workflows/release.yml +++ /dev/null @@ -1,131 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# Release workflow — triggered by version tags (v*). -# Builds artifacts, generates changelog via git-cliff, creates a GitHub Release, -# and produces SLSA provenance attestations. -name: Release - -on: - push: - tags: - - 'v*' - -permissions: read-all - -jobs: - build: - name: Build Artifacts - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - - name: Build - run: | - echo "Build your artifacts here" - # TODO: Replace with your build commands - # Examples: - # cargo build --release - # zig build -Doptimize=ReleaseFast - # gleam build - # mix release - - # TODO: Upload build artifacts if needed - # - uses: actions/upload-artifact@v4 - # with: - # name: release-artifacts - # path: target/release/ - - changelog: - name: Generate Changelog - runs-on: ubuntu-latest - timeout-minutes: 20 - permissions: - contents: read - outputs: - changelog: ${{ steps.cliff.outputs.content }} - version: ${{ steps.version.outputs.version }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Extract version from tag - id: version - run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" - - - name: Install git-cliff - run: | - curl -sSfL https://github.com/orhun/git-cliff/releases/latest/download/git-cliff-$(uname -m)-unknown-linux-gnu.tar.gz \ - | tar -xz --strip-components=1 -C /usr/local/bin/ git-cliff-*/git-cliff - - - name: Generate changelog for this release - id: cliff - run: | - # Generate changelog for the current tag only - CHANGELOG=$(git cliff --latest --strip header) - # Write to output using delimiter to handle multiline - { - echo "content<> "$GITHUB_OUTPUT" - - - name: Update full CHANGELOG.md - run: | - git cliff --output CHANGELOG.md - - - name: Upload updated CHANGELOG.md - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - with: - name: changelog - path: CHANGELOG.md - retention-days: 5 - - release: - name: Create GitHub Release - needs: [build, changelog] - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - # TODO: Download build artifacts if uploading to the release - # - uses: actions/download-artifact@v4 - # with: - # name: release-artifacts - # path: artifacts/ - - - name: Create GitHub Release - uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 - with: - body: ${{ needs.changelog.outputs.changelog }} - draft: false - prerelease: ${{ contains(github.ref_name, '-rc') || contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }} - generate_release_notes: false - # TODO: Add artifact files to the release - # files: | - # artifacts/* - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - provenance: - name: SLSA Provenance - needs: [build] - permissions: - actions: read - id-token: write - contents: write - # SLSA generator must run in a separate, isolated workflow - # See: https://slsa.dev/spec/v1.0/requirements#build-l3 - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 - with: - base64-subjects: "" - # TODO: Replace with actual artifact hashes - # Generate with: sha256sum artifact | base64 -w0 - # base64-subjects: "${{ needs.build.outputs.hashes }}" diff --git a/k9-svc/pandoc/.github/workflows/rhodibot.yml b/k9-svc/pandoc/.github/workflows/rhodibot.yml deleted file mode 100644 index 87dcad85..00000000 --- a/k9-svc/pandoc/.github/workflows/rhodibot.yml +++ /dev/null @@ -1,235 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# rhodibot.yml — Automated RSR compliance enforcement -# -# Reads root-hygiene rules and auto-fixes what it can: -# - Delete banned files (AI.djot, duplicate CONTRIBUTING.adoc, stale snapshots) -# - Rename misnamed files (AI.a2ml → 0-AI-MANIFEST.a2ml) -# - Fix SPDX headers (AGPL → PMPL in dotfiles) -# - Create missing required files (SECURITY.md, CONTRIBUTING.md) -# - Report unfixable issues as PR comments -# -# Runs weekly and on Hypatia scan completion. - -name: "🤖 Rhodibot — RSR Auto-Fix" - -on: - schedule: - - cron: '0 6 * * 1' # Every Monday at 06:00 UTC - workflow_dispatch: # Manual trigger - workflow_run: - workflows: ["Hypatia Neurosymbolic Analysis"] - types: [completed] - -permissions: - contents: write - pull-requests: write - -jobs: - rhodibot: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - name: Checkout - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 - with: - fetch-depth: 1 - - - name: Rhodibot — Scan and Fix - id: fix - run: | - set -euo pipefail - FIXES="" - ISSUES="" - CHANGED=false - - # --- 1. Delete banned files --- - for pattern in "AI.djot" "NEXT_STEPS.md" "TODO.md" "NOTES.md" "TASKS.md"; do - if [ -f "$pattern" ]; then - rm "$pattern" - FIXES="$FIXES\n- Deleted \`$pattern\` (superseded)" - CHANGED=true - fi - done - - # Delete stale snapshot files - for f in *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md; do - if [ -f "$f" ]; then - rm "$f" - FIXES="$FIXES\n- Deleted stale snapshot \`$f\`" - CHANGED=true - fi - done - - # --- 2. Rename misnamed files --- - if [ -f "AI.a2ml" ] && [ ! -f "0-AI-MANIFEST.a2ml" ]; then - mv AI.a2ml 0-AI-MANIFEST.a2ml - FIXES="$FIXES\n- Renamed \`AI.a2ml\` → \`0-AI-MANIFEST.a2ml\`" - CHANGED=true - fi - - # --- 3. Delete duplicate format files --- - if [ -f "CONTRIBUTING.md" ] && [ -f "CONTRIBUTING.adoc" ]; then - rm CONTRIBUTING.adoc - FIXES="$FIXES\n- Deleted duplicate \`CONTRIBUTING.adoc\` (keeping .md for GitHub)" - CHANGED=true - fi - - if [ -f "README.md" ] && [ -f "README.adoc" ]; then - # Only delete README.md if it's a stub (<5 lines) - lines=$(wc -l < README.md) - if [ "$lines" -lt 5 ]; then - rm README.md - FIXES="$FIXES\n- Deleted stub \`README.md\` (keeping .adoc)" - CHANGED=true - fi - fi - - # --- 4. Fix SPDX headers in dotfiles --- - for dotfile in .gitignore .gitattributes .editorconfig; do - if [ -f "$dotfile" ] && grep -q "AGPL-3.0" "$dotfile" 2>/dev/null; then - sed -i 's/AGPL-3.0-or-later/PMPL-1.0-or-later/g; s/AGPL-3.0/PMPL-1.0-or-later/g' "$dotfile" - FIXES="$FIXES\n- Fixed SPDX header in \`$dotfile\` (AGPL → PMPL)" - CHANGED=true - fi - done - - # --- 5. Create missing required files --- - if [ ! -f "SECURITY.md" ]; then - cat > SECURITY.md << 'SECEOF' - - # Security Policy - - ## Reporting a Vulnerability - - **Email:** j.d.a.jewell@open.ac.uk - - **Response timeline:** - - Acknowledgement within 48 hours - - Initial assessment within 7 days - - Fix or mitigation within 90 days - - **Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure. - SECEOF - FIXES="$FIXES\n- Created missing \`SECURITY.md\`" - CHANGED=true - fi - - if [ ! -f "CONTRIBUTING.md" ]; then - cat > CONTRIBUTING.md << 'CONTEOF' - - # Contributing - - 1. Fork the repository - 2. Create a feature branch - 3. Ensure SPDX headers on all files - 4. Submit a pull request - - **Author:** Jonathan D.A. Jewell - CONTEOF - FIXES="$FIXES\n- Created missing \`CONTRIBUTING.md\`" - CHANGED=true - fi - - # --- 6. Check for issues we can't auto-fix --- - if [ ! -f "0-AI-MANIFEST.a2ml" ] && [ ! -f "AI.a2ml" ]; then - ISSUES="$ISSUES\n- Missing AI manifest (0-AI-MANIFEST.a2ml)" - fi - - if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.md" ] && [ ! -f "LICENSE.txt" ]; then - ISSUES="$ISSUES\n- Missing LICENSE file" - fi - - if [ ! -f "README.adoc" ] && [ ! -f "README.md" ]; then - ISSUES="$ISSUES\n- Missing README" - fi - - # Check for third-party fork (skip SPDX enforcement) - if [ -f "LICENSE" ] && grep -q "multiple licenses\|LGPL\|Apache" LICENSE 2>/dev/null; then - echo "FORK=true" >> $GITHUB_OUTPUT - fi - - # --- 7. Check dangerous patterns --- - DANGEROUS="" - for pattern in "believe_me" "assert_total" "Admitted" "sorry" "unsafeCoerce" "Obj.magic"; do - count=$(grep -r "$pattern" --include='*.idr' --include='*.v' --include='*.lean' --include='*.hs' --include='*.ml' --include='*.res' . 2>/dev/null | grep -v node_modules | wc -l || echo 0) - if [ "$count" -gt 0 ]; then - DANGEROUS="$DANGEROUS\n- \`$pattern\`: $count occurrences" - fi - done - - # Output results - echo "CHANGED=$CHANGED" >> $GITHUB_OUTPUT - { - echo "FIXES<> $GITHUB_OUTPUT - { - echo "ISSUES<> $GITHUB_OUTPUT - { - echo "DANGEROUS<> $GITHUB_OUTPUT - - - name: Create PR with fixes - if: steps.fix.outputs.CHANGED == 'true' - run: | - git config user.name "rhodibot" - git config user.email "rhodibot@hyperpolymath.dev" - BRANCH="rhodibot/rsr-compliance-$(date +%Y%m%d)" - git checkout -b "$BRANCH" - git add -A - git commit -m "fix(rhodibot): automated RSR compliance fixes - - ${{ steps.fix.outputs.FIXES }} - - Co-Authored-By: rhodibot " - - git push origin "$BRANCH" - - BODY="## 🤖 Rhodibot — RSR Compliance Fixes - - ### Changes Made - ${{ steps.fix.outputs.FIXES }} - " - - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - BODY="$BODY - ### Issues Found (manual fix needed) - ${{ steps.fix.outputs.ISSUES }} - " - fi - - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - BODY="$BODY - ### ⚠️ Dangerous Patterns Detected - ${{ steps.fix.outputs.DANGEROUS }} - - _These bypass formal verification. See \`proven\` repo for alternatives._ - " - fi - - gh pr create \ - --title "🤖 Rhodibot: RSR compliance fixes" \ - --body "$BODY" \ - --base main \ - --head "$BRANCH" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Report (no changes needed) - if: steps.fix.outputs.CHANGED != 'true' - run: | - echo "✅ Repository is RSR-compliant. No fixes needed." - if [ -n "${{ steps.fix.outputs.ISSUES }}" ]; then - echo "⚠️ Issues found (manual fix needed):" - echo -e "${{ steps.fix.outputs.ISSUES }}" - fi - if [ -n "${{ steps.fix.outputs.DANGEROUS }}" ]; then - echo "⚠️ Dangerous patterns:" - echo -e "${{ steps.fix.outputs.DANGEROUS }}" - fi diff --git a/k9-svc/pandoc/.github/workflows/scorecard-enforcer.yml b/k9-svc/pandoc/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index bbba795b..00000000 --- a/k9-svc/pandoc/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml diff --git a/k9-svc/pandoc/.github/workflows/scorecard.yml b/k9-svc/pandoc/.github/workflows/scorecard.yml deleted file mode 100644 index d665a836..00000000 --- a/k9-svc/pandoc/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/k9-svc/pandoc/.github/workflows/secret-scanner.yml b/k9-svc/pandoc/.github/workflows/secret-scanner.yml deleted file mode 100644 index 82b3c70e..00000000 --- a/k9-svc/pandoc/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/k9-svc/pandoc/.github/workflows/static-analysis-gate.yml b/k9-svc/pandoc/.github/workflows/static-analysis-gate.yml deleted file mode 100644 index 235af7f7..00000000 --- a/k9-svc/pandoc/.github/workflows/static-analysis-gate.yml +++ /dev/null @@ -1,331 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Static Analysis Gate — Required by branch protection rules. -# Runs panic-attack and hypatia, deposits findings for gitbot-fleet learning. -name: Static Analysis Gate - -on: - pull_request: - branches: ['**'] - push: - branches: [main, master] - -permissions: read-all - -jobs: - # --------------------------------------------------------------------------- - # Job 1: panic-attack assail - # --------------------------------------------------------------------------- - panic-attack-assail: - name: panic-attack assail - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Install panic-attack (if available) - id: install - run: | - # Try to fetch the latest release binary from the org - PA_URL="https://github.com/hyperpolymath/panic-attack/releases/latest/download/panic-attack-linux-x86_64" - if curl -fsSL --head "$PA_URL" >/dev/null 2>&1; then - curl -fsSL -o /usr/local/bin/panic-attack "$PA_URL" - chmod +x /usr/local/bin/panic-attack - echo "installed=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::panic-attack binary not available — skipping assail" - echo "installed=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run panic-attack assail - id: assail - if: steps.install.outputs.installed == 'true' - run: | - set +e - panic-attack assail --format json . > panic-attack-findings.json 2>&1 - PA_EXIT=$? - set -e - - if [ ! -s panic-attack-findings.json ]; then - echo "[]" > panic-attack-findings.json - fi - - # Parse finding counts - TOTAL=$(jq '. | length' panic-attack-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' panic-attack-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - echo "exit_code=$PA_EXIT" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.install.outputs.installed == 'true' - run: | - # Convert JSON findings into GitHub Actions annotations - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[panic-attack] \(.message)" - end - ' panic-attack-findings.json || true - - - name: Write step summary - if: steps.install.outputs.installed == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## panic-attack assail Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.assail.outputs.critical }} | - | High | ${{ steps.assail.outputs.high }} | - | Medium | ${{ steps.assail.outputs.medium }} | - | Low | ${{ steps.assail.outputs.low }} | - | **Total**| ${{ steps.assail.outputs.total }} | - EOF - - - name: Create stub findings (when panic-attack unavailable) - if: steps.install.outputs.installed != 'true' - run: | - echo "[]" > panic-attack-findings.json - echo "## panic-attack assail" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: panic-attack not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload panic-attack findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: panic-attack-findings - path: panic-attack-findings.json - retention-days: 90 - - - name: Fail on critical findings - if: steps.install.outputs.installed == 'true' && steps.assail.outputs.critical > 0 - run: | - echo "::error::panic-attack found ${{ steps.assail.outputs.critical }} critical issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 2: hypatia-scan - # --------------------------------------------------------------------------- - hypatia-scan: - name: Hypatia neurosymbolic scan - runs-on: ubuntu-latest - timeout-minutes: 20 - - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - - name: Setup Elixir for Hypatia scanner - id: beam - continue-on-error: true - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1.18.2 - with: - elixir-version: '1.19.4' - otp-version: '28.3' - - - name: Clone and build Hypatia - id: build - continue-on-error: true - run: | - git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true - if [ -d "$HOME/hypatia/scanner" ]; then - cd "$HOME/hypatia" - if [ ! -f hypatia-v2 ]; then - mix deps.get - mix escript.build - mv hypatia ../hypatia-v2 - fi - echo "ready=true" >> "$GITHUB_OUTPUT" - else - echo "::notice::Hypatia scanner not available — skipping scan" - echo "ready=false" >> "$GITHUB_OUTPUT" - fi - - - name: Run Hypatia scan - id: scan - if: steps.build.outputs.ready == 'true' - run: | - set +e - HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . > hypatia-findings.json 2>&1 - HYP_EXIT=$? - set -e - - if [ ! -s hypatia-findings.json ] || ! jq empty hypatia-findings.json 2>/dev/null; then - echo "[]" > hypatia-findings.json - fi - - TOTAL=$(jq '. | length' hypatia-findings.json 2>/dev/null || echo 0) - CRITICAL=$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json 2>/dev/null || echo 0) - HIGH=$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json 2>/dev/null || echo 0) - MEDIUM=$(jq '[.[] | select(.severity == "medium")] | length' hypatia-findings.json 2>/dev/null || echo 0) - LOW=$(jq '[.[] | select(.severity == "low")] | length' hypatia-findings.json 2>/dev/null || echo 0) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Emit check annotations - if: steps.build.outputs.ready == 'true' - run: | - jq -r '.[] | select(.file != null) | - if .severity == "critical" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - elif .severity == "high" then - "::error file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - else - "::warning file=\(.file),line=\(.line // 1)::[hypatia] \(.message)" - end - ' hypatia-findings.json || true - - - name: Write step summary - if: steps.build.outputs.ready == 'true' - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Hypatia Scan Results - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.scan.outputs.critical }} | - | High | ${{ steps.scan.outputs.high }} | - | Medium | ${{ steps.scan.outputs.medium }} | - | Low | ${{ steps.scan.outputs.low }} | - | **Total**| ${{ steps.scan.outputs.total }} | - EOF - - - name: Create stub findings (when Hypatia unavailable) - if: steps.build.outputs.ready != 'true' - run: | - echo "[]" > hypatia-findings.json - echo "## Hypatia Scan" >> "$GITHUB_STEP_SUMMARY" - echo "" >> "$GITHUB_STEP_SUMMARY" - echo "Skipped: Hypatia scanner not available in this environment." >> "$GITHUB_STEP_SUMMARY" - - - name: Upload hypatia findings - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: hypatia-findings - path: hypatia-findings.json - retention-days: 90 - - - name: Fail on critical security findings - if: steps.build.outputs.ready == 'true' && steps.scan.outputs.critical > 0 - run: | - echo "::error::Hypatia found ${{ steps.scan.outputs.critical }} critical security issue(s) — blocking merge" - exit 1 - - # --------------------------------------------------------------------------- - # Job 3: deposit-findings (combines + archives for gitbot-fleet) - # --------------------------------------------------------------------------- - deposit-findings: - name: Deposit findings for gitbot-fleet - runs-on: ubuntu-latest - timeout-minutes: 20 - needs: [panic-attack-assail, hypatia-scan] - if: always() - - steps: - - name: Download panic-attack findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: panic-attack-findings - path: findings/ - - - name: Download hypatia findings - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4 - with: - name: hypatia-findings - path: findings/ - - - name: Combine findings into unified report - id: combine - run: | - PA_FILE="findings/panic-attack-findings.json" - HYP_FILE="findings/hypatia-findings.json" - - # Ensure both files exist and are valid JSON arrays - for f in "$PA_FILE" "$HYP_FILE"; do - if [ ! -s "$f" ] || ! jq empty "$f" 2>/dev/null; then - echo "[]" > "$f" - fi - done - - # Tag each finding with its source scanner - jq '[.[] | . + {"scanner": "panic-attack"}]' "$PA_FILE" > /tmp/pa-tagged.json - jq '[.[] | . + {"scanner": "hypatia"}]' "$HYP_FILE" > /tmp/hyp-tagged.json - - # Build unified report envelope - jq -n \ - --arg repo "${{ github.repository }}" \ - --arg sha "${{ github.sha }}" \ - --arg ref "${{ github.ref }}" \ - --arg run_id "${{ github.run_id }}" \ - --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \ - --slurpfile pa /tmp/pa-tagged.json \ - --slurpfile hyp /tmp/hyp-tagged.json \ - '{ - schema_version: "1.0.0", - repository: $repo, - commit_sha: $sha, - ref: $ref, - run_id: $run_id, - timestamp: $ts, - findings: ($pa[0] + $hyp[0]) - }' > findings/unified-findings.json - - TOTAL=$(jq '.findings | length' findings/unified-findings.json) - CRITICAL=$(jq '[.findings[] | select(.severity == "critical")] | length' findings/unified-findings.json) - HIGH=$(jq '[.findings[] | select(.severity == "high")] | length' findings/unified-findings.json) - MEDIUM=$(jq '[.findings[] | select(.severity == "medium")] | length' findings/unified-findings.json) - LOW=$(jq '[.findings[] | select(.severity == "low")] | length' findings/unified-findings.json) - - echo "total=$TOTAL" >> "$GITHUB_OUTPUT" - echo "critical=$CRITICAL" >> "$GITHUB_OUTPUT" - echo "high=$HIGH" >> "$GITHUB_OUTPUT" - echo "medium=$MEDIUM" >> "$GITHUB_OUTPUT" - echo "low=$LOW" >> "$GITHUB_OUTPUT" - - - name: Upload unified findings (fleet scanner picks these up) - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 - with: - name: unified-findings - path: findings/unified-findings.json - retention-days: 90 - - - name: Write deposit summary - run: | - cat <> "$GITHUB_STEP_SUMMARY" - ## Unified Findings Deposit - - **Repository:** ${{ github.repository }} - **Commit:** \`${{ github.sha }}\` - **Deposited at:** $(date -u +"%Y-%m-%d %H:%M:%S UTC") - - | Severity | Count | - |----------|-------| - | Critical | ${{ steps.combine.outputs.critical }} | - | High | ${{ steps.combine.outputs.high }} | - | Medium | ${{ steps.combine.outputs.medium }} | - | Low | ${{ steps.combine.outputs.low }} | - | **Total**| ${{ steps.combine.outputs.total }} | - - Findings saved as \`unified-findings\` artifact. - The gitbot-fleet scanner will ingest these on its next pass. - EOF \ No newline at end of file diff --git a/k9-svc/pandoc/.gitignore b/k9-svc/pandoc/.gitignore deleted file mode 100644 index 037efd36..00000000 --- a/k9-svc/pandoc/.gitignore +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ -.direnv/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Nix -# flake.lock is ignored in the template repo because each project should -# generate its own lock file on first use. In derived projects, REMOVE this -# line and track flake.lock for reproducible builds. -flake.lock - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Maintenance local artifacts -.maintenance-perms-state.tsv -docs/reports/maintenance/*.json - -# Machine-readable locks -.machine_readable/.locks/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ - -# KDE metadata -.directory - -# Sync artifacts -sync_report*.txt - -# Hypatia scan cache (local-only) -.hypatia/ diff --git a/k9-svc/pandoc/.gitlab-ci.yml b/k9-svc/pandoc/.gitlab-ci.yml deleted file mode 100644 index 7309fa90..00000000 --- a/k9-svc/pandoc/.gitlab-ci.yml +++ /dev/null @@ -1,175 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Primary CI/CD - GitLab is the source of truth - -stages: - - security - - lint - - test - - build - -variables: - CARGO_HOME: ${CI_PROJECT_DIR}/.cargo - -cache: - key: ${CI_COMMIT_REF_SLUG} - paths: - - .cargo/ - - target/ - -# ================== -# Security Scanning -# ================== - -trivy: - stage: security - image: aquasec/trivy:latest - script: - - trivy fs --exit-code 0 --severity HIGH,CRITICAL --format table . - - trivy fs --exit-code 1 --severity CRITICAL . - allow_failure: false - -gitleaks: - stage: security - image: zricethezav/gitleaks:latest - script: - - gitleaks detect --source . --verbose --redact - allow_failure: false - -semgrep: - stage: security - image: returntocorp/semgrep - script: - - semgrep --config auto --error . - allow_failure: true - -cargo-audit: - stage: security - image: rust:latest - script: - - cargo install cargo-audit - - cargo audit - rules: - - exists: - - Cargo.toml - -cargo-deny: - stage: security - image: rust:latest - script: - - cargo install cargo-deny - - cargo deny check - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-audit: - stage: security - image: elixir:latest - script: - - mix local.hex --force - - mix archive.install hex mix_audit --force - - mix deps.get - - mix deps.audit - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Linting -# ================== - -rustfmt: - stage: lint - image: rust:latest - script: - - rustup component add rustfmt - - cargo fmt -- --check - rules: - - exists: - - Cargo.toml - -clippy: - stage: lint - image: rust:latest - script: - - rustup component add clippy - - cargo clippy -- -D warnings - rules: - - exists: - - Cargo.toml - allow_failure: true - -mix-format: - stage: lint - image: elixir:latest - script: - - mix format --check-formatted - rules: - - exists: - - mix.exs - -credo: - stage: lint - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix credo --strict - rules: - - exists: - - mix.exs - allow_failure: true - -# ================== -# Testing -# ================== - -cargo-test: - stage: test - image: rust:latest - script: - - cargo test --all-features - rules: - - exists: - - Cargo.toml - -mix-test: - stage: test - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - mix test - rules: - - exists: - - mix.exs - -# ================== -# Build -# ================== - -cargo-build: - stage: build - image: rust:latest - script: - - cargo build --release - artifacts: - paths: - - target/release/ - expire_in: 1 week - rules: - - exists: - - Cargo.toml - -mix-build: - stage: build - image: elixir:latest - script: - - mix local.hex --force - - mix deps.get - - MIX_ENV=prod mix compile - rules: - - exists: - - mix.exs diff --git a/k9-svc/pandoc/.guix-channel b/k9-svc/pandoc/.guix-channel deleted file mode 100644 index f9bdf68f..00000000 --- a/k9-svc/pandoc/.guix-channel +++ /dev/null @@ -1,22 +0,0 @@ -;; SPDX-License-Identifier: MPL-2.0 -;; Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -;; -;; Guix channel definition for {{PROJECT_NAME}} -;; -;; To use this channel, add to ~/.config/guix/channels.scm: -;; -;; (channel -;; (name '{{PROJECT_NAME}}) -;; (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") -;; (branch "main")) -;; -;; Then: guix pull - -(channel - (version 0) - (url "https://github.com/{{OWNER}}/{{PROJECT_NAME}}") - (dependencies - (channel - (name 'guix) - (url "https://git.savannah.gnu.org/git/guix.git") - (branch "master")))) diff --git a/k9-svc/pandoc/.machine_readable/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 9d2bc7a0..00000000 --- a/k9-svc/pandoc/.machine_readable/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "machine-readable-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Registry for all machine-readable metadata, policies, and internal - automation scripts. - -canonical_locations: - state: "STATE.a2ml" - meta: "META.a2ml" - ecosystem: "ECOSYSTEM.a2ml" - agentic: "AGENTIC.a2ml" - neurosym: "NEUROSYM.a2ml" - playbook: "PLAYBOOK.a2ml" - anchors: "anchors/" - policies: "policies/" - ai_configs: "ai/" - compliance: "compliance/" - scripts: "scripts/" - -invariants: - - "Metadata files MUST follow a2ml format" - - "Internal automation MUST live in scripts/ subfolder" diff --git a/k9-svc/pandoc/.machine_readable/CLADE.a2ml b/k9-svc/pandoc/.machine_readable/CLADE.a2ml deleted file mode 100644 index b14389ce..00000000 --- a/k9-svc/pandoc/.machine_readable/CLADE.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Clade declaration — part of the gv-clade-index registry -# See: https://github.com/hyperpolymath/gv-clade-index - -[identity] -uuid = "a5ea1382-a34c-5334-8a46-a2ebe904c810" -primary-forge = "github" -primary-owner = "hyperpolymath" -canonical-name = "rsr-template-repo" -prefixed-name = "rm-rsr-template-repo" - -[clade] -primary = "rm" -secondary = ["gv"] -assigned = "2026-03-16" -rationale = "" - -[forges] -github = "hyperpolymath/rsr-template-repo" -gitlab = "hyperpolymath/rsr-template-repo" -bitbucket = "hyperpolymath/rsr-template-repo" - -[lineage] -type = "standalone" -parent = "RSR template — scaffold for new repos" -born = "2026-03-16" diff --git a/k9-svc/pandoc/.machine_readable/ENSAID_CONFIG.a2ml b/k9-svc/pandoc/.machine_readable/ENSAID_CONFIG.a2ml deleted file mode 100644 index 1384822c..00000000 --- a/k9-svc/pandoc/.machine_readable/ENSAID_CONFIG.a2ml +++ /dev/null @@ -1,96 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ENSAID_CONFIG.a2ml — eNSAID Environment Configuration -# Per-repo configuration for PanLL and eNSAID-compatible tools. -# -# Canonical location: .machine_readable/ENSAID_CONFIG.a2ml -# Spec: https://github.com/hyperpolymath/standards/tree/main/ensaid-config -# -# Naming convention: -# - UPPERCASE + underscore = non-executable machine-readable file -# - Lives in .machine_readable/ alongside STATE.a2ml, META.a2ml, etc. - -# ───────────────────────────────────────────────────────────────── -# [ensaid] — Core eNSAID identity and version -# ───────────────────────────────────────────────────────────────── -[ensaid] -version = "1.0.0" -tool = "panll" - -# ───────────────────────────────────────────────────────────────── -# [workspace] — Workspace mode, protection, and execution policy -# ───────────────────────────────────────────────────────────────── -[workspace] -mode = "rhodium" # rhodium | gold | silver | bronze -protection = "open" # open | guarded | locked -execution = "live" # live | dry-run | approval-required - -# ───────────────────────────────────────────────────────────────── -# [preferences] — User/repo-level display and behaviour preferences -# ───────────────────────────────────────────────────────────────── -[preferences] -humidity = "medium" # high | medium | low (drift aura intensity) -default-arrangement = "default-3-panel" # workspace arrangement ID -auto-connect = true # auto-connect panels to backends on load - -# ───────────────────────────────────────────────────────────────── -# [panels] — Panel visibility, enablement, and isolation overrides -# ───────────────────────────────────────────────────────────────── -[panels] -version = "1.0.0" - -# By default, all panels are available. Uncomment to restrict: -# [[panels.enabled]] -# id = "valence-shell" -# isolation = "native" -# auto-connect = true -# -# [[panels.enabled]] -# id = "editor-bridge" -# isolation = "native" -# auto-connect = true - -# Panels to hide for this repo context: -# [panels.disabled] -# ids = [] - -# ───────────────────────────────────────────────────────────────── -# [workflows] — Automation Router event-driven cross-panel rules -# ───────────────────────────────────────────────────────────────── -[workflows] -version = "1.0.0" - -# Example: rebuild on file save -# [[workflows.rule]] -# name = "build-on-save" -# trigger = { event = "file-changed", pattern = "src/**/*.res" } -# condition = { panel = "build-dashboard", field = "watchMode", equals = true } -# action = { panel = "build-dashboard", message = "TriggerBuild", args = { target = "game" } } -# approval = "auto-fire" # auto-fire | require-approval | approve-once | dry-run-first - -# ───────────────────────────────────────────────────────────────── -# [clades] — Panel clade trait and capability overrides -# ───────────────────────────────────────────────────────────────── -[clades] -version = "1.0.0" - -# Example: add a custom capability to a panel clade -# [[clades.override]] -# id = "build-dashboard" -# traits = { has-work-items = true } -# capabilities-add = ["CustomCheck"] - -# ───────────────────────────────────────────────────────────────── -# [portfolios] — Custom panel bundles for this repo's workflow -# ───────────────────────────────────────────────────────────────── -[portfolios] -version = "1.0.0" - -# Example: a custom portfolio for this project -# [[portfolios.custom]] -# id = "{{project}}-dev" -# name = "{{PROJECT_NAME}} Development" -# description = "Panels for {{PROJECT_NAME}} development" -# panels = ["valence-shell", "editor-bridge", "build-dashboard"] -# default-isolation = "native" diff --git a/k9-svc/pandoc/.machine_readable/README.adoc b/k9-svc/pandoc/.machine_readable/README.adoc deleted file mode 100644 index 471d6c72..00000000 --- a/k9-svc/pandoc/.machine_readable/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= .machine_readable Pillar diff --git a/k9-svc/pandoc/.machine_readable/ai/.clinerules b/k9-svc/pandoc/.machine_readable/ai/.clinerules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/.clinerules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/pandoc/.machine_readable/ai/.cursorrules b/k9-svc/pandoc/.machine_readable/ai/.cursorrules deleted file mode 100644 index d3b9cee0..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/.cursorrules +++ /dev/null @@ -1,47 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# Read 0-AI-MANIFEST.a2ml in the repo root FIRST for canonical file locations. - -# LICENSE -# All original code: PMPL-1.0-or-later (SPDX header required on every file). -# Never use AGPL-3.0. Fallback to MPL-2.0 only when platform requires it. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES -# .a2ml metadata files go in .machine_readable/ ONLY. -# Never create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -# NEUROSYM.a2ml, or PLAYBOOK.a2ml in the repository root. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> use ReScript -# Node.js / npm / bun -> use Deno -# Go -> use Rust -# Python -> use Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker) -# File: Containerfile (never Dockerfile) -# Base: cgr.dev/chainguard/wolfi-base:latest - -# ABI/FFI STANDARD -# ABI definitions: Idris2 with dependent types (src/interface/abi/) -# FFI implementation: Zig with C ABI (src/interface/ffi/) -# Generated C headers: src/interface/generated/ - -# BUILD SYSTEM -# Use just (justfile) for all build, test, lint, and format tasks. - -# CODE STYLE -# Use descriptive variable names. -# Annotate and document all files. -# Add SPDX-License-Identifier header to every source file. diff --git a/k9-svc/pandoc/.machine_readable/ai/.windsurfrules b/k9-svc/pandoc/.machine_readable/ai/.windsurfrules deleted file mode 100644 index 854d2ee3..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/.windsurfrules +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# Authoritative source: docs/AI-CONVENTIONS.md - -# STARTUP: Read 0-AI-MANIFEST.a2ml first, then .machine_readable/STATE.a2ml. - -# LICENSE -# All original code: PMPL-1.0-or-later. -# Never AGPL-3.0. MPL-2.0 only as platform-required fallback. -# SPDX header required on every source file. -# Copyright: {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> - -# STATE FILES (.machine_readable/ ONLY) -# Never create in repo root: STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, -# AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml. -# The .machine_readable/ directory is the single source of truth. - -# BANNED PATTERNS -# Idris2: believe_me, assert_total, assert_smaller, unsafePerformIO -# Haskell: unsafeCoerce, unsafePerformIO, undefined, error -# OCaml: Obj.magic, Obj.repr, Obj.obj -# Coq: Admitted -# Lean: sorry -# Rust: transmute (unless FFI with // SAFETY: comment) - -# BANNED LANGUAGES -# TypeScript -> ReScript -# Node.js / npm / bun -> Deno -# Go -> Rust -# Python -> Julia or Rust - -# CONTAINERS -# Runtime: Podman (never Docker). -# File: Containerfile (never Dockerfile). -# Base: cgr.dev/chainguard/wolfi-base:latest or cgr.dev/chainguard/static:latest. - -# ABI/FFI -# ABI: Idris2 with dependent types (src/interface/abi/). -# FFI: Zig with C ABI (src/interface/ffi/). -# Headers: src/interface/generated/. - -# BUILD: Use just (justfile) for all tasks. -# STYLE: Descriptive names. Document all files. SPDX headers everywhere. diff --git a/k9-svc/pandoc/.machine_readable/ai/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/ai/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 869cbee6..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ai-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for ai metadata. diff --git a/k9-svc/pandoc/.machine_readable/ai/AI.a2ml b/k9-svc/pandoc/.machine_readable/ai/AI.a2ml deleted file mode 100644 index c683d30f..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/AI.a2ml +++ /dev/null @@ -1,16 +0,0 @@ - -# AI Assistant Instructions - -## Repository Focus -- `rsr-template-repo` is treated as a Rhodium Standard Repository; obey the Rhodium policies and keep `.machine_readable/` authoritative. -- All machine-readable content lives under `.machine_readable/` — state files (a2ml), bot directives, and contractiles. -- Prefer to keep generated files out of source control, and regenerate them with the documented commands before committing. - -## Workflow -1. Inspect `.machine_readable/STATE.a2ml` for blockers and next actions. -2. Respect any constraints listed inside `.machine_readable/AGENTIC.a2ml` when tooling changes are requested. -3. After finishing edits, update STATE with your outcomes and commit with a concise, imperative message. - -## Delivery Promises -- Mention in summaries whether STATE, `.machine_readable/contractiles/`, or `.machine_readable/bot_directives/` changed. -- Keep this file in sync with the repository's status; update it if the governance changes. diff --git a/k9-svc/pandoc/.machine_readable/ai/PLACEHOLDERS.adoc b/k9-svc/pandoc/.machine_readable/ai/PLACEHOLDERS.adoc deleted file mode 100644 index a1382f4f..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/PLACEHOLDERS.adoc +++ /dev/null @@ -1,142 +0,0 @@ -= Template Placeholders -# Template Placeholders - -All placeholders in this template follow the `{{PLACEHOLDER}}` pattern. -After cloning, replace them with your project-specific values. - -## Recommended: Interactive Bootstrap - -```bash -just init -``` - -This interactively prompts for all values, replaces every placeholder, -validates the result, and runs k9-svc checks if available. - -## Manual Replace - -```bash -# If you prefer manual replacement (run from repo root) - -sed -i 's/{{AUTHOR}}/Jane Doe/g' $(grep -rl '{{AUTHOR}}' .) -sed -i 's/{{AUTHOR_EMAIL}}/jane@example.org/g' $(grep -rl '{{AUTHOR_EMAIL}}' .) -sed -i 's/{{OWNER}}/my-org/g' $(grep -rl '{{OWNER}}' .) -sed -i 's/{{PROJECT_NAME}}/my-project/g' $(grep -rl '{{PROJECT_NAME}}' .) -sed -i 's/{{PROJECT}}/MY_PROJECT/g' $(grep -rl '{{PROJECT}}' .) -sed -i 's/{{project}}/my_project/g' $(grep -rl '{{project}}' .) -sed -i 's/{{REPO}}/my-project/g' $(grep -rl '{{REPO}}' .) -sed -i 's/{{FORGE}}/github.com/g' $(grep -rl '{{FORGE}}' .) -sed -i "s/{{CURRENT_YEAR}}/$(date +%Y)/g" $(grep -rl '{{CURRENT_YEAR}}' .) -sed -i "s/{{CURRENT_DATE}}/$(date +%Y-%m-%d)/g" $(grep -rl '{{CURRENT_DATE}}' .) -``` - -## Placeholder Reference - -### Author & Copyright - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{AUTHOR}}` | Full legal name | `Jane Doe` | SPDX headers (all files), MAINTAINERS.md, .mailmap, .reuse/dep5, docs/AI-CONVENTIONS.md | -| `{{AUTHOR_EMAIL}}` | Primary contact email | `jane@example.org` | SPDX headers (all files), .mailmap, .reuse/dep5, .well-known/humans.txt | -| `{{AUTHOR_EMAIL_ALT}}` | Previous/secondary email (for .mailmap) | `old@example.com` | .mailmap | -| `{{AUTHOR_ORG}}` | Author's organization/affiliation | `Acme University` | project-metadata.k9.ncl | -| `{{AUTHOR_LAST}}` | Author surname (for citations) | `Doe` | docs/CITATIONS.adoc | -| `{{AUTHOR_FIRST}}` | Author first name (for citations) | `Jane` | docs/CITATIONS.adoc | -| `{{AUTHOR_INITIALS}}` | Author initials (for citations) | `J.` | docs/CITATIONS.adoc | - -### Project Identity - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{PROJECT_NAME}}` | Human-readable project name | `My Project` | SECURITY.md, CODE_OF_CONDUCT.md, TOPOLOGY.md, STATE.a2ml, Justfile, GOVERNANCE.md, MAINTAINERS.md, flake.nix, devcontainer.json | -| `{{PROJECT_DESCRIPTION}}` | One-line description | `A tool for X` | flake.nix | -| `{{PROJECT}}` | Uppercase identifier (for Idris2 modules, C macros) | `MY_PROJECT` | ABI-FFI-README.md, src/interface/abi/*.idr, src/interface/ffi/*.zig | -| `{{project}}` | Lowercase identifier (for C symbols, filenames) | `my_project` | ABI-FFI-README.md, src/interface/ffi/*.zig | -| `{{REPO}}` | Repository name (slug) | `my-project` | CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, cliff.toml | -| `{{OWNER}}` | GitHub/GitLab org or username | `my-org` | SPDX headers, CONTRIBUTING.md, SECURITY.md, GOVERNANCE.md, MAINTAINERS.md, CODEOWNERS, mirror.yml, cliff.toml | -| `{{FORGE}}` | Git forge domain | `github.com` | CONTRIBUTING.md | - -### Dates - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{CURRENT_YEAR}}` | Current year | `2026` | SPDX headers (all files), GOVERNANCE.md, MAINTAINERS.md | -| `{{CURRENT_DATE}}` | Current date (ISO) | `2026-02-14` | STATE.a2ml, MAINTAINERS.md | -| `{{DATE}}` | Last updated date | `2026-02-14` | TOPOLOGY.md, THREAT-MODEL.md | - -### Contact & Security - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{SECURITY_EMAIL}}` | Security contact email | `security@example.org` | SECURITY.md | -| `{{PGP_FINGERPRINT}}` | 40-char PGP fingerprint | `ABCD 1234 ...` | SECURITY.md | -| `{{PGP_KEY_URL}}` | URL to public PGP key | `https://keys.openpgp.org/...` | SECURITY.md | -| `{{WEBSITE}}` | Project website | `https://example.org` | SECURITY.md | -| `{{CONDUCT_EMAIL}}` | Conduct reports email | `conduct@example.org` | CODE_OF_CONDUCT.md | -| `{{CONDUCT_TEAM}}` | Conduct committee name | `Code of Conduct Committee` | CODE_OF_CONDUCT.md | -| `{{RESPONSE_TIME}}` | SLA for initial response | `48 hours` | CODE_OF_CONDUCT.md | - -### Git - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{MAIN_BRANCH}}` | Main branch name | `main` | CONTRIBUTING.md | - -### Build - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `{{LICENSE}}` | License name | `PMPL-1.0-or-later` | ABI-FFI-README.md | -| `{{PROJECT_PURPOSE}}` | One-line project description | `FFI bridges between languages` | STATE.a2ml | - -### AI Manifest - -| Placeholder | Description | Example | Files | -|---|---|---|---| -| `[YOUR-REPO-NAME]` | Repository name | `my-project` | 0-AI-MANIFEST.a2ml | -| `[DATE]` | Creation date | `2026-02-14` | 0-AI-MANIFEST.a2ml | -| `[YOUR-NAME/ORG]` | Maintainer name | `hyperpolymath` | 0-AI-MANIFEST.a2ml | - -### AI Installation Guide - -| Marker | Description | Files | -|---|---|---| -| `[TODO-AI-INSTALL]` | Unfilled section in AI installation guide | `docs/AI_INSTALLATION_GUIDE.adoc`, `docs/AI-INSTALL-README-SECTION.adoc`, `README.adoc` | - -These are **not** standard `{{PLACEHOLDER}}` markers -- they are TODO markers -that must be replaced with project-specific content before release. They mark -sections where the developer (or AI) must fill in: - -- What questions the AI should ask the user -- Exact prerequisite check and install commands -- Privacy notice specific to this project -- Complete installation command block -- Credential setup instructions (URLs, scopes, env vars) -- Verification commands and expected output -- Error handling table -- Example conversation - -**finishbot checks:** `just validate-ai-install` verifies no `[TODO-AI-INSTALL]` markers remain. - -## Deletion Markers - -Some files contain deletion instructions: - -| Marker | Meaning | File | -|---|---|---| -| `{{~ ... ~}}` | Delete this entire line after reading | ABI-FFI-README.md (line 1) | - -## Verification - -After replacing all placeholders, verify none remain: - -```bash -grep -rn '{{' . --include='*.md' --include='*.adoc' --include='*.a2ml' \ - --include='*.scm' --include='*.idr' --include='*.zig' --include='*.res' \ - --include='Justfile' --include='*.nix' --include='*.toml' --include='*.yml' \ - --include='*.yaml' --include='*.hs' --include='*.ncl' --include='*.txt' \ - --include='*.json' --include='Containerfile' --include='dep5' \ - | grep -v 'PLACEHOLDERS.md' | grep -v 'node_modules' -``` - -If the above command produces no output, all placeholders have been replaced. diff --git a/k9-svc/pandoc/.machine_readable/ai/README.adoc b/k9-svc/pandoc/.machine_readable/ai/README.adoc deleted file mode 100644 index 121bbc8a..00000000 --- a/k9-svc/pandoc/.machine_readable/ai/README.adoc +++ /dev/null @@ -1,22 +0,0 @@ -= AI Guidance Directory - -Put AI-facing instructions in this folder. - -Examples: - -* `CLAUDE.md` -* `COPILOT.md` -* `GEMINI.md` -* `AI.a2ml` -* `AI.djot` - -Avoid scattering agent instruction files around the repo root. - -Recommended machine read order: - -* `.machine_readable/anchors/ANCHOR.a2ml` -* `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -* `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -* `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -* `.machine_readable/STATE.a2ml` -* `.machine_readable/META.a2ml` diff --git a/k9-svc/pandoc/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 45038e1e..00000000 --- a/k9-svc/pandoc/.machine_readable/anchors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "anchors-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for anchors metadata. diff --git a/k9-svc/pandoc/.machine_readable/anchors/ANCHOR.a2ml b/k9-svc/pandoc/.machine_readable/anchors/ANCHOR.a2ml deleted file mode 100644 index 87238998..00000000 --- a/k9-svc/pandoc/.machine_readable/anchors/ANCHOR.a2ml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# ANCHOR.a2ml - authoritative anchor for this repository - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" - -[anchor] -schema = "hyperpolymath.anchor/1" -repo = "{{OWNER}}/{{REPO}}" -authority = "upstream-canonical" - -purpose = [ - "Define canonical semantics and policy boundaries for this repository.", - "Declare what downstream/satellite repos can extend but not redefine.", - "Provide a stable golden path and invariant contract for release readiness.", -] - -[identity] -project = "{{PROJECT_NAME}}" -kind = "{{PROJECT_KIND}}" # language | library | service | tool -one-sentence = "{{PROJECT_PURPOSE}}" -domain = "{{PROJECT_DOMAIN}}" - -[semantic-authority] -policy = "canonical" - -owns = [ - "Project semantics and specification", - "Invariant definitions and contractiles", - "Reference implementation behavior", -] - -[implementation-policy] -allowed = ["Rust", "Idris2", "Zig", "Scheme", "Shell", "Just", "AsciiDoc", "Markdown"] -forbidden = ["Node.js", "npm"] - -[golden-path] -smoke-test-command = [ - "just test", - "just quality", -] - -success-criteria = [ - "Core tests pass", - "Quality gates pass", - "No unresolved critical security findings", -] - -[satellite-policy] -must-pin-upstream = true -must-declare-authority = true -must-have-anchor = true -must-have-golden-path = true - -[semantic-authority-files] -language-spec = "SPECIFICATION.md" -formal-proofs = "docs/proofs/PROOFS.adoc" -type-theory = "docs/theory/THEORY.adoc" -algorithms = "docs/theory/ALGORITHMS.adoc" diff --git a/k9-svc/pandoc/.machine_readable/anchors/README.adoc b/k9-svc/pandoc/.machine_readable/anchors/README.adoc deleted file mode 100644 index 1b27c02d..00000000 --- a/k9-svc/pandoc/.machine_readable/anchors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= anchors Registry diff --git a/k9-svc/pandoc/.machine_readable/compliance/reuse/dep5 b/k9-svc/pandoc/.machine_readable/compliance/reuse/dep5 deleted file mode 100644 index 3f5b2ef6..00000000 --- a/k9-svc/pandoc/.machine_readable/compliance/reuse/dep5 +++ /dev/null @@ -1,54 +0,0 @@ -Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ -Upstream-Name: {{PROJECT_NAME}} -Upstream-Contact: {{AUTHOR}} <{{AUTHOR_EMAIL}}> -Source: https://github.com/{{OWNER}}/{{REPO}} - -# Default: all files are PMPL-1.0-or-later -Files: * -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Configuration files that cannot carry headers -Files: .editorconfig .gitignore .gitattributes .tool-versions .mailmap -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Machine-readable state files -Files: .machine_readable/*.a2ml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Bot directives -Files: .machine_readable/bot_directives/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Contractiles -Files: .machine_readable/contractiles/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# GitHub/CI configuration -Files: .github/* .github/**/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Generated files -Files: generated/* -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Lockfiles and auto-generated -Files: *.lock Cargo.lock flake.lock -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Devcontainer config (JSON, no comments) -Files: .devcontainer/*.json -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) - -# Git-cliff config -Files: cliff.toml -Copyright: {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) diff --git a/k9-svc/pandoc/.machine_readable/compliance/rust/deny.toml b/k9-svc/pandoc/.machine_readable/compliance/rust/deny.toml deleted file mode 100644 index b096db88..00000000 --- a/k9-svc/pandoc/.machine_readable/compliance/rust/deny.toml +++ /dev/null @@ -1,65 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# cargo-deny configuration for RSR-compliant repositories -# Run: cargo deny check -# Docs: https://embarkstudios.github.io/cargo-deny/ - -[graph] -targets = [] -all-features = true - -# --- Advisory database --------------------------------------------------- -[advisories] -db-path = "~/.cargo/advisory-db" -db-urls = ["https://github.com/rustsec/advisory-db"] -# Fail on any known vulnerability -vulnerability = "deny" -unmaintained = "warn" -yanked = "warn" -notice = "warn" - -# --- License policy ------------------------------------------------------- -[licenses] -unlicensed = "deny" -confidence-threshold = 0.8 - -allow = [ - "PMPL-1.0-or-later", - "MPL-2.0", - "MIT", - "Apache-2.0", - "BSD-2-Clause", - "BSD-3-Clause", - "ISC", - "Zlib", - "Unicode-3.0", - "Unicode-DFS-2016", -] - -deny = [ - "AGPL-3.0-only", - "AGPL-3.0-or-later", -] - -copyleft = "warn" - -[[licenses.exceptions]] -allow = ["OpenSSL"] -name = "ring" - -# --- Crate bans ------------------------------------------------------------ -[bans] -multiple-versions = "warn" -wildcards = "allow" -highlight = "all" - -deny = [ - # Known-bad crates - { name = "openssl", wrappers = ["openssl-sys"] }, -] - -# --- Source restrictions ---------------------------------------------------- -[sources] -unknown-registry = "deny" -unknown-git = "warn" -allow-registry = ["https://github.com/rust-lang/crates.io-index"] -allow-git = [] diff --git a/k9-svc/pandoc/.machine_readable/configs/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/configs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 6e41e6c2..00000000 --- a/k9-svc/pandoc/.machine_readable/configs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "configs-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for configs metadata. diff --git a/k9-svc/pandoc/.machine_readable/configs/README.adoc b/k9-svc/pandoc/.machine_readable/configs/README.adoc deleted file mode 100644 index 616b9e76..00000000 --- a/k9-svc/pandoc/.machine_readable/configs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= configs Registry diff --git a/k9-svc/pandoc/.machine_readable/configs/git-cliff/cliff.toml b/k9-svc/pandoc/.machine_readable/configs/git-cliff/cliff.toml deleted file mode 100644 index 5c39b484..00000000 --- a/k9-svc/pandoc/.machine_readable/configs/git-cliff/cliff.toml +++ /dev/null @@ -1,119 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# git-cliff configuration for conventional commit changelog generation. -# https://git-cliff.org/docs/configuration -# -# Placeholders — replace before first use: -# {{OWNER}} — GitHub organization or username -# {{REPO}} — GitHub repository name - -[changelog] -# Changelog header -header = """ -# Changelog\n -All notable changes to this project will be documented in this file.\n -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n -\n -""" -# Template for the changelog body -# https://keats.github.io/tera/docs/#introduction -body = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% if version -%} - ## [{{ version | trim_start_matches(pat="v") }}] - {{ timestamp | date(format="%Y-%m-%d") }} -{% else -%} - ## [Unreleased] -{% endif -%} - -{% for group, commits in commits | group_by(attribute="group") %} - ### {{ group | striptags | trim }} - {% for commit in commits %} - - {% if commit.scope %}**{{ commit.scope }}:** {% endif %}\ - {% if commit.breaking %}[**BREAKING**] {% endif %}\ - {{ commit.message | upper_first }}\ - {%- if commit.links %} \ - ({% for link in commit.links %}[{{ link.text }}]({{ link.href }}){% endfor %}){% endif -%} - {% endfor %} -{% endfor %} - -{%- if github -%} -{% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %} - ### New Contributors -{%- for contributor in github.contributors | filter(attribute="is_first_time", value=true) %} - * @{{ contributor.username }} made their first contribution - {%- if contributor.pr_number %} in \ - [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) - {%- endif %} -{%- endfor %} -{% endif -%} -{% endif -%} - -""" -# Template for the changelog footer -footer = """ -{%- macro remote_url() -%} - https://github.com/{{OWNER}}/{{REPO}} -{%- endmacro -%} - -{% for release in releases -%} - {% if release.version -%} - {% if release.previous.version -%} - [{{ release.version | trim_start_matches(pat="v") }}]: \ - {{ self::remote_url() }}/compare/{{ release.previous.version }}...{{ release.version }} - {% endif -%} - {% else -%} - {% if release.previous.version -%} - [Unreleased]: {{ self::remote_url() }}/compare/{{ release.previous.version }}...HEAD - {% endif -%} - {% endif -%} -{% endfor %} - -""" -# Remove leading and trailing whitespace from templates -trim = true - -[git] -# Parse conventional commits -# https://www.conventionalcommits.org -conventional_commits = true -# Filter out unconventional commits -filter_unconventional = true -# Process each line of a commit as an individual commit -split_commits = false -# Regex for commit preprocessing -commit_preprocessors = [ - # Remove issue numbers from commit messages - { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "" }, -] -# Regex for parsing and grouping commits -commit_parsers = [ - { message = "^feat", group = "Features" }, - { message = "^fix", group = "Bug Fixes" }, - { message = "^security", group = "Security" }, - { message = "^perf", group = "Performance" }, - { message = "^refactor", group = "Refactoring" }, - { message = "^docs", group = "Documentation" }, - { message = "^style", group = "Styling" }, - { message = "^test", group = "Testing" }, - { message = "^ci", group = "CI/CD" }, - { message = "^chore\\(release\\)", skip = true }, - { message = "^chore\\(deps.*\\)", skip = true }, - { message = "^chore\\(pr\\)", skip = true }, - { message = "^chore", group = "Miscellaneous" }, - { body = ".*security", group = "Security" }, -] -# Protect breaking changes from being skipped by a commit parser -protect_breaking_commits = false -# Filter out merge commits -filter_merge_commits = true -# Filter out commits by tag pattern (skip pre-releases) -# tag_pattern = "v[0-9].*" -# Regex for skipping tags -# skip_tags = "beta|alpha" -# Sort commits within each group by oldest first -sort_commits = "oldest" diff --git a/k9-svc/pandoc/.machine_readable/contractiles/README.adoc b/k9-svc/pandoc/.machine_readable/contractiles/README.adoc deleted file mode 100644 index d40fcd18..00000000 --- a/k9-svc/pandoc/.machine_readable/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `.machine_readable/contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/k9-svc/pandoc/.machine_readable/contractiles/dust/Dustfile.a2ml b/k9-svc/pandoc/.machine_readable/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index be38a8ca..00000000 --- a/k9-svc/pandoc/.machine_readable/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,44 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile — Cleanup and hygiene contract -# Author: Jonathan D.A. Jewell - -@abstract: -What should be cleaned up or removed from this repository. -These are housekeeping items, not blockers. -@end - -## Stale Files - -### no-stale-snapshots -- description: No dated status/completion files in root -- run: "! ls *-STATUS-*.md *-COMPLETION-*.md *-COMPLETE.md *-VERIFIED-*.md 2>/dev/null | head -1 | grep -q ." -- severity: info - -### no-ai-djot -- description: AI.djot is superseded by 0-AI-MANIFEST.a2ml -- run: test ! -f AI.djot -- severity: warning - -### no-next-steps -- description: NEXT_STEPS.md superseded by ROADMAP -- run: test ! -f NEXT_STEPS.md -- severity: info - -## Build Artifacts - -### no-tracked-artifacts -- description: No build artifacts tracked in git -- run: "! git ls-files lib/bs/ lib/ocaml/ target/release/ _build/ 2>/dev/null | head -1 | grep -q ." -- severity: warning - -## Format Duplicates - -### no-duplicate-contributing -- description: Only one CONTRIBUTING format (keep .md) -- run: "! (test -f CONTRIBUTING.md && test -f CONTRIBUTING.adoc)" -- severity: warning - -### no-duplicate-readme -- description: Only one README format -- run: "! (test -f README.md && test -f README.adoc && [ $(wc -l < README.md) -gt 5 ])" -- severity: warning diff --git a/k9-svc/pandoc/.machine_readable/contractiles/must/Mustfile.a2ml b/k9-svc/pandoc/.machine_readable/contractiles/must/Mustfile.a2ml deleted file mode 100644 index 215c5106..00000000 --- a/k9-svc/pandoc/.machine_readable/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,69 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile — Physical state contract -# Author: Jonathan D.A. Jewell - -@abstract: -What MUST be true about this repository's files and configuration. -These are hard requirements — CI fails if any check fails. -@end - -## File Presence - -### license-present -- description: LICENSE file must exist -- run: test -f LICENSE -- severity: critical - -### readme-present -- description: README.adoc or README.md must exist -- run: test -f README.adoc || test -f README.md -- severity: critical - -### security-policy -- description: SECURITY.md must exist -- run: test -f SECURITY.md -- severity: critical - -### ai-manifest -- description: 0-AI-MANIFEST.a2ml must exist -- run: test -f 0-AI-MANIFEST.a2ml -- severity: critical - -### contributing -- description: CONTRIBUTING.md must exist (GitHub community health) -- run: test -f CONTRIBUTING.md -- severity: warning - -### editorconfig -- description: .editorconfig must exist -- run: test -f .editorconfig -- severity: warning - -## SPDX Compliance - -### spdx-headers -- description: All source files must have SPDX-License-Identifier -- run: "! find src/ -name '*.rs' -o -name '*.res' -o -name '*.idr' -o -name '*.zig' 2>/dev/null | head -20 | xargs grep -L 'SPDX-License-Identifier' 2>/dev/null | head -1 | grep -q ." -- severity: warning - -### no-agpl -- description: No AGPL-3.0 references in dotfiles -- run: "! grep -r 'AGPL-3.0' .gitignore .gitattributes .editorconfig 2>/dev/null | head -1 | grep -q ." -- severity: critical - -## Dangerous Patterns - -### no-believe-me -- description: No believe_me in Idris2 code -- run: "! grep -r 'believe_me' --include='*.idr' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-sorry -- description: No sorry in Lean code -- run: "! grep -r 'sorry' --include='*.lean' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-admitted -- description: No Admitted in Coq code -- run: "! grep -r 'Admitted' --include='*.v' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical diff --git a/k9-svc/pandoc/.machine_readable/contractiles/trust/Trustfile.a2ml b/k9-svc/pandoc/.machine_readable/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index f2a4f959..00000000 --- a/k9-svc/pandoc/.machine_readable/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,50 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile — Integrity and provenance verification -# Author: Jonathan D.A. Jewell - -@abstract: -Integrity invariants for this repository. These verify that the repo -has not been tampered with, secrets are not leaked, and provenance -is traceable. -@end - -## Secrets - -### no-secrets-committed -- description: No credential files in repo -- run: test ! -f .env && test ! -f credentials.json && test ! -f .env.local && test ! -f .env.production -- severity: critical - -### no-private-keys -- description: No private key files committed -- run: "! find . -name '*.pem' -o -name '*.key' -o -name 'id_rsa' -o -name 'id_ed25519' 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -### no-tokens-in-source -- description: No hardcoded API tokens in source -- run: "! grep -rE '(api[_-]?key|secret|token|password)\s*[:=]\s*[\"'\\''][A-Za-z0-9]{16,}' --include='*.js' --include='*.ts' --include='*.res' --include='*.py' . 2>/dev/null | grep -v node_modules | head -1 | grep -q ." -- severity: critical - -## Provenance - -### author-correct -- description: Git author matches expected identity -- run: "git log -1 --format='%ae' | grep -qE '(hyperpolymath|j\\.d\\.a\\.jewell)'" -- severity: warning - -### license-content -- description: LICENSE contains expected identifier -- run: grep -q 'PMPL\|MPL\|MIT\|Apache\|LGPL' LICENSE -- severity: warning - -## Container Security - -### container-images-pinned -- description: Containerfile uses pinned base images -- run: test ! -f Containerfile || grep -q 'cgr.dev\|@sha256:' Containerfile -- severity: warning - -### no-dockerfile -- description: No Dockerfile (use Containerfile) -- run: test ! -f Dockerfile -- severity: warning diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/AGENTIC.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/AGENTIC.a2ml deleted file mode 100644 index 4d5db884..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/AGENTIC.a2ml +++ /dev/null @@ -1,36 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -# Defines what AI agents can and cannot do in this repository. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/ECOSYSTEM.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/ECOSYSTEM.a2ml deleted file mode 100644 index 0f649d99..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/ECOSYSTEM.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Project ecosystem position -# Relationships, dependencies, integration points. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project] -name = "pandoc" -purpose = "" # TODO: describe project purpose -role = "" # TODO: describe project role # e.g. ffi-infrastructure, cli-tool, library, service - -[position-in-ecosystem] -tier = "infrastructure" # 1 | 2 | infrastructure - -[related-projects] -# relationship types: sibling-standard, dependency, dependent, inspiration, potential-consumer -# - { name = "language-bridges", relationship = "sibling-standard" } -# - { name = "hypatia", relationship = "potential-consumer" } - -[integration-points] -# External systems this project connects to -# - { system = "gitbot-fleet", direction = "outbound", protocol = "repository_dispatch" } diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/META.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/META.a2ml deleted file mode 100644 index d9b09e68..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/META.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Project meta-level information -# Architecture decisions, design rationale, governance. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -type = "library" # TODO: update type (library|binary|service|website|monorepo) # library | binary | monorepo | service | website -languages = [] # e.g. ["rust", "zig", "idris2"] -license = "MPL-2.0" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -# ADR format: status = proposed | accepted | deprecated | superseded | rejected -# - { id = "ADR-001", title = "Use Zig for FFI", status = "accepted", date = "2026-02-14" } - -[development-practices] -build-tool = "just" -container-runtime = "podman" -ci-platform = "github-actions" -package-manager = "guix" # guix | nix | cargo | mix - -[maintenance-axes] -scoping-first = true -execution-order = "axis-1 > axis-2 > axis-3" -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -marker-scan = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-scan = "believe_me/assert_total" - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope-change reconciliation, stale-reference removal, obsolete-work culling" -perfective-third = true -perfective-source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed" -compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks" -drift-risk-example = "single exception broadening into policy violation (e.g. ReScript->TypeScript spread)" -effects-evidence = "benchmark execution/results and maintainer status dialogue/review" - -[design-rationale] -# Key design decisions and their reasoning diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/NEUROSYM.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/NEUROSYM.a2ml deleted file mode 100644 index 1acf7a30..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/NEUROSYM.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -# Configuration for Hypatia scanning and symbolic reasoning. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/PLAYBOOK.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/PLAYBOOK.a2ml deleted file mode 100644 index 6408e1c7..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/PLAYBOOK.a2ml +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -# Runbooks, incident response, deployment procedures. - -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml, Justfile -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Optional local permission hardening: `just perms-snapshot && just perms-lock` -# 4. Tag and push -# 5. Restore local permissions if needed: `just perms-restore` -# 6. Run `just container-push` if applicable - -[maintenance-operations] -# Baseline audit: -# just maint-audit -# Hard release gate: -# just maint-hard-pass -# Permission audit: -# just perms-audit diff --git a/k9-svc/pandoc/.machine_readable/descriptiles/STATE.a2ml b/k9-svc/pandoc/.machine_readable/descriptiles/STATE.a2ml deleted file mode 100644 index a76d8dd6..00000000 --- a/k9-svc/pandoc/.machine_readable/descriptiles/STATE.a2ml +++ /dev/null @@ -1,64 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Project state checkpoint (META-TEMPLATE) -# -# This is the STATE file for rsr-template-repo itself. -# When consumed by a new project, replace {{PLACEHOLDER}} tokens -# and customize sections below for the target project. - -[metadata] -project = "rsr-template-repo" -version = "0.2.0" -last-updated = "2026-02-28" -status = "active" # active | paused | archived - -[project-context] -name = "rsr-template-repo" -purpose = "Canonical RSR-compliant repository template providing scaffolding for all hyperpolymath projects — including CI/CD, AI manifests, ABI/FFI standards, container ecosystem, and governance infrastructure." -completion-percentage = 95 - -[position] -phase = "maintenance" # design | implementation | testing | maintenance | archived -maturity = "production" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - { name = "Phase 0: Core scaffolding (justfile, CI/CD, .machine_readable)", completion = 100 }, - { name = "Phase 1: ABI/FFI standard (Idris2/Zig templates)", completion = 100 }, - { name = "Phase 1b: AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)", completion = 100 }, - { name = "Phase 1c: TOPOLOGY.md standard and guide", completion = 100 }, - { name = "Phase 1d: Maintenance gate (axes, checklist, approach)", completion = 100 }, - { name = "Phase 1e: Trustfile / contractiles", completion = 100 }, - { name = "Phase 2: Container ecosystem templates (stapeln)", completion = 100 }, - { name = "Phase 3: Multi-forge sync hardening", completion = 0 }, - { name = "Phase 4: Nix/Guix reproducible shells", completion = 50 }, -] - -[blockers-and-issues] -# No active blockers - -[critical-next-actions] -actions = [ - "Container templates complete — test with `just container-init`", - "Validate container templates across wolfi-base and static Chainguard images", - "Harden multi-forge sync for GitLab/Bitbucket mirroring edge cases", - "Expand Nix/Guix development shell templates", -] - -[maintenance-status] -last-run-utc = "never" -last-report = "docs/reports/maintenance/latest.json" -last-result = "unknown" # unknown | pass | warn | fail -open-warnings = 0 -open-failures = 0 - -[ecosystem] -part-of = ["RSR Framework", "stapeln ecosystem"] -depends-on = ["stapeln", "selur-compose", "cerro-torre", "svalinn", "vordr", "k9-svc"] - -# --------------------------------------------------------------------------- -# NOTE FOR CONSUMERS: When using this template to create a new repo, reset -# the fields above to your project's values and replace all {{PLACEHOLDER}} -# tokens. The milestones above describe the TEMPLATE's evolution, not yours. -# --------------------------------------------------------------------------- diff --git a/k9-svc/pandoc/.machine_readable/policies/.maintenance-perms-ignore b/k9-svc/pandoc/.machine_readable/policies/.maintenance-perms-ignore deleted file mode 100644 index 2c8c4096..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/.maintenance-perms-ignore +++ /dev/null @@ -1,5 +0,0 @@ -# Regex patterns for justified permission-policy exceptions. -# One pattern per line. -# Example: -# ^vendor/ -# ^third_party/ diff --git a/k9-svc/pandoc/.machine_readable/policies/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/policies/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 01a19140..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "policies-registry" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-registry for policies metadata. diff --git a/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-AXES.a2ml b/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-AXES.a2ml deleted file mode 100644 index eeffd278..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-AXES.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Canonical maintenance governance model - -[metadata] -version = "1.0.0" -last-updated = "{{CURRENT_DATE}}" -scope = "repo" - -[discovery] -human-entrypoints = [ - "README.adoc", - "docs/maintenance/MAINTENANCE-CHECKLIST.md", - "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc", -] -machine-entrypoints = [ - ".machine_readable/policies/MAINTENANCE-AXES.a2ml", - ".machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml", - ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml", - ".machine_readable/META.a2ml", - ".machine_readable/ai/README.adoc", - ".machine_readable/bot_directives/README.scm", -] -bots = ["hypatia", "gitbot-fleet", "repo visitors"] - -[axes] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" -execution-order = "axis-1 > axis-2 > axis-3" - -[axis-1-scoping] -required = true -sources = "README, roadmap, status docs, maintenance checklist, CI/security docs" -markers = "TODO/FIXME/XXX/HACK/STUB/PARTIAL" -idris-unsound-markers = "believe_me/assert_total" -output = "scoped work assembly in must/intend/like buckets" - -[axis-2-maintenance] -corrective-first = true -adaptive-second = true -adaptive-focus = "scope changes, stale references, obsolete work culling" -perfective-third = true -perfective-source = "honest state from axis-1 after corrective/adaptive updates" - -[axis-3-audit] -systems-check = true -compliance-check = true -effects-check = true -compliance-focus = "seams/compromises/exception register and anti-drift" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" -effects-evidence = "benchmark evidence and maintainer dialogue/status review" diff --git a/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/pandoc/.machine_readable/policies/README.adoc b/k9-svc/pandoc/.machine_readable/policies/README.adoc deleted file mode 100644 index b7e25f57..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= policies Registry diff --git a/k9-svc/pandoc/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/pandoc/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/pandoc/.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/pandoc/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 615df84f..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-scripts-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for the project lifecycle, forge sync, - verification triggers, and maintenance. - -canonical_locations: - maintenance: "maintenance/" - lifecycle: "lifecycle/" - forge: "forge/" - verification: "verification/" diff --git a/k9-svc/pandoc/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 4bbd6cf3..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/forge/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-forge" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project forge. diff --git a/k9-svc/pandoc/.machine_readable/scripts/forge/README.adoc b/k9-svc/pandoc/.machine_readable/scripts/forge/README.adoc deleted file mode 100644 index 31adef65..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/forge/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Forge Scripts diff --git a/k9-svc/pandoc/.machine_readable/scripts/forge/forge-sync.sh b/k9-svc/pandoc/.machine_readable/scripts/forge/forge-sync.sh deleted file mode 100755 index 330e54b3..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/forge/forge-sync.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# forge-sync.sh — Multi-forge mirroring script -# -# Synchronises the local repository with GitHub, GitLab, and Codeberg. -# Usage: ./forge-sync.sh - -set -euo pipefail - -REMOTES=("origin" "gitlab" "codeberg") - -echo "=== RSR Forge Synchronisation ===" - -for remote in "${REMOTES[@]}"; do - if git remote | grep -q "^$remote$"; then - echo "Pushing to $remote..." - git push "$remote" --all - git push "$remote" --tags - else - echo "Skip: Remote '$remote' not configured." - fi -done - -echo "Sync complete." diff --git a/k9-svc/pandoc/.machine_readable/scripts/forge/git-cleanup.sh b/k9-svc/pandoc/.machine_readable/scripts/forge/git-cleanup.sh deleted file mode 100755 index 4fec1a27..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/forge/git-cleanup.sh +++ /dev/null @@ -1,8 +0,0 @@ -#!/usr/bin/env bash -# git-cleanup.sh — Repository hygiene script -set -euo pipefail -echo "Cleaning up merged branches..." -git fetch -p -git branch --merged | grep -v "\*" | grep -v "main" | xargs -n 1 git branch -d || echo "No branches to clean." -echo "Pruning remote tracking branches..." -git remote prune origin diff --git a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 3182d175..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-lifecycle" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project lifecycle. diff --git a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/README.adoc b/k9-svc/pandoc/.machine_readable/scripts/lifecycle/README.adoc deleted file mode 100644 index 8d262b14..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Lifecycle Scripts diff --git a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/install-tools.sh b/k9-svc/pandoc/.machine_readable/scripts/lifecycle/install-tools.sh deleted file mode 100755 index 408df642..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/lifecycle/install-tools.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# install-tools.sh — Developer toolchain installer -# -# Detects and installs the required project toolchain (asdf, nix, or guix). - -set -euo pipefail - -echo "=== RSR Toolchain Installer ===" - -if [ -f "flake.nix" ] && command -v nix &>/dev/null; then - echo "Nix detected. Setting up development shell..." - nix develop --command echo "Nix shell verified." -elif [ -f ".tool-versions" ] && command -v asdf &>/dev/null; then - echo "asdf detected. Installing plugins and tools..." - while read -r line; do - plugin=$(echo "$line" | awk '{print $1}') - asdf plugin add "$plugin" || true - done < .tool-versions - asdf install -else - echo "No standard toolchain (Nix/asdf) detected or installed." - echo "Please refer to README.adoc for manual setup instructions." -fi - -echo "Installer complete." diff --git a/k9-svc/pandoc/.machine_readable/scripts/maintenance/maint-assault.sh b/k9-svc/pandoc/.machine_readable/scripts/maintenance/maint-assault.sh deleted file mode 100644 index f170cabc..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/maintenance/maint-assault.sh +++ /dev/null @@ -1,44 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# maint-assault.sh — High-rigor stress testing using panic-attacker -# -# This script runs a full assault (static + dynamic) on the project binary -# to detect logic-based bug signatures and environmental vulnerabilities. - -set -euo pipefail - -BINARY_NAME="{{project}}" -REPORT_PATH="docs/reports/security/assault-latest.json" -PA_BIN="${PANIC_ATTACK_BIN:-panic-attack}" - -echo "=== High-Rigor Security Assault ===" - -# 1. Verify environment -if ! command -v "$PA_BIN" &>/dev/null; then - echo "Error: panic-attack tool not found." - echo "Please install it or set PANIC_ATTACK_BIN environment variable." - exit 1 -fi - -if [ ! -f "target/release/$BINARY_NAME" ]; then - echo "Warning: Release binary not found at target/release/$BINARY_NAME" - echo "Running build first..." - just build --release -fi - -# 2. Run Assault -echo "Initiating full assault on $BINARY_NAME..." -mkdir -p "$(dirname "$REPORT_PATH")" - -"$PA_BIN" assault "target/release/$BINARY_NAME" - --source . - --intensity medium - --duration 10 - --output "$REPORT_PATH" - -echo "" -echo "=== Assault Complete ===" -echo "Report generated: $REPORT_PATH" -echo "To review interactively, run:" -echo " $PA_BIN tui $REPORT_PATH" diff --git a/k9-svc/pandoc/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 460e0694..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/verification/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "automation-unit-verification" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Internal automation logic for project verification. diff --git a/k9-svc/pandoc/.machine_readable/scripts/verification/README.adoc b/k9-svc/pandoc/.machine_readable/scripts/verification/README.adoc deleted file mode 100644 index 277b4aa6..00000000 --- a/k9-svc/pandoc/.machine_readable/scripts/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Scripts diff --git a/k9-svc/pandoc/.tool-versions b/k9-svc/pandoc/.tool-versions deleted file mode 100644 index f8af37b2..00000000 --- a/k9-svc/pandoc/.tool-versions +++ /dev/null @@ -1,9 +0,0 @@ -# Uncomment and customize for your project -# rust nightly -# just 1.40.0 -# nickel 1.10.0 -# gleam 1.8.0 -# elixir 1.18.0 -# erlang 27.2 -# zig 0.14.0 -# idris2 0.7.0 diff --git a/k9-svc/pandoc/.well-known/ai.txt b/k9-svc/pandoc/.well-known/ai.txt deleted file mode 100644 index cc7cbc35..00000000 --- a/k9-svc/pandoc/.well-known/ai.txt +++ /dev/null @@ -1,18 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# ai.txt - AI interaction policy -# See: https://site.spawning.ai/spawning-ai-txt - -User-Agent: * -Disallow-Training: yes -Disallow-Summarization: no -Disallow-Generation: yes - -# This project's code is licensed under PMPL-1.0-or-later. -# AI agents may read and analyze this code for assisting contributors. -# AI agents must NOT use this code for model training without explicit consent. -# AI agents must preserve Emotional Lineage per PMPL Section 3. -# -# For AI agent integration instructions, see: -# 0-AI-MANIFEST.a2ml (universal AI entry point) -# AI.a2ml (Claude-specific instructions) -# .machine_readable/ (structured project state) diff --git a/k9-svc/pandoc/.well-known/humans.txt b/k9-svc/pandoc/.well-known/humans.txt deleted file mode 100644 index 8891981a..00000000 --- a/k9-svc/pandoc/.well-known/humans.txt +++ /dev/null @@ -1,14 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# humanstxt.org - -/* TEAM */ -Maintainer: {{AUTHOR}} ({{OWNER}}) -Contact: {{AUTHOR_EMAIL}} -From: United Kingdom - -/* SITE */ -Last update: {{CURRENT_DATE}} -Standards: RSR (Rhodium Standard Repository) -License: MPL-2.0 (code) / CC-BY-SA-4.0 (docs) -Components: Idris2 ABI, Zig FFI -Tools: just, Podman, Guix diff --git a/k9-svc/pandoc/.well-known/security.txt b/k9-svc/pandoc/.well-known/security.txt deleted file mode 100644 index 5414d508..00000000 --- a/k9-svc/pandoc/.well-known/security.txt +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RFC 9116 - security.txt -# https://securitytxt.org/ - -Contact: mailto:{{SECURITY_EMAIL}} -Expires: {{CURRENT_YEAR}}-12-31T23:59:59.000Z -Encryption: {{PGP_KEY_URL}} -Preferred-Languages: en -Canonical: https://{{FORGE}}/{{OWNER}}/{{REPO}}/.well-known/security.txt -Policy: https://{{FORGE}}/{{OWNER}}/{{REPO}}/blob/main/SECURITY.md -Hiring: https://{{WEBSITE}}/careers diff --git a/k9-svc/pandoc/0-AI-MANIFEST.a2ml b/k9-svc/pandoc/0-AI-MANIFEST.a2ml deleted file mode 100644 index dc12c575..00000000 --- a/k9-svc/pandoc/0-AI-MANIFEST.a2ml +++ /dev/null @@ -1,121 +0,0 @@ -# ⚠️ STOP - CRITICAL READING REQUIRED - -**THIS FILE MUST BE READ FIRST BY ALL AI AGENTS** - -## WHAT IS THIS? - -This is the AI manifest for **[YOUR-REPO-NAME]**. It declares: -- Canonical file locations (where things MUST be, and nowhere else) -- Critical invariants (rules that must NEVER be violated) -- Repository structure and organization - -## CANONICAL LOCATIONS (UNIVERSAL RULE) - -### Machine-Readable Metadata: `.machine_readable/` ONLY - -These 6 a2ml files MUST exist in `.machine_readable/` directory ONLY: -1. **STATE.a2ml** - Project state, progress, blockers -2. **META.a2ml** - Architecture decisions, governance -3. **ECOSYSTEM.a2ml** - Position in ecosystem, relationships -4. **AGENTIC.a2ml** - AI agent interaction patterns -5. **NEUROSYM.a2ml** - Neurosymbolic integration config -6. **PLAYBOOK.a2ml** - Operational runbook - -**CRITICAL:** If ANY of these files exist in the root directory, this is an ERROR. - -### Anchor File: `.machine_readable/anchors/ANCHOR.a2ml` ONLY - -Canonical authority and semantic-boundary declaration MUST exist at: - -` .machine_readable/anchors/ANCHOR.a2ml ` - -Do not place `ANCHOR.a2ml` at repository root. - -### Maintenance Policies: `.machine_readable/policies/` ONLY - -Canonical maintenance/governance files MUST exist under: - -` .machine_readable/policies/ ` - -Minimum required files: -- `MAINTENANCE-AXES.a2ml` -- `MAINTENANCE-CHECKLIST.a2ml` -- `SOFTWARE-DEVELOPMENT-APPROACH.a2ml` - -Do not place maintenance policy files in repository root. - -### Bot Directives: `.machine_readable/bot_directives/` ONLY - -Bot-specific instructions for your automated agents. - -### Contractiles: `.machine_readable/contractiles/` ONLY - -Policy enforcement contracts (k9, dust, lust, must, trust). - -### AI Configuration & Guides: `.machine_readable/ai/` ONLY - -- `AI.a2ml` - Language-specific or LLM-specific patterns -- `PLACEHOLDERS.md` - Bootstrap guide - -### Community & Forge Metadata: `.github/` ONLY - -- `CODEOWNERS` - Review assignments -- `MAINTAINERS` - Machine-readable contact list -- `SUPPORT` - Support channels -- `SECURITY.md` - Technical security policy -- `CONTRIBUTING.md` - Technical contribution manual -- `CODE_OF_CONDUCT.md` - Conduct rules - -### Agent Instructions - -- `0-AI-MANIFEST.a2ml` - THIS FILE (universal entry point) - -## CORE INVARIANTS - -1. **No state file duplication** - Root must NOT contain STATE.a2ml, META.a2ml, etc. -2. **Single source of truth** - `.machine_readable/` is authoritative -3. **No stale metadata** - If root state files exist, they are OUT OF DATE -4. **License consistency** - All code PMPL-1.0-or-later unless platform requires MPL-2.0 -5. **Author attribution** - Always "{{AUTHOR}} <{{AUTHOR_EMAIL}}>" -6. **Container images** - MUST use Chainguard base (`cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`) -7. **Container runtime** - Podman, never Docker. Files are `Containerfile`, never `Dockerfile` -8. **Container orchestration** - `selur-compose`, never `docker-compose` - -## REPOSITORY STRUCTURE - -This repo follows the **Dual-Track** architecture: - -``` -[YOUR-REPO-NAME]/ -├── 0-AI-MANIFEST.a2ml # THIS FILE (start here) -├── README.adoc # High-level orientation (Rich Human) -├── ROADMAP.adoc # Future direction -├── CONTRIBUTING.adoc # Human contribution guide -├── GOVERNANCE.adoc # Decision-making model -├── Justfile # Task runner -├── Containerfile # OCI build -├── LICENSE # Primary license -├── src/ # Source code -│ └── interface/ # Verified Interface Seams -│ ├── abi/ # Idris2 ABI (The Spec) -│ ├── ffi/ # Zig FFI (The Bridge) -│ └── generated/ # C Headers (The Result) -├── container/ # Stapeln container ecosystem -├── docs/ # Technical depths -│ ├── attribution/ # Citations, owners, maintainers (adoc) -│ ├── architecture/ # Topology, diagrams -│ ├── theory/ # Domain theory -│ └── practice/ # Manuals -├── docs/legal/ # Legal exhibits and full texts -└── .machine_readable/ # ALL machine-readable metadata -``` - -## SESSION STARTUP CHECKLIST - -✅ Read THIS file (0-AI-MANIFEST.a2ml) first -✅ Understand canonical location: `.machine_readable/` -✅ State understanding of canonical locations - -## ATTESTATION PROOF - -**"I have read the AI manifest. All machine-readable content (state files, anchors, policies, bot directives, contractiles, AI guides) is located in `.machine_readable/` ONLY, and community metadata is in `.github/`. I will not create duplicate files in the root directory."** diff --git a/k9-svc/pandoc/CHANGELOG.adoc b/k9-svc/pandoc/CHANGELOG.adoc deleted file mode 100644 index ca1c6528..00000000 --- a/k9-svc/pandoc/CHANGELOG.adoc +++ /dev/null @@ -1,9 +0,0 @@ -== Changelog - -All notable changes to this project will be documented in this file. - -The format is based on https://keepachangelog.com/en/1.1.0/[Keep a -Changelog], and this project adheres to -https://semver.org/spec/v2.0.0.html[Semantic Versioning]. - -=== [Unreleased] diff --git a/k9-svc/pandoc/CONTRIBUTING.adoc b/k9-svc/pandoc/CONTRIBUTING.adoc deleted file mode 100644 index a7cf8611..00000000 --- a/k9-svc/pandoc/CONTRIBUTING.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Contributing to {project-name} -:toc: preamble -:icons: font - -This document explains how to contribute to the project. We follow a "Dual-Track" architecture where human-readable documentation lives in the root and machine-readable policies live in `.machine_readable/`. - -== How to Contribute - -We welcome contributions in many forms: -* **Code:** Improving the core verified stack or extensions. -* **Documentation:** Enhancing AsciiDoc manuals or AI manifests. -* **Testing:** Adding property-based tests or formal proofs. - -== Getting Started - -1. **Read the AI Manifest:** Start with `0-AI-MANIFEST.a2ml` to understand the repository structure. -2. **Environment:** Use `nix develop` or `direnv allow` to set up your tools (Idris2, Zig, Rust). -3. **Task Runner:** Use `just` to see available commands (`just --list`). - -== Contribution Policies - -For detailed rules on branch naming, commit messages, and the PR process, please refer to the machine-readable manual at link:.github/CONTRIBUTING.md[CONTRIBUTING.adoc]. - -== Code of Conduct - -All contributors are expected to adhere to our ethical standards. See link:.github/CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.adoc] for details. diff --git a/k9-svc/pandoc/Containerfile b/k9-svc/pandoc/Containerfile deleted file mode 100644 index d7266bc0..00000000 --- a/k9-svc/pandoc/Containerfile +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# Containerfile for {{PROJECT_NAME}} -# Build: podman build -t {{project}}:latest -f Containerfile . -# Run: podman run --rm -it {{project}}:latest -# Seal: selur seal {{project}}:latest - -# --- Build stage --- -FROM cgr.dev/chainguard/wolfi-base:latest AS build - -# TODO: Install build dependencies for your stack -# Examples: -# RUN apk add --no-cache rust cargo # Rust -# RUN apk add --no-cache elixir erlang # Elixir -# RUN apk add --no-cache zig # Zig - -WORKDIR /build -COPY . . - -# TODO: Replace with your build command -# Examples: -# RUN cargo build --release -# RUN mix deps.get && MIX_ENV=prod mix release -# RUN zig build -Doptimize=ReleaseSafe - -# --- Runtime stage --- -FROM cgr.dev/chainguard/static:latest - -# Copy built artifact from build stage -# TODO: Replace with your binary/artifact path -# Examples: -# COPY --from=build /build/target/release/{{project}} /usr/local/bin/ -# COPY --from=build /build/_build/prod/rel/{{project}} /app/ -# COPY --from=build /build/zig-out/bin/{{project}} /usr/local/bin/ - -# Non-root user (chainguard images default to nonroot) -USER nonroot - -# TODO: Replace with your entrypoint -# ENTRYPOINT ["/usr/local/bin/{{project}}"] diff --git a/k9-svc/pandoc/Justfile b/k9-svc/pandoc/Justfile deleted file mode 100644 index 1b37b870..00000000 --- a/k9-svc/pandoc/Justfile +++ /dev/null @@ -1,916 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -# -# RSR Standard Justfile Template -# https://just.systems/man/en/ -# -# Copy this file to new projects and customize the placeholder values. -# -# Run `just` to see all available recipes -# Run `just cookbook` to generate docs/just-cookbook.adoc -# Run `just combinations` to see matrix recipe options - -set shell := ["bash", "-uc"] -set dotenv-load := true -set positional-arguments := true - -# Import auto-generated contractile recipes (must-check, trust-verify, etc.) -# Re-generate with: contractile gen-just -import? "contractile.just" - -# Project metadata — customize these -project := "{{PROJECT_NAME}}" -PROJECT_NAME := "pandoc-k9" -OWNER := "hyperpolymath" -AUTHOR := "hyperpolymath" -AUTHOR_EMAIL := "maintainers@hyperpolymath.org" -CURRENT_YEAR := "2026" -PLACEHOLDER := "PLACEHOLDER" -version := "0.1.0" -tier := "infrastructure" # 1 | 2 | infrastructure - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEFAULT & HELP -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show all available recipes with descriptions -default: - @just --list --unsorted - -# Show detailed help for a specific recipe -help recipe="": - #!/usr/bin/env bash - if [ -z "{{recipe}}" ]; then - just --list --unsorted - echo "" - echo "Usage: just help " - echo " just cookbook # Generate full documentation" - echo " just combinations # Show matrix recipes" - else - just --show "{{recipe}}" 2>/dev/null || echo "Recipe '{{recipe}}' not found" - fi - -# Show this project's info -info: - @echo "Project: {{project}}" - @echo "Version: {{version}}" - @echo "RSR Tier: {{tier}}" - @echo "Recipes: $(just --summary | wc -w)" - @[ -f ".machine_readable/STATE.a2ml" ] && grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml | head -1 | xargs -I{} echo "Phase: {}" || true - -# ═══════════════════════════════════════════════════════════════════════════════ -# INIT — Bootstrap a new project from this template -# ═══════════════════════════════════════════════════════════════════════════════ - -# Interactive project bootstrap — replaces all {{PLACEHOLDER}} tokens -init: - #!/usr/bin/env bash - set -euo pipefail - - echo "═══════════════════════════════════════════════════" - echo " RSR Project Bootstrap" - echo "═══════════════════════════════════════════════════" - echo "" - - # --- Load defaults from config (if exists) --- - # Create yours: ~/.config/rsr/defaults - # Format: OWNER=myorg AUTHOR="My Name" AUTHOR_EMAIL=me@example.org ... - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # --- Required values (pre-filled from defaults if available) --- - read -rp "Project name (human-readable, e.g. My Project): " PROJECT_NAME - [ -z "$PROJECT_NAME" ] && echo "Error: project name required" && exit 1 - - read -rp "Repository slug (e.g. my-project): " REPO - [ -z "$REPO" ] && echo "Error: repo slug required" && exit 1 - - read -rp "Owner [${OWNER:-}]: " _OWNER - OWNER="${_OWNER:-${OWNER:-}}" - [ -z "$OWNER" ] && echo "Error: owner required" && exit 1 - - read -rp "Author full name [${AUTHOR:-}]: " _AUTHOR - AUTHOR="${_AUTHOR:-${AUTHOR:-}}" - [ -z "$AUTHOR" ] && echo "Error: author name required" && exit 1 - - read -rp "Author email [${AUTHOR_EMAIL:-}]: " _AUTHOR_EMAIL - AUTHOR_EMAIL="${_AUTHOR_EMAIL:-${AUTHOR_EMAIL:-}}" - [ -z "$AUTHOR_EMAIL" ] && echo "Error: email required" && exit 1 - - # --- Optional values (pre-filled from defaults if available) --- - read -rp "Author organization [${AUTHOR_ORG:-none}]: " _AUTHOR_ORG - AUTHOR_ORG="${_AUTHOR_ORG:-${AUTHOR_ORG:-}}" - - read -rp "Previous/alt email [${AUTHOR_EMAIL_ALT:-none}]: " _AUTHOR_EMAIL_ALT - AUTHOR_EMAIL_ALT="${_AUTHOR_EMAIL_ALT:-${AUTHOR_EMAIL_ALT:-}}" - - read -rp "Project description []: " PROJECT_DESCRIPTION - - read -rp "Forge domain [${FORGE:-github.com}]: " _FORGE - FORGE="${_FORGE:-${FORGE:-github.com}}" - - read -rp "Security contact email [${SECURITY_EMAIL:-$AUTHOR_EMAIL}]: " _SECURITY_EMAIL - SECURITY_EMAIL="${_SECURITY_EMAIL:-${SECURITY_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Conduct contact email [${CONDUCT_EMAIL:-$AUTHOR_EMAIL}]: " _CONDUCT_EMAIL - CONDUCT_EMAIL="${_CONDUCT_EMAIL:-${CONDUCT_EMAIL:-$AUTHOR_EMAIL}}" - - read -rp "Project type (library|binary|monorepo|service|website) [library]: " PROJECT_TYPE - PROJECT_TYPE="${PROJECT_TYPE:-library}" - - read -rp "Website URL [https://${FORGE}/${OWNER}/${REPO}]: " WEBSITE - WEBSITE="${WEBSITE:-https://${FORGE}/${OWNER}/${REPO}}" - - # --- Container values (optional — only relevant if container/ exists) --- - if [ -d "container" ]; then - echo "" - echo "── Container configuration (optional) ─────────" - read -rp "Service name [${REPO}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-${REPO}}" - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - read -rp "Container registry [ghcr.io/${OWNER}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER}}" - else - SERVICE_NAME="${REPO}" - PORT="8080" - REGISTRY="ghcr.io/${OWNER}" - fi - - # --- Derived values --- - PROJECT_UPPER=$(echo "$REPO" | tr '[:lower:]-' '[:upper:]_') - PROJECT_LOWER=$(echo "$REPO" | tr '[:upper:]-' '[:lower:]_') - CURRENT_YEAR=$(date +%Y) - CURRENT_DATE=$(date +%Y-%m-%d) - VERSION="0.1.0" - - # Derive citation name parts (best-effort split on last space) - AUTHOR_LAST="${AUTHOR##* }" - AUTHOR_FIRST="${AUTHOR% *}" - FIRST_INITIAL="${AUTHOR_FIRST:0:1}." - if [ "$AUTHOR_LAST" = "$AUTHOR_FIRST" ]; then - AUTHOR_FIRST="$AUTHOR" - AUTHOR_LAST="" - FIRST_INITIAL="" - fi - - echo "" - echo "── Summary ──────────────────────────────────────" - echo " Project: $PROJECT_NAME" - echo " Repo: $REPO" - echo " Owner: $OWNER" - echo " Author: $AUTHOR <$AUTHOR_EMAIL>" - [ -n "$AUTHOR_ORG" ] && echo " Organization: $AUTHOR_ORG" - echo " Forge: $FORGE" - echo " Year: $CURRENT_YEAR" - echo "────────────────────────────────────────────────" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing placeholders..." - - # Brace tokens as variables (hex avoids just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - # Build the sed expression list - # Note: using | as delimiter since URLs contain / - SED_ARGS=( - -e "s|${LB}PROJECT_NAME${RB}|${PROJECT_NAME}|g" - -e "s|${LB}PROJECT_DESCRIPTION${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT${RB}|${PROJECT_UPPER}|g" - -e "s|${LB}project${RB}|${PROJECT_LOWER}|g" - -e "s|${LB}REPO${RB}|${REPO}|g" - -e "s|${LB}OWNER${RB}|${OWNER}|g" - -e "s|${LB}AUTHOR${RB}|${AUTHOR}|g" - -e "s|${LB}AUTHOR_EMAIL${RB}|${AUTHOR_EMAIL}|g" - -e "s|${LB}AUTHOR_ORG${RB}|${AUTHOR_ORG}|g" - -e "s|${LB}AUTHOR_LAST${RB}|${AUTHOR_LAST}|g" - -e "s|${LB}AUTHOR_FIRST${RB}|${AUTHOR_FIRST}|g" - -e "s|${LB}AUTHOR_INITIALS${RB}|${FIRST_INITIAL}|g" - -e "s|${LB}FORGE${RB}|${FORGE}|g" - -e "s|${LB}CURRENT_YEAR${RB}|${CURRENT_YEAR}|g" - -e "s|${LB}CURRENT_DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}DATE${RB}|${CURRENT_DATE}|g" - -e "s|${LB}SECURITY_EMAIL${RB}|${SECURITY_EMAIL}|g" - -e "s|${LB}CONDUCT_EMAIL${RB}|${CONDUCT_EMAIL}|g" - -e "s|${LB}LICENSE${RB}|PMPL-1.0-or-later|g" - -e "s|${LB}CONDUCT_TEAM${RB}|Code of Conduct Committee|g" - -e "s|${LB}RESPONSE_TIME${RB}|48 hours|g" - -e "s|${LB}MAIN_BRANCH${RB}|main|g" - -e "s|${LB}PROJECT_PURPOSE${RB}|${PROJECT_DESCRIPTION}|g" - -e "s|${LB}PROJECT_ROLE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}PROJECT_TYPE${RB}|${PROJECT_TYPE}|g" - -e "s|${LB}WEBSITE${RB}|${WEBSITE}|g" - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - -e "s|${LB}IMAGE${RB}|${REGISTRY}/${SERVICE_NAME}|g" - -e "s|${LB}VERSION${RB}|${VERSION}|g" - -e "s|${LB}EMAIL${RB}|${AUTHOR_EMAIL}|g" - ) - [ -n "$AUTHOR_EMAIL_ALT" ] && SED_ARGS+=(-e "s|${LB}AUTHOR_EMAIL_ALT${RB}|${AUTHOR_EMAIL_ALT}|g") - - # Replace in all text files (skip .git, LICENSE text, and binaries) - find . -type f \ - -not -path './.git/*' \ - -not -name 'PMPL-1.0-or-later.txt' \ - -not -name '*.png' -not -name '*.jpg' -not -name '*.gif' \ - -not -name '*.woff' -not -name '*.woff2' \ - | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - # Also replace [YOUR-REPO-NAME] and [YOUR-NAME/ORG] in AI manifest - sed -i "s|\[YOUR-REPO-NAME\]|${PROJECT_NAME}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - sed -i "s|\[YOUR-NAME/ORG\]|${OWNER}|g" 0-AI-MANIFEST.a2ml 2>/dev/null || true - - echo "" - echo "── Validation ───────────────────────────────────" - - # Check for remaining placeholders - PATTERN="${LB}[A-Z_]*${RB}" - REMAINING=$(grep -rl "$PATTERN" . --include='*.md' --include='*.adoc' --include='*.yml' --include='*.yaml' --include='*.a2ml' --include='*.toml' --include='*.scm' --include='*.ncl' --include='*.nix' --include='*.json' --include='*.sh' 2>/dev/null | grep -v '.git/' | grep -v '.machine_readable/ai/PLACEHOLDERS.adoc' || true) - if [ -n "$REMAINING" ]; then - echo "WARNING: Remaining placeholders in:" - echo "$REMAINING" | sed 's/^/ /' - echo "" - echo "Run: grep -rn '$LB' . --include='*.md' to inspect" - else - echo "All placeholders replaced successfully!" - fi - - # K9-SVC validation (if available) - if command -v k9-svc >/dev/null 2>&1; then - echo "" - echo "Running k9-svc validation..." - k9-svc validate . 2>/dev/null || true - fi - - echo "" - echo "Done! Next steps:" - echo " 1. Review changes: git diff" - echo " 2. Remove template cruft: rm .machine_readable/ai/PLACEHOLDERS.adoc" - echo " 3. Customize README.adoc for your project" - echo " 4. Commit: git add -A && git commit -m 'feat: initialize from RSR template'" - echo " 5. Push: git remote add origin git@${FORGE}:${OWNER}/${REPO}.git && git push -u origin main" - -# ═══════════════════════════════════════════════════════════════════════════════ -# BUILD & COMPILE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build the project (debug mode) -build *args: - @echo "Building {{project}} (debug)..." - # TODO: Replace with your build command - # Examples: - # cargo build {{args}} # Rust - # mix compile {{args}} # Elixir - # zig build {{args}} # Zig - # deno task build {{args}} # Deno/ReScript - @echo "Build complete" - -# Build in release mode with optimizations -build-release *args: - @echo "Building {{project}} (release)..." - # TODO: Replace with your release build command - # Examples: - # cargo build --release {{args}} - # MIX_ENV=prod mix compile {{args}} - # zig build -Doptimize=ReleaseFast {{args}} - @echo "Release build complete" - -# Build and watch for changes (requires entr or similar) -build-watch: - @echo "Watching for changes..." - # TODO: Customize file patterns for your language - # Examples: - # find src -name '*.rs' | entr -c just build - # mix compile --force --warnings-as-errors - # deno task dev - -# Clean build artifacts [reversible: rebuild with `just build`] -clean: - @echo "Cleaning..." - # TODO: Customize for your build system - rm -rf target/ _build/ build/ dist/ out/ obj/ bin/ - -# Deep clean including caches [reversible: rebuild] -clean-all: clean - rm -rf .cache .tmp - -# ═══════════════════════════════════════════════════════════════════════════════ -# TEST & QUALITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run all tests -test *args: - @echo "Running tests..." - # TODO: Replace with your test command - # Examples: - # cargo test {{args}} - # mix test {{args}} - # zig build test {{args}} - # deno test {{args}} - @echo "Tests passed!" - -# Run tests with verbose output -test-verbose: - @echo "Running tests (verbose)..." - # TODO: Replace with verbose test command - -# Smoke test -test-smoke: - @echo "Smoke test..." - # TODO: Add basic sanity checks - -# Run all quality checks -quality: fmt-check lint test - @echo "All quality checks passed!" - -# Fix all auto-fixable issues [reversible: git checkout] -fix: fmt - @echo "Fixed all auto-fixable issues" - -# ═══════════════════════════════════════════════════════════════════════════════ -# LINT & FORMAT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Format all source files [reversible: git checkout] -fmt: - @echo "Formatting source files..." - # TODO: Replace with your formatter - # Examples: - # cargo fmt - # mix format - # gleam format - # deno fmt - -# Check formatting without changes -fmt-check: - @echo "Checking formatting..." - # TODO: Replace with your format check - # Examples: - # cargo fmt --check - # mix format --check-formatted - # gleam format --check - -# Run linter -lint: - @echo "Linting source files..." - # TODO: Replace with your linter - # Examples: - # cargo clippy -- -D warnings - # mix credo --strict - # gleam check - -# ═══════════════════════════════════════════════════════════════════════════════ -# RUN & EXECUTE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run the application -run *args: build - # TODO: Replace with your run command - echo "Run not configured yet" - -# Run with verbose output -run-verbose *args: build - # TODO: Replace with verbose run command - echo "Run not configured yet" - -# Install to user path -install: build-release - @echo "Installing {{project}}..." - # TODO: Replace with your install command - -# ═══════════════════════════════════════════════════════════════════════════════ -# DEPENDENCIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Install/check all dependencies -deps: - @echo "Checking dependencies..." - # TODO: Replace with your dependency check - # Examples: - # cargo check - # mix deps.get - # gleam deps download - @echo "All dependencies satisfied" - -# Audit dependencies for vulnerabilities -deps-audit: - @echo "Auditing for vulnerabilities..." - # TODO: Replace with your audit command - # Examples: - # cargo audit - # mix audit - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL --quiet . || true - @command -v gitleaks >/dev/null && gitleaks detect --source . --no-git --quiet || true - @echo "Audit complete" - -# ═══════════════════════════════════════════════════════════════════════════════ -# DOCUMENTATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Generate all documentation -docs: - @mkdir -p docs/generated docs/man - just cookbook - just man - @echo "Documentation generated in docs/" - -# Generate justfile cookbook documentation -cookbook: - #!/usr/bin/env bash - mkdir -p docs - OUTPUT="docs/just-cookbook.adoc" - echo "= {{project}} Justfile Cookbook" > "$OUTPUT" - echo ":toc: left" >> "$OUTPUT" - echo ":toclevels: 3" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "Generated: $(date -Iseconds)" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "== Recipes" >> "$OUTPUT" - echo "" >> "$OUTPUT" - just --list --unsorted | while read -r line; do - if [[ "$line" =~ ^[[:space:]]+([a-z_-]+) ]]; then - recipe="${BASH_REMATCH[1]}" - echo "=== $recipe" >> "$OUTPUT" - echo "" >> "$OUTPUT" - echo "[source,bash]" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "just $recipe" >> "$OUTPUT" - echo "----" >> "$OUTPUT" - echo "" >> "$OUTPUT" - fi - done - echo "Generated: $OUTPUT" - -# Generate man page -man: - #!/usr/bin/env bash - mkdir -p docs/man - cat > docs/man/{{project}}.1 << EOF - .TH {{project}} 1 "$(date +%Y-%m-%d)" "{{version}}" "{{project}} Manual" - .SH NAME - {{project}} \- RSR-compliant project - .SH SYNOPSIS - .B just - [recipe] [args...] - .SH DESCRIPTION - RSR (Rhodium Standard Repository) project managed with just. - .SH AUTHOR - $(git config user.name 2>/dev/null || echo "Author") <$(git config user.email 2>/dev/null || echo "email")> - EOF - echo "Generated: docs/man/{{project}}.1" - -# ═══════════════════════════════════════════════════════════════════════════════ -# CONTAINERS (stapeln ecosystem — Podman + Chainguard Wolfi) -# ═══════════════════════════════════════════════════════════════════════════════ - -# Initialise container templates — substitute placeholders with project values -container-init: - #!/usr/bin/env bash - set -euo pipefail - - if [ ! -d "container" ]; then - echo "Error: container/ directory not found." - echo "This repo may not have been created from rsr-template-repo." - exit 1 - fi - - echo "=== Container Template Initialisation ===" - echo "" - - # Load RSR defaults if available - DEFAULTS="${XDG_CONFIG_HOME:-$HOME/.config}/rsr/defaults" - if [ -f "$DEFAULTS" ]; then - echo "Loading defaults from $DEFAULTS" - # shellcheck source=/dev/null - source "$DEFAULTS" - echo "" - fi - - # Prompt for container-specific values - read -rp "Service name (e.g. my-api) [{{project}}]: " _SERVICE_NAME - SERVICE_NAME="${_SERVICE_NAME:-{{project}}}" - - read -rp "Primary port [8080]: " _PORT - PORT="${_PORT:-8080}" - - read -rp "Container registry [ghcr.io/${OWNER:-{{OWNER}}}]: " _REGISTRY - REGISTRY="${_REGISTRY:-ghcr.io/${OWNER:-{{OWNER}}}}" - - echo "" - echo " Service: $SERVICE_NAME" - echo " Port: $PORT" - echo " Registry: $REGISTRY" - echo "" - read -rp "Proceed? [Y/n] " CONFIRM - [[ "${CONFIRM:-Y}" =~ ^[Nn] ]] && echo "Aborted." && exit 0 - - echo "" - echo "Replacing container placeholders..." - - # Brace tokens as variables (hex escapes avoid just interpolation) - LB=$(printf '\x7b\x7b') - RB=$(printf '\x7d\x7d') - - SED_ARGS=( - -e "s|${LB}SERVICE_NAME${RB}|${SERVICE_NAME}|g" - -e "s|${LB}PORT${RB}|${PORT}|g" - -e "s|${LB}REGISTRY${RB}|${REGISTRY}|g" - ) - - find container/ -type f | while read -r file; do - if file --brief "$file" | grep -qi 'text\|ascii\|utf'; then - sed -i "${SED_ARGS[@]}" "$file" - fi - done - - echo "Container templates initialised." - echo "" - echo "Next steps:" - echo " 1. Edit container/Containerfile — add your build commands" - echo " 2. Edit container/entrypoint.sh — set your application binary" - echo " 3. Review container/compose.toml — adjust services and volumes" - echo " 4. Build: just container-build" - -# Build container image via cerro-torre pipeline -container-build *args: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh {{args}} - elif [ -f "container/Containerfile" ]; then - podman build -t {{project}}:latest -f container/Containerfile . - elif [ -f "Containerfile" ]; then - podman build -t {{project}}:latest -f Containerfile . - else - echo "No Containerfile found in container/ or project root" - exit 1 - fi - -# Verify compose configuration -container-verify: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose verify - else - echo "selur-compose not found, falling back to podman compose" - podman compose --file compose.toml config - fi - -# Start container stack -container-up *args: - #!/usr/bin/env bash - if [ ! -f "container/compose.toml" ]; then - echo "No container/compose.toml found" - exit 1 - fi - cd container - if command -v selur-compose &>/dev/null; then - selur-compose up {{args}} - else - podman compose --file compose.toml up {{args}} - fi - -# Stop container stack -container-down: - #!/usr/bin/env bash - cd container 2>/dev/null || { echo "No container/ directory"; exit 1; } - if command -v selur-compose &>/dev/null; then - selur-compose down - else - podman compose --file compose.toml down - fi - -# Sign and verify container bundle (build + pack + sign + verify) -container-sign: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh - else - echo "No container/ct-build.sh found" - exit 1 - fi - -# Push signed bundle to registry -container-push: - #!/usr/bin/env bash - if [ -f "container/ct-build.sh" ]; then - cd container && ./ct-build.sh --push - else - echo "No container/ct-build.sh found — falling back to podman push" - podman push {{project}}:latest - fi - -# Run container interactively (for debugging) -container-run *args: - podman run --rm -it {{project}}:latest {{args}} - -# ═══════════════════════════════════════════════════════════════════════════════ -# CI & AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run full CI pipeline locally -ci: deps quality - @echo "CI pipeline complete!" - -# Install git hooks -install-hooks: - @mkdir -p .git/hooks - @cat > .git/hooks/pre-commit << 'HOOKEOF' - #!/bin/bash - just fmt-check || exit 1 - just lint || exit 1 - HOOKEOF - @chmod +x .git/hooks/pre-commit - @echo "Git hooks installed" - -# ═══════════════════════════════════════════════════════════════════════════════ -# SECURITY -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run security audit -security: deps-audit - @echo "=== Security Audit ===" - @command -v gitleaks >/dev/null && gitleaks detect --source . --verbose || true - @command -v trivy >/dev/null && trivy fs --severity HIGH,CRITICAL . || true - @echo "Security audit complete" - -# Generate SBOM -sbom: - @mkdir -p docs/security - @command -v syft >/dev/null && syft . -o spdx-json > docs/security/sbom.spdx.json || echo "syft not found" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VALIDATION & COMPLIANCE -# ═══════════════════════════════════════════════════════════════════════════════ - -# Validate RSR compliance -validate-rsr: - #!/usr/bin/env bash - echo "=== RSR Compliance Check ===" - MISSING="" - for f in .editorconfig .gitignore Justfile README.adoc LICENSE 0-AI-MANIFEST.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in .machine_readable/STATE.a2ml .machine_readable/META.a2ml .machine_readable/ECOSYSTEM.a2ml .machine_readable/anchors/ANCHOR.a2ml .machine_readable/policies/MAINTENANCE-AXES.a2ml .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in licensing/exhibits/EXHIBIT-A-ETHICAL-USE.txt licensing/exhibits/EXHIBIT-B-QUANTUM-SAFE.txt licensing/texts/PMPL-1.0-or-later.txt; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - for f in src/interface/abi src/interface/ffi src/interface/generated; do - [ -d "$f" ] || MISSING="$MISSING $f" - done - for f in docs/maintenance/MAINTENANCE-CHECKLIST.adoc docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc; do - [ -f "$f" ] || MISSING="$MISSING $f" - done - if [ -f ".machine_readable/META.a2ml" ]; then - grep -q 'axis-1 = "must > intend > like"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-1" - grep -q 'axis-2 = "corrective > adaptive > perfective"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-2" - grep -q 'axis-3 = "systems > compliance > effects"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:axis-3" - grep -q 'scoping-first = true' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:scoping-first" - grep -q 'idris-unsound-scan = "believe_me/assert_total"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:idris-unsound-scan" - grep -q 'audit-focus = "systems in place, documentation explains actual state, safety/security accounted for, observed effects reviewed"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:audit-focus" - grep -q 'compliance-focus = "seams/compromises/exception register, bounded exceptions, anti-drift checks"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:compliance-focus" - grep -q 'effects-evidence = "benchmark execution/results and maintainer status dialogue/review"' .machine_readable/META.a2ml || MISSING="$MISSING META.a2ml:effects-evidence" - grep -q 'compliance-tooling = "panic-attack"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:compliance-tooling" - grep -q 'effects-tooling = "ecological checking with sustainabot guidance"' .machine_readable/policies/MAINTENANCE-AXES.a2ml || MISSING="$MISSING MAINTENANCE-AXES.a2ml:effects-tooling" - grep -q 'source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc"' .machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml || MISSING="$MISSING MAINTENANCE-CHECKLIST.a2ml:source-human" - grep -q 'source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc"' .machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml || MISSING="$MISSING SOFTWARE-DEVELOPMENT-APPROACH.a2ml:source-human" - fi - if [ -n "$MISSING" ]; then - echo "MISSING:$MISSING" - exit 1 - fi - echo "RSR compliance: PASS" - -# Validate STATE.a2ml syntax -validate-state: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - grep -q '^\[metadata\]' .machine_readable/STATE.a2ml && \ - grep -q 'project\s*=' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml: valid" || echo "STATE.a2ml: INVALID (missing required sections)"; \ - else \ - echo "No .machine_readable/STATE.a2ml found"; \ - fi - -# Validate AI installation guide completeness (finishbot pre-release check) -validate-ai-install: - #!/usr/bin/env bash - echo "=== AI Installation Guide Check ===" - GUIDE="docs/AI_INSTALLATION_GUIDE.adoc" - README="README.adoc" - ERRORS=0 - - # Check guide exists - if [ ! -f "$GUIDE" ]; then - echo "MISSING: $GUIDE (create from template: docs/AI_INSTALLATION_GUIDE.adoc)" - ERRORS=$((ERRORS + 1)) - else - # Check for unfilled TODO markers - TODOS=$(grep -c '\[TODO-AI-INSTALL' "$GUIDE" 2>/dev/null || true) - if [ "$TODOS" -gt 0 ]; then - echo "INCOMPLETE: $GUIDE has $TODOS unfilled [TODO-AI-INSTALL] markers:" - grep -n '\[TODO-AI-INSTALL' "$GUIDE" | head -10 - ERRORS=$((ERRORS + 1)) - else - echo "$GUIDE: complete (no TODO markers)" - fi - - # Check AI implementation section exists - if ! grep -q 'ai-implementation' "$GUIDE" 2>/dev/null; then - echo "MISSING: [[ai-implementation]] anchor in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check privacy notice exists - if ! grep -qi 'privacy' "$GUIDE" 2>/dev/null; then - echo "MISSING: Privacy notice in $GUIDE" - ERRORS=$((ERRORS + 1)) - fi - - # Check install commands exist (not just placeholders) - if ! grep -q 'git clone' "$GUIDE" 2>/dev/null; then - echo "WARNING: No git clone command found in $GUIDE -- install commands may be incomplete" - fi - fi - - # Check README has AI install section - if [ -f "$README" ]; then - if ! grep -qi 'AI-Assisted Installation' "$README" 2>/dev/null; then - echo "MISSING: AI-Assisted Installation section in $README" - echo " Copy from docs/AI-INSTALL-README-SECTION.adoc" - ERRORS=$((ERRORS + 1)) - fi - - # Check README for unfilled TODO markers - README_TODOS=$(grep -c '\[TODO-AI-INSTALL' "$README" 2>/dev/null || true) - if [ "$README_TODOS" -gt 0 ]; then - echo "INCOMPLETE: $README has $README_TODOS unfilled [TODO-AI-INSTALL] markers" - ERRORS=$((ERRORS + 1)) - fi - fi - - if [ "$ERRORS" -gt 0 ]; then - echo "" - echo "AI install guide: FAIL ($ERRORS issues)" - exit 1 - fi - echo "AI install guide: PASS" - -# Full validation suite -validate: validate-rsr validate-state validate-ai-install - @echo "All validations passed!" - -# ═══════════════════════════════════════════════════════════════════════════════ -# STATE MANAGEMENT -# ═══════════════════════════════════════════════════════════════════════════════ - -# Update STATE.a2ml timestamp -state-touch: - @if [ -f ".machine_readable/STATE.a2ml" ]; then \ - sed -i 's/last-updated = "[^"]*"/last-updated = "'"$(date +%Y-%m-%d)"'"/' .machine_readable/STATE.a2ml && \ - echo "STATE.a2ml timestamp updated"; \ - fi - -# Show current phase from STATE.a2ml -state-phase: - @grep -oP 'phase\s*=\s*"\K[^"]+' .machine_readable/STATE.a2ml 2>/dev/null | head -1 || echo "unknown" - -# ═══════════════════════════════════════════════════════════════════════════════ -# GUIX & NIX -# ═══════════════════════════════════════════════════════════════════════════════ - -# Enter Guix development shell (primary) -guix-shell: - guix shell -D -f guix.scm - -# Build with Guix -guix-build: - guix build -f guix.scm - -# Enter Nix development shell (fallback) -nix-shell: - @if [ -f "flake.nix" ]; then nix develop; else echo "No flake.nix"; fi - -# ═══════════════════════════════════════════════════════════════════════════════ -# HYBRID AUTOMATION -# ═══════════════════════════════════════════════════════════════════════════════ - -# Run local automation tasks -automate task="all": - #!/usr/bin/env bash - case "{{task}}" in - all) just fmt && just lint && just test && just docs && just state-touch ;; - cleanup) just clean && find . -name "*.orig" -delete && find . -name "*~" -delete ;; - update) just deps && just validate ;; - *) echo "Unknown: {{task}}. Use: all, cleanup, update" && exit 1 ;; - esac - -# ═══════════════════════════════════════════════════════════════════════════════ -# COMBINATORIC MATRIX RECIPES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Build matrix: [debug|release] x [target] x [features] -build-matrix mode="debug" target="" features="": - @echo "Build matrix: mode={{mode}} target={{target}} features={{features}}" - -# Test matrix: [unit|integration|e2e|all] x [verbosity] x [parallel] -test-matrix suite="unit" verbosity="normal" parallel="true": - @echo "Test matrix: suite={{suite}} verbosity={{verbosity}} parallel={{parallel}}" - -# Container matrix: [build|run|push|shell|scan] x [registry] x [tag] -container-matrix action="build" registry="ghcr.io/{{OWNER}}" tag="latest": - @echo "Container matrix: action={{action}} registry={{registry}} tag={{tag}}" - -# CI matrix: [lint|test|build|security|all] x [quick|full] -ci-matrix stage="all" depth="quick": - @echo "CI matrix: stage={{stage}} depth={{depth}}" - -# Show all matrix combinations -combinations: - @echo "=== Combinatoric Matrix Recipes ===" - @echo "" - @echo "Build Matrix: just build-matrix [debug|release] [target] [features]" - @echo "Test Matrix: just test-matrix [unit|integration|e2e|all] [verbosity] [parallel]" - @echo "Container: just container-matrix [build|run|push|shell|scan] [registry] [tag]" - @echo "CI Matrix: just ci-matrix [lint|test|build|security|all] [quick|full]" - -# ═══════════════════════════════════════════════════════════════════════════════ -# VERSION CONTROL -# ═══════════════════════════════════════════════════════════════════════════════ - -# Show git status -status: - @git status --short - -# Show recent commits -log count="20": - @git log --oneline -{{count}} - -# Generate CHANGELOG.md with git-cliff -changelog: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --output CHANGELOG.md - @echo "Generated CHANGELOG.md" - -# Preview changelog for unreleased commits (does not write) -changelog-preview: - @command -v git-cliff >/dev/null || { echo "git-cliff not found — install: cargo install git-cliff"; exit 1; } - git cliff --config .machine_readable/configs/git-cliff/cliff.toml --unreleased --strip header - -# Tag a new release (usage: just release-tag 1.2.3) -release-tag version: - #!/usr/bin/env bash - TAG="v{{version}}" - if git rev-parse "$TAG" >/dev/null 2>&1; then - echo "Tag $TAG already exists" - exit 1 - fi - just changelog - git add CHANGELOG.md - git commit -m "chore(release): prepare $TAG" - git tag -a "$TAG" -m "Release $TAG" - echo "Created tag $TAG — push with: git push origin main --tags" - -# ═══════════════════════════════════════════════════════════════════════════════ -# UTILITIES -# ═══════════════════════════════════════════════════════════════════════════════ - -# Count lines of code -loc: - @find . \( -name "*.rs" -o -name "*.ex" -o -name "*.exs" -o -name "*.res" -o -name "*.gleam" -o -name "*.zig" -o -name "*.idr" -o -name "*.hs" -o -name "*.ncl" -o -name "*.scm" -o -name "*.adb" -o -name "*.ads" \) -not -path './target/*' -not -path './_build/*' 2>/dev/null | xargs wc -l 2>/dev/null | tail -1 || echo "0" - -# Show TODO comments -todos: - @grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.rs" --include="*.ex" --include="*.res" --include="*.gleam" --include="*.zig" --include="*.idr" --include="*.hs" . 2>/dev/null || echo "No TODOs" - -# Open in editor -edit: - ${EDITOR:-code} . - -# Run high-rigor security assault using panic-attacker -maint-assault: - @./.machine_readable/scripts/maintenance/maint-assault.sh - -# [AUTO-GENERATED] Multi-arch / RISC-V target -build-riscv: - @echo "Building for RISC-V..." - cross build --target riscv64gc-unknown-linux-gnu diff --git a/k9-svc/pandoc/LICENSE b/k9-svc/pandoc/LICENSE deleted file mode 100644 index ec540b34..00000000 --- a/k9-svc/pandoc/LICENSE +++ /dev/null @@ -1,153 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -SPDX-FileCopyrightText: 2024-2025 Palimpsest Stewardship Council - -================================================================================ -PALIMPSEST-MPL LICENSE VERSION 1.0 -================================================================================ - -File-level copyleft with ethical use and quantum-safe provenance - -Based on Mozilla Public License 2.0 - --------------------------------------------------------------------------------- -PREAMBLE --------------------------------------------------------------------------------- - -This License extends the Mozilla Public License 2.0 (MPL-2.0) with provisions -for ethical use, post-quantum cryptographic provenance, and emotional lineage -protection. The base MPL-2.0 terms apply except where explicitly modified by -the Exhibits below. - -Like a palimpsest manuscript where each layer builds upon what came before, -this license recognizes that creative works carry history, context, and meaning -that transcend mere code or text. - --------------------------------------------------------------------------------- -SECTION 1: BASE LICENSE --------------------------------------------------------------------------------- - -This License incorporates the full text of Mozilla Public License 2.0 by -reference. The complete MPL-2.0 text is available at: -https://www.mozilla.org/en-US/MPL/2.0/ - -All terms, conditions, and definitions from MPL-2.0 apply except where -explicitly modified by the Exhibits in this License. - --------------------------------------------------------------------------------- -SECTION 2: ADDITIONAL DEFINITIONS --------------------------------------------------------------------------------- - -2.1. "Emotional Lineage" - means the narrative, cultural, symbolic, and contextual meaning embedded - in Covered Software, including but not limited to: protest traditions, - cultural heritage, trauma narratives, and community stories. - -2.2. "Provenance Metadata" - means cryptographically signed attribution information attached to or - associated with Covered Software, including author identities, timestamps, - modification history, and lineage references. - -2.3. "Non-Interpretive System" - means any automated system that processes Covered Software without - preserving or considering its Emotional Lineage, including but not - limited to: AI training pipelines, content aggregators, and automated - summarization tools. - -2.4. "Quantum-Safe Signature" - means a cryptographic signature using algorithms resistant to attacks - by quantum computers, as specified in Exhibit B. - --------------------------------------------------------------------------------- -SECTION 3: ETHICAL USE REQUIREMENTS --------------------------------------------------------------------------------- - -In addition to the rights and obligations under MPL-2.0: - -3.1. Emotional Lineage Preservation - You must make reasonable efforts to preserve and communicate the - Emotional Lineage of Covered Software when distributing or creating - derivative works. This includes maintaining narrative context, cultural - attributions, and symbolic meaning where documented. - -3.2. Non-Interpretive System Notice - If You use Covered Software as input to a Non-Interpretive System, You - must: - (a) document such use in a publicly accessible manner; and - (b) not claim that outputs of such systems carry the Emotional Lineage - of the original work without explicit permission from Contributors. - -3.3. Ethical Use Declaration - Commercial use of Covered Software requires acknowledgment that You have - read and understood Exhibit A (Ethical Use Guidelines) and agree to act - in good faith accordance with its principles. - -See Exhibit A for complete Ethical Use Guidelines. - --------------------------------------------------------------------------------- -SECTION 4: PROVENANCE REQUIREMENTS --------------------------------------------------------------------------------- - -4.1. Metadata Preservation - You must not strip, alter, or obscure Provenance Metadata from Covered - Software except where technically necessary and with clear documentation - of any changes. - -4.2. Quantum-Safe Provenance (Optional) - Contributors may sign their Contributions using Quantum-Safe Signatures. - If Quantum-Safe Signatures are present, You must preserve them in all - distributions. - -4.3. Lineage Chain - When creating derivative works, You should extend the provenance chain - to include Your own contributions, maintaining cryptographic linkage to - prior Contributors where feasible. - -See Exhibit B for Quantum-Safe Provenance specifications. - --------------------------------------------------------------------------------- -SECTION 5: GOVERNANCE --------------------------------------------------------------------------------- - -5.1. Stewardship Council - This License is maintained by the Palimpsest Stewardship Council, which - may issue clarifications, interpretive guidance, and future versions. - -5.2. Version Selection - You may use Covered Software under this version of the License or any - later version published by the Palimpsest Stewardship Council. - -5.3. Dispute Resolution - Disputes regarding interpretation of Ethical Use Requirements (Section 3) - should first be submitted to the Palimpsest Stewardship Council for - non-binding guidance before pursuing legal remedies. - --------------------------------------------------------------------------------- -SECTION 6: COMPATIBILITY --------------------------------------------------------------------------------- - -6.1. MPL-2.0 Compatibility - Covered Software under this License may be combined with software under - MPL-2.0. The combined work must comply with both licenses. - -6.2. Secondary Licenses - The Secondary License provisions of MPL-2.0 Section 3.3 apply to this - License. - --------------------------------------------------------------------------------- -EXHIBITS --------------------------------------------------------------------------------- - -Exhibit A - Ethical Use Guidelines -Exhibit B - Quantum-Safe Provenance Specification - -See separate files: -- EXHIBIT-A-ETHICAL-USE.txt -- EXHIBIT-B-QUANTUM-SAFE.txt - --------------------------------------------------------------------------------- -END OF PALIMPSEST-MPL LICENSE VERSION 1.0 --------------------------------------------------------------------------------- - -For questions about this License: -- Repository: https://github.com/hyperpolymath/palimpsest-license -- Council: contact via repository Issues diff --git a/k9-svc/pandoc/PANDOC-SUBMISSION.adoc b/k9-svc/pandoc/PANDOC-SUBMISSION.adoc deleted file mode 100644 index cd42ac1b..00000000 --- a/k9-svc/pandoc/PANDOC-SUBMISSION.adoc +++ /dev/null @@ -1,80 +0,0 @@ -== K9 Pandoc Reader, Writer, and Filter - -=== Summary - -Custom Pandoc reader, writer, and Lua filter for K9 Self-Validating -Components — a security-tiered service configuration format built on -Nickel, with three trust levels (Kennel, Yard, Hunt) and structured -pedigree metadata. - -K9 files come in two syntaxes: YAML (`+.k9+`) for Kennel-level configs -and Nickel (`+.k9.ncl+`) for Yard/Hunt-level components with contracts, -recipes, and cryptographic signing. This tooling enables converting K9 -documents to HTML, PDF, DOCX, Markdown, and all other Pandoc-supported -formats. - -=== Components - -* *k9.lua* — Comprehensive Pandoc custom reader (597 lines). -Auto-detects YAML vs Nickel syntax, extracts pedigree metadata, -identifies security trust level, and parses records, contracts, recipes, -and bindings into the Pandoc AST. -* *k9-reader.lua* — Lightweight reader variant (92 lines) for quick -extraction. -* *k9-writer.lua* — Custom Pandoc writer (230 lines). Converts any -Pandoc AST to valid K9 Nickel output with pedigree blocks, security -settings, recipe definitions, and proper multiline string syntax -(`+m%"..."%+`). -* *k9-filter.lua* — Post-processing Lua filter with four passes: -security badge colouring (green/amber/red for trust levels), contract -annotation highlighting, recipe command validation (80+ known tools), -and pedigree completeness checking. -* *k9.html* — HTML5 Pandoc template with security-level-adaptive header -bar, pedigree summary card, contract styling, recipe blocks with labels, -copy-to-clipboard on code blocks, and responsive/print-friendly layout. - -=== Usage - -[source,sh] ----- -# K9 Nickel to HTML (full pipeline) -pandoc -f k9.lua input.k9.ncl \ - --lua-filter=k9-filter.lua \ - --template=k9.html \ - -o output.html - -# K9 YAML to PDF -pandoc -f k9.lua config.k9 -o output.pdf - -# Round-trip: K9 to AST to K9 -pandoc -f k9.lua input.k9.ncl -t k9-writer.lua -o roundtrip.k9.ncl ----- - -=== Requirements - -* Pandoc 3.0+ with Lua support - -=== Spec - -* K9 SVC specification: -https://github.com/hyperpolymath/standards/tree/main/k9-svc -* Media type: `+application/vnd.k9+nickel+` (IANA registration pending) - -=== Related - -* https://github.com/pandoc/lua-filters[pandoc/lua-filters] — Community -Lua filters repository -* link:../lsp/[K9 LSP server] — Language Server Protocol implementation -* link:../editors/vscode/[VS Code extension] — Syntax highlighting for -VS Code -* link:../SPEC.adoc[K9 specification] — Full K9 SVC specification -* link:../pedigree.ncl[Pedigree contract] — Nickel contract defining -component structure - -=== License - -PMPL-1.0-or-later (Palimpsest License) - -=== Author - -Jonathan D.A. Jewell j.d.a.jewell@open.ac.uk diff --git a/k9-svc/pandoc/README.adoc b/k9-svc/pandoc/README.adoc deleted file mode 100644 index 6124fe80..00000000 --- a/k9-svc/pandoc/README.adoc +++ /dev/null @@ -1,141 +0,0 @@ -== k9 - -A collection of Pandoc custom reader, writer, filter, and HTML template -for https://github.com/hyperpolymath/standards/tree/main/k9-svc[K9] -(Self-Validating Components) documents. - -K9 is a configuration format for self-validating software components. -Each K9 file carries a *pedigree* (name, version, security level) and -validates itself against a Nickel contract schema. K9 has three security -levels: - -* *Kennel* – pure data, no execution (YAML-style `+.k9+`) -* *Yard* – Nickel evaluation with contracts (`+.k9.ncl+`) -* *Hunt* – full execution with shell commands, signature required -(`+.k9.ncl+`) - -=== Files - -* `+k9.lua+` – Custom reader with YAML + Nickel support (597 lines) -* `+k9-reader.lua+` – Lightweight standalone reader (92 lines) -* `+k9-writer.lua+` – Custom writer producing K9 Nickel output (256 -lines) -* `+k9-filter.lua+` – Lua filter with 4 post-processing passes (407 -lines) -* `+k9.html+` – HTML5 template with security-level colour scheme (591 -lines) - -=== Usage - -==== Reading K9 - -Convert K9 documents to any Pandoc output format: - -.... -pandoc -f k9.lua hello.k9 -o output.html -pandoc -f k9.lua config.k9.ncl -o output.html -pandoc -f k9.lua deploy.k9.ncl -t markdown -.... - -==== Writing K9 - -Convert any Pandoc-supported format to K9 Nickel: - -.... -pandoc input.md -t k9-writer.lua -o component.k9.ncl -.... - -==== Full pipeline - -Use the reader, filter, and template together: - -.... -pandoc -f k9.lua input.k9.ncl \ - --lua-filter=k9-filter.lua \ - --template=k9.html \ - -o output.html -.... - -=== Auto-detection - -The reader automatically detects: - -* *Syntax*: YAML (`+.k9+`) vs Nickel (`+.k9.ncl+`) from content patterns -* *Security level*: Kennel / Yard / Hunt from `+trust_level+` or content -analysis -* *Magic number*: `+K9!+` presence at file start -* *SPDX license*: extracted from comment headers - -=== K9 syntax - -==== Kennel level (YAML-style) - -.... -K9! -# SPDX-License-Identifier: MIT ---- -metadata: - name: hello-k9 - version: 1.0.0 - description: A friendly greeting - -content: - greeting: "Hello from K9!" -.... - -==== Yard level (Nickel) - -.... -let pedigree = import "pedigree.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "my-component", - version = "1.0.0", - }, - security = { - trust_level = 'Yard, - allow_network = false, - }, -} -.... - -=== Filter capabilities - -The `+k9-filter.lua+` provides these post-processing passes: - -[arabic] -. *Security badge colouring* – Kennel = green, Yard = amber, Hunt = red. -Badges render as inline HTML with colour-coded backgrounds. -. *Contract highlighting* – Nickel type contracts get monospace styling -with type-specific colours (green for String, blue for Number, orange -for Bool, etc.) -. *Recipe validation* – recipe command blocks are scanned against 80+ -known tools; unknown commands produce warnings. -. *Pedigree completeness* – checks that name, version, and description -are present; warns for missing fields. - -Disable capabilities via metadata: - -.... ---- -k9-validate: false -k9-diagrams: false ---- -.... - -=== HTML template - -The `+k9.html+` template provides: - -* Security-level header bar with gradient background -* Pedigree summary card (structured table) -* Contract annotations in monospace -* Recipe blocks with "`Recipe`" label badge -* Copy-to-clipboard on all code blocks -* Responsive layout with mobile grid -* Print-friendly stylesheet - -=== Requirements - -* Pandoc 3.0+ with Lua support diff --git a/k9-svc/pandoc/ROADMAP.adoc b/k9-svc/pandoc/ROADMAP.adoc deleted file mode 100644 index 5cdea28d..00000000 --- a/k9-svc/pandoc/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Pandoc Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/k9-svc/pandoc/SECURITY.adoc b/k9-svc/pandoc/SECURITY.adoc deleted file mode 100644 index e47fdd92..00000000 --- a/k9-svc/pandoc/SECURITY.adoc +++ /dev/null @@ -1,16 +0,0 @@ -== Security Policy - -=== Reporting a Vulnerability - -If you discover a security vulnerability, please report it responsibly. - -*Email:* j.d.a.jewell@open.ac.uk - -*Please include:* - Description of the vulnerability - Steps to -reproduce - Potential impact - -*Response timeline:* - Acknowledgement within 48 hours - Initial -assessment within 7 days - Fix or mitigation within 90 days - -*Safe harbour:* We will not pursue legal action against security -researchers who follow responsible disclosure. diff --git a/k9-svc/pandoc/container/.gatekeeper.yaml b/k9-svc/pandoc/container/.gatekeeper.yaml deleted file mode 120000 index 87731df3..00000000 --- a/k9-svc/pandoc/container/.gatekeeper.yaml +++ /dev/null @@ -1 +0,0 @@ -../../../../_shared/container/.gatekeeper.yaml \ No newline at end of file diff --git a/k9-svc/pandoc/container/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/container/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index ccb5bc51..00000000 --- a/k9-svc/pandoc/container/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,143 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "container-templates" -version: "1.0.0" -context: - - "https://a2ml.org/ns/v2" - - "https://stapeln.dev/ns/v1" - ---- -### [AI_MANIFEST] -description: | - Container templates for the stapeln container ecosystem. This directory - provides Podman-Chainguard-stapeln templates that are customised via - `just container-init` or `just init` during project bootstrap. - - All files use {{PLACEHOLDER}} tokens that are substituted with project- - specific values during initialisation. - -purpose: | - Provide a complete, security-first container deployment story for any - RSR-compliant repository. The templates cover the full lifecycle: - build, sign, verify, deploy, monitor, and govern. - -canonical_locations: - compose: "container/compose.toml" - containerfile: "container/Containerfile" - manifest: "container/manifest.toml" - gatekeeper: "container/.gatekeeper.yaml" - build_pipeline: "container/ct-build.sh" - entrypoint: "container/entrypoint.sh" - monitoring: "container/vordr.toml" - deployment: "container/deploy.k9.ncl" - example: "container/compose.example.toml" - ---- -### [FILE_RELATIONSHIPS] -files: - - name: "compose.toml" - role: "Orchestration" - description: | - selur-compose stack definition. Declares services, volumes, networks, - and health checks. References the Containerfile for image builds and - .gatekeeper.yaml for svalinn policy. - depends_on: ["Containerfile", ".gatekeeper.yaml"] - - - name: "Containerfile" - role: "Image Build" - description: | - Multi-stage OCI container build. Stage 1 compiles the application on - wolfi-base; Stage 2 copies the binary into a minimal runtime image. - Copies entrypoint.sh, .gatekeeper.yaml, and manifest.toml into the - final image. - depends_on: ["entrypoint.sh", ".gatekeeper.yaml", "manifest.toml"] - - - name: "manifest.toml" - role: "Bundle Metadata" - description: | - Cerro-torre .ctp bundle manifest. Describes provenance, dependencies, - attestations, and runtime security profile. Used by `ct pack` and - `ct verify`. - depends_on: [] - - - name: ".gatekeeper.yaml" - role: "Gateway Policy" - description: | - Svalinn edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging. - depends_on: [] - - - name: "ct-build.sh" - role: "Build Pipeline" - description: | - Shell script implementing the 5-stage pipeline: build (Podman), - pack (cerro-torre .ctp), sign (Ed25519), verify, push (optional). - Degrades gracefully when cerro-torre tools are not installed. - depends_on: ["Containerfile", "manifest.toml"] - - - name: "entrypoint.sh" - role: "Container Entrypoint" - description: | - Startup script with signal handling (SIGTERM, SIGINT), logging, and - exec into the main application process. - depends_on: [] - - - name: "vordr.toml" - role: "Runtime Monitoring" - description: | - Vordr monitoring configuration. Health endpoint probing, crash - detection, resource thresholds, and structured log output. - depends_on: [] - - - name: "deploy.k9.ncl" - role: "Deployment Component" - description: | - k9-svc deployment specification at Hunt trust level. Full pedigree - (L1-L5), environment configs, container config, and rolling - deployment strategy. - depends_on: ["compose.toml", "ct-build.sh"] - - - name: "compose.example.toml" - role: "Example" - description: | - Fully-commented multi-service example (Rust API + Elixir worker + - svalinn gateway). Copy to compose.toml and customise. - depends_on: [] - ---- -### [STAPELN_ECOSYSTEM] -overview: | - The stapeln container ecosystem comprises six tools: - - selur — Container orchestration with zero-copy IPC. Reads compose.toml. - cerro-torre — Verified container packaging (.ctp bundles), Ed25519 signing. - svalinn — Policy-driven edge gateway (auth, rate limits, CORS, trust). - vordr — Runtime monitoring (health, crashes, resources, logs). - rokur — Secrets management (runtime injection, no baked secrets). - k9-svc — Nickel deployment components (Kennel/Yard/Hunt trust levels). - -invariants: - - "Base images MUST be cgr.dev/chainguard/wolfi-base or cgr.dev/chainguard/static" - - "Container runtime is Podman — never Docker" - - "Containerfile — never Dockerfile" - - "All images run as non-root (appuser or project-specific user)" - - ".ctp bundles are signed with Ed25519 via cerro-torre" - - "Health endpoints (/health, /ready) must always be public (no auth)" - ---- -### [USAGE] -initialisation: | - Run `just container-init` to substitute all {{PLACEHOLDER}} tokens with - project-specific values. This is also run as part of `just init`. - -development: | - 1. `just container-build` — Build the container image - 2. `just container-verify` — Verify compose configuration - 3. `just container-up` — Start the stack locally - 4. `just container-down` — Stop the stack - -production: | - 1. `just container-sign` — Build, sign, verify .ctp bundle - 2. `just container-push` — Push signed bundle to registry - 3. `selur-compose up` — Deploy on target host diff --git a/k9-svc/pandoc/container/Containerfile b/k9-svc/pandoc/container/Containerfile deleted file mode 100644 index ba85260a..00000000 --- a/k9-svc/pandoc/container/Containerfile +++ /dev/null @@ -1,136 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} Container Image -# -# Multi-stage build template for Chainguard Wolfi base images. -# Customise the builder stage for your language and copy the -# resulting binary/release into the minimal runtime stage. -# -# Build with Podman: -# podman build -t {{SERVICE_NAME}}:latest -f container/Containerfile . -# -# Run: -# podman run -p {{PORT}}:{{PORT}} {{SERVICE_NAME}}:latest -# -# Run with persistent volume: -# podman run -p {{PORT}}:{{PORT}} -v {{SERVICE_NAME}}-data:/data {{SERVICE_NAME}}:latest - -# ============================================================================ -# Stage 1: Builder -# ============================================================================ -# -# Install build tools and compile the application. -# This stage is discarded after the build — only the compiled output -# is copied into the runtime stage. -# -# Language-specific examples (uncomment the one you need): -# -# --- Rust --- -# RUN apk add --no-cache rust pkgconf build-base -# COPY Cargo.toml Cargo.lock ./ -# COPY src/ ./src/ -# RUN cargo build --release -# # Output: /build/target/release/{{SERVICE_NAME}} -# -# --- Elixir --- -# RUN apk add --no-cache erl27-elixir-1.18 erlang-27 erlang-27-dev git build-base -# COPY mix.exs mix.lock ./ -# COPY lib/ ./lib/ -# COPY config/ ./config/ -# ENV MIX_ENV=prod -# RUN mix local.hex --force && mix local.rebar --force && \ -# mix deps.get --only prod && mix compile && mix release -# # Output: /build/_build/prod/rel/{{SERVICE_NAME}}/ -# -# --- Zig --- -# RUN apk add --no-cache zig build-base -# COPY build.zig build.zig.zon ./ -# COPY src/ ./src/ -# RUN zig build -Doptimize=ReleaseFast -# # Output: /build/zig-out/bin/{{SERVICE_NAME}} -# -FROM cgr.dev/chainguard/wolfi-base:latest AS builder - -# TODO: Install your language toolchain -RUN apk add --no-cache build-base - -WORKDIR /build - -# TODO: Copy source files and build -COPY . . -# RUN - -# ============================================================================ -# Stage 2: Runtime -# ============================================================================ -# -# Minimal production image. Only the compiled binary/release and runtime -# dependencies are included. No compilers, no source code, no build tools. -# -FROM cgr.dev/chainguard/wolfi-base:latest - -# OCI image labels (compatible with cerro-torre .ctp bundle metadata) -LABEL org.opencontainers.image.title="{{PROJECT_NAME}}" \ - org.opencontainers.image.description="{{PROJECT_DESCRIPTION}}" \ - org.opencontainers.image.url="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.source="https://{{FORGE}}/{{OWNER}}/{{REPO}}" \ - org.opencontainers.image.vendor="{{OWNER}}" \ - org.opencontainers.image.licenses="{{LICENSE}}" \ - org.opencontainers.image.authors="{{AUTHOR}} <{{AUTHOR_EMAIL}}>" \ - dev.cerrotorre.manifest="container/manifest.toml" \ - dev.cerrotorre.gatekeeper="container/.gatekeeper.yaml" \ - dev.stapeln.compose="container/compose.toml" - -# Install minimal runtime dependencies. -# Adjust this list for your application: -# - ca-certificates: TLS root certificates -# - curl: health check probe -# - libstdc++: C++ standard library (if needed by native deps) -# - ncurses: terminal UI (if needed, e.g. Elixir IEx) -RUN apk add --no-cache ca-certificates curl - -# Create non-root user for the application. -# Running as root inside containers is a security anti-pattern. -RUN addgroup -S appuser && adduser -S appuser -G appuser - -WORKDIR /app - -# TODO: Copy compiled binary/release from builder stage. -# Examples: -# COPY --from=builder /build/target/release/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} -# COPY --from=builder /build/_build/prod/rel/{{SERVICE_NAME}} /app/release/ -# COPY --from=builder /build/zig-out/bin/{{SERVICE_NAME}} /app/{{SERVICE_NAME}} - -# Copy entrypoint script -COPY container/entrypoint.sh /app/entrypoint.sh -RUN chmod +x /app/entrypoint.sh - -# Copy stapeln integration files (svalinn gatekeeper policy, cerro-torre manifest) -COPY container/.gatekeeper.yaml /etc/svalinn/gatekeeper.yaml -COPY container/manifest.toml /app/manifest.toml - -# Create data directory for persistent storage (mountable volume) -RUN mkdir -p /data && chown appuser:appuser /data - -# Set ownership of the application directory -RUN chown -R appuser:appuser /app - -# Environment variables — customise for your application -ENV APP_HOST=[::] -ENV APP_PORT={{PORT}} -ENV APP_LOG_FORMAT=json -ENV APP_DATA_DIR=/data - -# Declare /data as a volume for persistent storage -VOLUME ["/data"] - -# Run as non-root -USER appuser - -# Expose the application port -EXPOSE {{PORT}} - -# Health check — the application must respond 2xx at /health -HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \ - CMD curl -sf http://localhost:${APP_PORT}/health || exit 1 - -ENTRYPOINT ["/app/entrypoint.sh"] diff --git a/k9-svc/pandoc/container/README.adoc b/k9-svc/pandoc/container/README.adoc deleted file mode 100644 index 9f7f7f05..00000000 --- a/k9-svc/pandoc/container/README.adoc +++ /dev/null @@ -1,179 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -= {{PROJECT_NAME}} Container Templates -:toc: left -:toclevels: 3 -:sectnums: - -== Overview - -This directory contains container templates for the -https://github.com/hyperpolymath/stapeln[stapeln] container ecosystem. -The stapeln stack provides verified container packaging, edge gateway -policies, runtime monitoring, and supply-chain signing for Podman-based -deployments using https://www.chainguard.dev/[Chainguard] Wolfi base images. - -All files use `{{PLACEHOLDER}}` tokens that are replaced by `just container-init` -(or by the top-level `just init` during project bootstrap). - -== File Reference - -[cols="1,3"] -|=== -| File | Purpose - -| `compose.toml` -| **selur-compose** stack definition. Declares services, volumes, networks, - and health checks. The primary orchestration file for local and production - deployment. Use `selur-compose up` or fall back to `podman compose`. - -| `compose.example.toml` -| Concrete multi-service example with detailed comments. Copy and customise - for your own stack. Not used directly by any tooling. - -| `Containerfile` -| Multi-stage OCI container build specification. Stage 1 builds the - application; Stage 2 produces a minimal runtime image on - `cgr.dev/chainguard/wolfi-base`. Uses Podman (never Docker). - -| `manifest.toml` -| **cerro-torre** bundle metadata. Describes the `.ctp` verified container - package: provenance, dependencies, attestations, and runtime security - profile. Used by `ct pack` and `ct verify`. - -| `.gatekeeper.yaml` -| **svalinn** edge gateway policy. Controls authentication, rate limiting, - container trust, request validation, CORS, and audit logging at the - network boundary. - -| `ct-build.sh` -| Build, sign, and verify pipeline script. Five stages: build (Podman), - pack (cerro-torre `.ctp`), sign (Ed25519), verify, and push (optional). - Gracefully degrades when cerro-torre tools are not installed. - -| `entrypoint.sh` -| Container entrypoint with signal handling (SIGTERM, SIGINT), startup - logging, and `exec` into the main application process. - -| `vordr.toml` -| **vordr** runtime monitoring configuration. Defines health endpoints, - crash detection, resource thresholds, and log output. - -| `deploy.k9.ncl` -| **k9-svc** deployment component at Hunt trust level. Full pedigree - (L1--L5), environment configs (dev/staging/prod), container - configuration, and rolling deployment strategy. - -| `0-AI-MANIFEST.a2ml` -| AI-readable manifest describing the container directory, file - interconnections, and the stapeln ecosystem. -|=== - -== The stapeln Ecosystem - -The stapeln container ecosystem comprises six interconnected tools: - -**selur** (compose):: - Container orchestration with zero-copy IPC for co-located services. - Reads `compose.toml` files. Falls back to standard Podman Compose - when the selur driver is unavailable. - -**cerro-torre** (bundles and signing):: - Verified container packaging. Produces `.ctp` bundles from OCI images, - signs them with Ed25519, and verifies the full chain. Tools: `ct pack`, - `ct sign`, `ct verify`, `ct push`, `ct explain`. - -**svalinn** (edge gateway):: - Policy-driven reverse proxy. Enforces authentication, rate limiting, - CORS, and container trust policies defined in `.gatekeeper.yaml`. - -**vordr** (monitoring):: - Runtime container monitoring. Watches health endpoints, detects crashes, - tracks resource usage, and emits structured logs. - -**rokur** (secrets):: - Secrets management for container deployments. Injects secrets at runtime - without baking them into images. Currently a stub/placeholder. - -**k9-svc** (deployment components):: - Nickel-based deployment specification. Components declare their pedigree - (identity, target, security, validation, recipes) and execute at one of - three trust levels: Kennel (data only), Yard (evaluation), Hunt (full - execution with cryptographic handshake). - -== How to Initialise - -[source,bash] ----- -# Option 1: During project bootstrap (includes all placeholders) -just init - -# Option 2: Container-specific initialisation -just container-init ----- - -The `container-init` recipe prompts for container-specific values -(service name, port, registry) and substitutes all `{{PLACEHOLDER}}` -tokens in the `container/` directory. - -== Development Workflow - -[source,bash] ----- -# 1. Build the container image -just container-build - -# 2. Verify the compose configuration -just container-verify - -# 3. Start the stack locally -just container-up --detach - -# 4. Check logs -podman compose --file container/compose.toml logs -f - -# 5. Stop the stack -just container-down ----- - -== Production Deployment - -[source,bash] ----- -# 1. Build, sign, and verify the .ctp bundle -just container-sign - -# 2. Push the signed bundle to the registry -just container-push - -# 3. Deploy on the target host -selur-compose up --detach ----- - -For k9-svc managed deployments: - -[source,bash] ----- -# Validate the deployment component -nickel typecheck container/deploy.k9.ncl - -# Deploy (requires Hunt-level authorisation) -k9-svc deploy container/deploy.k9.ncl --env production ----- - -== Base Images - -All Containerfiles use Chainguard Wolfi base images: - -* **Builder stage:** `cgr.dev/chainguard/wolfi-base:latest` -* **Runtime stage:** `cgr.dev/chainguard/wolfi-base:latest` (or - `cgr.dev/chainguard/static:latest` for statically-linked binaries) - -Chainguard images are minimal, CVE-free, and rebuilt daily. They use the -`apk` package manager (Alpine-compatible). - -== Container Runtime - -This project uses **Podman** (never Docker). All scripts, compose files, -and documentation reference Podman commands. The OCI Containerfile format -is compatible with Podman, Docker, and nerdctl. diff --git a/k9-svc/pandoc/container/compose.example.toml b/k9-svc/pandoc/container/compose.example.toml deleted file mode 100644 index d8d717c4..00000000 --- a/k9-svc/pandoc/container/compose.example.toml +++ /dev/null @@ -1,135 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Example selur-compose configuration — multi-service stack -# -# This is a concrete, fully-commented example showing a Rust API + Elixir -# worker + svalinn gateway deployment. Copy this file to compose.toml and -# customise for your project. -# -# Usage: -# cp compose.example.toml compose.toml -# # Edit service names, ports, images -# selur-compose up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Rust API service — the primary HTTP/gRPC backend. -# Handles incoming requests, data storage, and core business logic. -[services.rust-api] -image = "ghcr.io/hyperpolymath/myproject-api:latest.ctp" - -# Map host port 8080 to container port 8080. -# Use ["[::]:8080:8080"] for explicit IPv6 binding. -ports = ["8080:8080"] - -# Environment variables passed into the container at startup. -# These override defaults in the Containerfile ENV directives. -environment = { - RUST_LOG = "info", # Rust log level (trace, debug, info, warn, error) - APP_HOST = "[::]", # Listen on all interfaces (IPv4 + IPv6) - APP_PORT = "8080", # Internal container port - APP_LOG_FORMAT = "json", # Structured logging for selur/vordr - APP_DATA_DIR = "/data", # Persistent data directory (matches VOLUME) -} - -# Bind-mount a named volume for persistent data. -# Format: "volume-name:/container/path" -volumes = ["api-data:/data"] - -# Restart policy: "always" ensures the service comes back after crashes. -# Other options: "no", "on-failure", "unless-stopped" -restart = "always" - -# Health check: selur/Podman uses this to determine if the service is ready. -# The service must respond 2xx to this endpoint within the timeout. -healthcheck = { test = "curl -sf http://localhost:8080/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Elixir worker service — background processing, event handling, coordination. -# Runs as an OTP release with supervision trees for fault tolerance. -[services.elixir-worker] -image = "ghcr.io/hyperpolymath/myproject-worker:latest.ctp" - -# Separate port for the worker's admin/metrics endpoint. -ports = ["4000:4000"] - -# The worker connects to the Rust API over the internal selur network. -# Service names resolve as hostnames within the compose network. -environment = { - API_URL = "http://rust-api:8080/api/v1", # Internal service discovery - MIX_ENV = "prod", # Elixir release mode - APP_LOG_FORMAT = "json", # Match structured logging format - POOL_SIZE = "10", # DB connection pool size -} - -# depends_on ensures the Rust API starts before the worker. -# Note: This only waits for the container to start, not for the health check. -# Use healthcheck + startup probes for true readiness gating. -depends_on = ["rust-api"] - -restart = "always" -healthcheck = { test = "curl -sf http://localhost:4000/health", interval = "30s", timeout = "5s", retries = 3 } - -# --- - -# Svalinn edge gateway — reverse proxy with policy enforcement. -# All external traffic enters through svalinn, which: -# 1. Terminates TLS (auto-provisioned certificates) -# 2. Validates JWT/OAuth2 authentication -# 3. Enforces rate limits from .gatekeeper.yaml -# 4. Routes requests to the appropriate backend service -# 5. Logs all write operations for audit -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" - -# External-facing ports: HTTPS (443) and HTTP->HTTPS redirect (80). -ports = ["443:443", "80:80"] - -environment = { - # Backend routing: svalinn proxies to internal services. - SVALINN_BACKEND = "http://rust-api:8080", - SVALINN_WORKER_BACKEND = "http://elixir-worker:4000", - - # Policy file: mounted from the svalinn-config volume. - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - - # Auto-provision TLS certificates (Let's Encrypt). - SVALINN_TLS_AUTO = "true", -} - -# Mount .gatekeeper.yaml as read-only policy configuration. -volumes = ["svalinn-config:/etc/svalinn:ro"] - -# Svalinn starts last — it needs both backends to be running. -depends_on = ["rust-api", "elixir-worker"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -# Persistent storage for the Rust API (database files, indexes, WAL). -[volumes.api-data] -driver = "local" - -# Read-only policy configuration for svalinn gateway. -# Populate with: cp .gatekeeper.yaml /path/to/svalinn-config/gatekeeper.yaml -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# selur network: zero-copy IPC between services on the same host. -# When the selur driver is not installed, falls back to standard bridge -# networking (TCP over localhost). Performance is slightly lower but -# functionality is identical. -[networks.default] -driver = "selur" diff --git a/k9-svc/pandoc/container/compose.toml b/k9-svc/pandoc/container/compose.toml deleted file mode 100644 index a14f8a00..00000000 --- a/k9-svc/pandoc/container/compose.toml +++ /dev/null @@ -1,70 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} selur-compose configuration -# -# Orchestrates the container stack as verified container bundles (.ctp). -# Uses selur zero-copy IPC between services on the same host. -# -# Usage: -# selur-compose up # Start all services -# selur-compose up --detach # Start in background -# selur-compose verify # Verify all .ctp signatures -# selur-compose ps # Check status -# selur-compose logs -f {{SERVICE_NAME}} # Stream logs -# selur-compose down # Stop all services -# -# Fallback (when selur is not installed): -# podman compose --file compose.toml up --detach - -version = "1.0" - -# ============================================================================ -# Services -# ============================================================================ - -# Primary application service -[services.{{SERVICE_NAME}}] -image = "{{REGISTRY}}/{{SERVICE_NAME}}:latest.ctp" -ports = ["{{PORT}}:{{PORT}}"] -environment = { - APP_HOST = "[::]", - APP_PORT = "{{PORT}}", - APP_LOG_FORMAT = "json", - APP_DATA_DIR = "/data", -} -volumes = ["{{SERVICE_NAME}}-data:/data"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:{{PORT}}/health", interval = "30s", timeout = "5s", retries = 3 } - -# Svalinn edge gateway: validates requests, enforces policies, TLS termination -[services.svalinn] -image = "ghcr.io/hyperpolymath/svalinn:latest.ctp" -ports = ["443:443", "80:80"] -environment = { - SVALINN_BACKEND = "http://{{SERVICE_NAME}}:{{PORT}}", - SVALINN_POLICY_FILE = "/etc/svalinn/gatekeeper.yaml", - SVALINN_TLS_AUTO = "true", -} -volumes = ["svalinn-config:/etc/svalinn:ro"] -depends_on = ["{{SERVICE_NAME}}"] -restart = "always" -healthcheck = { test = "curl -sf http://localhost:80/health", interval = "30s", timeout = "5s", retries = 3 } - -# ============================================================================ -# Volumes -# ============================================================================ - -[volumes.{{SERVICE_NAME}}-data] -driver = "local" - -[volumes.svalinn-config] -driver = "local" - -# ============================================================================ -# Networks -# ============================================================================ - -# Use selur zero-copy IPC for inter-service communication on the same host. -# Falls back to standard bridge networking when selur driver is unavailable. -[networks.default] -driver = "selur" diff --git a/k9-svc/pandoc/container/ct-build.sh b/k9-svc/pandoc/container/ct-build.sh deleted file mode 100755 index a54a5418..00000000 --- a/k9-svc/pandoc/container/ct-build.sh +++ /dev/null @@ -1,162 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# {{PROJECT_NAME}} — Cerro Torre build, sign, and verify pipeline -# -# Builds the container image, packages it as a verified .ctp bundle, -# signs it with Ed25519, and verifies the result. Gracefully degrades -# when cerro-torre tools are not installed. -# -# Prerequisites: -# - podman (container build — required) -# - ct (cerro-torre CLI: pack, sign, verify — optional) -# - cerro-sign (Ed25519 signing — optional, ct sign used as fallback) -# -# Usage: -# ./ct-build.sh # Build + sign (local only) -# ./ct-build.sh --push # Build + sign + push to registry -# CT_KEY_ID=my-key ./ct-build.sh # Use specific signing key -# -# Environment variables: -# CT_KEY_ID — Signing key identifier (default: {{SERVICE_NAME}}-release) -# CT_REGISTRY — OCI registry to push to (default: {{REGISTRY}}) -# CT_TAG — Image tag (default: latest) - -set -euo pipefail - -# --------------------------------------------------------------------------- -# Configuration -# --------------------------------------------------------------------------- - -SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" -REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)" - -PUSH="" -for arg in "$@"; do - if [ "$arg" = "--push" ]; then - PUSH="--push" - fi -done - -CT_KEY_ID="${CT_KEY_ID:-{{SERVICE_NAME}}-release}" -CT_REGISTRY="${CT_REGISTRY:-{{REGISTRY}}}" -CT_TAG="${CT_TAG:-latest}" - -IMAGE_NAME="{{SERVICE_NAME}}" -FULL_IMAGE="${CT_REGISTRY}/${IMAGE_NAME}:${CT_TAG}" -CTP_FILE="${SCRIPT_DIR}/${IMAGE_NAME}-${CT_TAG}.ctp" - -echo "=== {{PROJECT_NAME}} Cerro Torre Build Pipeline ===" -echo " Image: ${FULL_IMAGE}" -echo " Key: ${CT_KEY_ID}" -echo " Bundle: ${CTP_FILE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 1: Build container image with Podman -# --------------------------------------------------------------------------- - -echo "--- Step 1: Building container image ---" - -podman build \ - -t "${FULL_IMAGE}" \ - -f "${SCRIPT_DIR}/Containerfile" \ - "${REPO_ROOT}" - -echo " Built: ${FULL_IMAGE}" -echo "" - -# --------------------------------------------------------------------------- -# Step 2: Pack into .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 2: Packing into .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct pack "${FULL_IMAGE}" -o "${CTP_FILE}" - echo " Packed: ${CTP_FILE}" -else - echo " SKIP: ct not found (install cerro-torre CLI from stapeln/container-stack/cerro-torre)" - echo " The container image is built and tagged but not packed as a .ctp bundle." - echo " To pack manually: ct pack ${FULL_IMAGE} -o ${CTP_FILE}" - echo "" - if [ "$PUSH" = "--push" ]; then - echo "--- Pushing unsigned OCI image (no .ctp) ---" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" - echo "=== Build complete (without .ctp signing) ===" - exit 0 -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 3: Sign the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 3: Signing .ctp bundle ---" - -if command -v cerro-sign &>/dev/null; then - cerro-sign sign "${CTP_FILE}" --key-id "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -elif command -v ct &>/dev/null; then - ct sign "${CTP_FILE}" --key "${CT_KEY_ID}" - echo " Signed: ${CTP_FILE} (key: ${CT_KEY_ID})" -else - echo " SKIP: cerro-sign not found (install from stapeln/container-stack/cerro-torre)" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 4: Verify the .ctp bundle -# --------------------------------------------------------------------------- - -echo "--- Step 4: Verifying .ctp bundle ---" - -if command -v ct &>/dev/null; then - ct verify "${CTP_FILE}" - echo " Verified: ${CTP_FILE}" -else - echo " SKIP: ct not found" -fi - -echo "" - -# --------------------------------------------------------------------------- -# Step 5: Push to registry (optional) -# --------------------------------------------------------------------------- - -if [ "$PUSH" = "--push" ]; then - echo "--- Step 5: Pushing to registry ---" - - if command -v ct &>/dev/null; then - ct push "${CTP_FILE}" "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE}" - else - # Fall back to podman push (unsigned OCI image) - echo " ct not available, falling back to podman push (unsigned)" - podman push "${FULL_IMAGE}" - echo " Pushed: ${FULL_IMAGE} (unsigned OCI — not a .ctp bundle)" - fi - echo "" -fi - -# --------------------------------------------------------------------------- -# Summary -# --------------------------------------------------------------------------- - -echo "=== Build pipeline complete ===" -echo " Image: ${FULL_IMAGE}" -echo " Bundle: ${CTP_FILE}" -echo "" -echo " To deploy with selur-compose:" -echo " cd container && selur-compose up" -echo "" -echo " To verify at any time:" -echo " ct verify ${CTP_FILE}" -echo "" -echo " To explain the verification chain:" -echo " ct explain ${CTP_FILE}" diff --git a/k9-svc/pandoc/container/deploy.k9.ncl b/k9-svc/pandoc/container/deploy.k9.ncl deleted file mode 100644 index 0ad0d04a..00000000 --- a/k9-svc/pandoc/container/deploy.k9.ncl +++ /dev/null @@ -1,166 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# deploy.k9.ncl — {{PROJECT_NAME}} deployment component (Hunt level) -# -# k9-svc deployment specification with full pedigree (L1-L5). -# Security Level: 'Hunt (requires cryptographic handshake for execution). -# -# WARNING: This component can execute shell commands! -# It requires explicit authorisation via the Leash system. -# -# Usage: -# nickel typecheck container/deploy.k9.ncl -# k9-svc validate container/deploy.k9.ncl -# k9-svc deploy container/deploy.k9.ncl --env production - -# The component's pedigree (self-description across five layers) -let component_pedigree = { - # ───────────────────────────────────────────────────────────── - # L1: The Snout — Identity - # ───────────────────────────────────────────────────────────── - metadata = { - name = "{{SERVICE_NAME}}-deploy", - version = "{{VERSION}}", - breed = "application/vnd.k9+nickel", - magic_number = "K9!", - description = "{{PROJECT_NAME}} deployment component (Hunt level)", - }, - - # ───────────────────────────────────────────────────────────── - # L2: The Scent — Target Environment - # ───────────────────────────────────────────────────────────── - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - min_memory_mb = 256, - }, - - # ───────────────────────────────────────────────────────────── - # L3: The Leash — Security - # ───────────────────────────────────────────────────────────── - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - # In production, replace with a real Ed25519 signature. - signature = "PLACEHOLDER-SIGNATURE-REQUIRED-FOR-HUNT", - }, - - # ───────────────────────────────────────────────────────────── - # L4: The Gut — Self-Validation - # ───────────────────────────────────────────────────────────── - validation = { - checksum = "sha256:placeholder", - pedigree_version = "1.0.0", - hunt_authorized = false, # Must be set true after handshake - }, - - # ───────────────────────────────────────────────────────────── - # L5: The Muscle — Deployment Recipes - # ───────────────────────────────────────────────────────────── - recipes = { - install = "just container-build", - validate = "just container-verify", - deploy = "just container-up", - migrate = "just container-build && just container-up", - }, -} in - -# Deployment configuration -let deployment = { - # Target environments (dev / staging / production) - environments = { - dev = { - replicas = 1, - memory = "256Mi", - cpu = "100m", - image_tag = "dev", - }, - staging = { - replicas = 2, - memory = "512Mi", - cpu = "250m", - image_tag = "staging", - }, - production = { - replicas = 3, - memory = "1Gi", - cpu = "500m", - image_tag = "latest", - }, - }, - - # Container configuration - container = { - image = "{{REGISTRY}}/{{SERVICE_NAME}}", - port = {{PORT}}, - health_check = "/health", - readiness_check = "/ready", - }, - - # Deployment strategy - strategy = { - type = "rolling", - max_surge = 1, - max_unavailable = 0, - }, -} in - -# Deployment scripts (executed at Hunt level) -let scripts = { - # Pre-deployment validation - pre_deploy = m%" -#!/bin/sh -set -eu -echo "K9: Pre-deployment validation for {{SERVICE_NAME}}..." -cd container && selur-compose verify || podman compose --file compose.toml config -echo "K9: Validation passed." -"%, - - # Deployment script - deploy = m%" -#!/bin/sh -set -eu -ENV="${1:-dev}" -echo "K9: Deploying {{SERVICE_NAME}} to $ENV environment..." -cd container -./ct-build.sh -selur-compose up --detach || podman compose --file compose.toml up --detach -echo "K9: Deployment to $ENV complete." -"%, - - # Rollback script - rollback = m%" -#!/bin/sh -set -eu -echo "K9: Rolling back {{SERVICE_NAME}} deployment..." -cd container -selur-compose down || podman compose --file compose.toml down -echo "K9: Rollback complete." -"%, -} in - -# Export the component -{ - pedigree = component_pedigree, - deployment = deployment, - scripts = scripts, - - # Security check: this component requires Hunt level - required_level = 'Hunt, - - # Warning for users - warning = m%" -WARNING: This is a Hunt-level component. - -It can execute shell commands and modify your system. -Before running, ensure you have: - -1. Reviewed the deployment scripts above -2. Verified the signature (when implemented) -3. Explicitly authorised Hunt-level execution - -Run with: k9-svc authorize container/deploy.k9.ncl && k9-svc deploy container/deploy.k9.ncl -"%, -} diff --git a/k9-svc/pandoc/container/entrypoint.sh b/k9-svc/pandoc/container/entrypoint.sh deleted file mode 100755 index a7a03699..00000000 --- a/k9-svc/pandoc/container/entrypoint.sh +++ /dev/null @@ -1,63 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# {{PROJECT_NAME}} container entrypoint -# -# Handles signal propagation, startup logging, and health check -# preparation before exec-ing into the main application process. - -set -e - -# --------------------------------------------------------------------------- -# Signal handling -# --------------------------------------------------------------------------- -# -# Trap SIGTERM and SIGINT so that the application can shut down gracefully -# when Podman sends stop signals (e.g. `podman stop`, `selur-compose down`). - -cleanup() { - echo "Received shutdown signal — stopping {{SERVICE_NAME}}..." - # If the main process is backgrounded, kill it here: - # kill "$MAIN_PID" 2>/dev/null || true - # wait "$MAIN_PID" 2>/dev/null || true - exit 0 -} -trap cleanup TERM INT - -# --------------------------------------------------------------------------- -# Startup logging -# --------------------------------------------------------------------------- - -echo "Starting {{SERVICE_NAME}}..." -echo " Host: ${APP_HOST:-[::]}" -echo " Port: ${APP_PORT:-{{PORT}}}" -echo " Data: ${APP_DATA_DIR:-/data}" -echo " Log: ${APP_LOG_FORMAT:-json}" - -# --------------------------------------------------------------------------- -# Health check preparation -# --------------------------------------------------------------------------- -# -# Ensure the data directory exists and is writable. -# The VOLUME directive in the Containerfile creates /data, but a bind-mount -# might replace it with an empty directory owned by root. - -if [ -d "${APP_DATA_DIR:-/data}" ]; then - if [ ! -w "${APP_DATA_DIR:-/data}" ]; then - echo "WARNING: ${APP_DATA_DIR:-/data} is not writable by $(whoami)" - fi -fi - -# --------------------------------------------------------------------------- -# Exec into main process -# --------------------------------------------------------------------------- -# -# Replace the entrypoint shell with the application process so that -# signals are delivered directly and PID 1 is the application. -# -# TODO: Replace the command below with your application binary. -# Examples: -# exec /app/{{SERVICE_NAME}} -# exec /app/release/bin/{{SERVICE_NAME}} start -# exec /app/{{SERVICE_NAME}} serve --host "${APP_HOST}" --port "${APP_PORT}" - -exec "$@" diff --git a/k9-svc/pandoc/container/manifest.toml b/k9-svc/pandoc/container/manifest.toml deleted file mode 100644 index f55fcb3a..00000000 --- a/k9-svc/pandoc/container/manifest.toml +++ /dev/null @@ -1,62 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Cerro Torre manifest for {{PROJECT_NAME}} .ctp bundle -# -# This manifest describes the container image for verified -# container packaging. Used by `ct pack` to create .ctp bundles. - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" -revision = 1 -summary = "{{PROJECT_DESCRIPTION}}" -description = """ -{{PROJECT_NAME}} — containerised service packaged as a verified -cerro-torre .ctp bundle with Ed25519 signing and full provenance -tracking. -""" -license = "{{LICENSE}}" -homepage = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -maintainer = "{{AUTHOR}} <{{EMAIL}}>" - -[provenance] -upstream = "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -import_date = {{CURRENT_DATE}}T00:00:00Z - -[dependencies] -runtime = ["ca-certificates", "curl"] -build = [] - -[build] -system = "podman" - -[build.environment] -APP_HOST = "[::]" -APP_PORT = "{{PORT}}" - -[outputs] -primary = "{{SERVICE_NAME}}" -split = [] - -[attestations] -require = ["source-signature", "sbom-complete"] -recommend = ["security-audit", "reproducible-build"] - -# Runtime security profile -[security] -user = "appuser" -group = "appuser" -read_only_root = false -no_new_privileges = true - -[security.capabilities] -drop = ["ALL"] -add = ["NET_BIND_SERVICE"] - -[security.network] -listen_tcp = [{{PORT}}] - -[security.filesystem] -read = ["/app/", "/data/"] -write = ["/data/", "/tmp/"] -execute = ["/app/entrypoint.sh"] diff --git a/k9-svc/pandoc/container/vordr.toml b/k9-svc/pandoc/container/vordr.toml deleted file mode 100644 index af38fc54..00000000 --- a/k9-svc/pandoc/container/vordr.toml +++ /dev/null @@ -1,100 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# -# Vordr runtime monitoring configuration for {{PROJECT_NAME}} -# -# Vordr watches container health, detects crashes, tracks resource usage, -# and emits structured logs. It runs alongside the application stack and -# provides runtime observability without requiring in-process agents. -# -# Usage: -# vordr watch --config container/vordr.toml -# vordr status -# vordr report - -[metadata] -name = "{{SERVICE_NAME}}" -version = "{{VERSION}}" - -# ============================================================================ -# Health Monitoring -# ============================================================================ -# -# Vordr periodically probes these endpoints. If a probe fails beyond the -# failure_threshold, vordr emits an alert and (optionally) restarts the -# container via Podman. - -[health] -# Primary health endpoint — must return 2xx. -endpoint = "http://localhost:{{PORT}}/health" -interval = "30s" -timeout = "5s" -failure_threshold = 3 - -# Readiness endpoint — checked during startup and after restarts. -readiness_endpoint = "http://localhost:{{PORT}}/ready" -readiness_timeout = "10s" - -# Action on failure: "alert" (log + notify) or "restart" (alert + podman restart). -on_failure = "alert" - -# ============================================================================ -# Crash Detection -# ============================================================================ -# -# Monitors container state via Podman. Detects OOM kills, segfaults, -# and unexpected exits. - -[crash_detection] -enabled = true -# Maximum restarts within the window before vordr stops restarting. -max_restarts = 5 -restart_window = "10m" - -# ============================================================================ -# Resource Thresholds -# ============================================================================ -# -# Alert when resource usage exceeds these thresholds. Values are percentages -# of the container's cgroup limits (or host limits if uncapped). - -[resources] -cpu_warn = 80 # Percentage — warn at 80% sustained CPU. -cpu_critical = 95 # Percentage — critical alert at 95%. -memory_warn = 75 # Percentage of memory limit. -memory_critical = 90 -disk_warn = 80 # Percentage of volume usage. -disk_critical = 95 - -# Sample interval for resource metrics. -sample_interval = "15s" - -# ============================================================================ -# Log Output -# ============================================================================ -# -# Vordr emits its own logs (not the application's) in structured format. - -[logging] -format = "json" -level = "info" -# Write vordr logs to stdout (captured by Podman) and optionally to file. -output = "stdout" -# file = "/var/log/vordr/{{SERVICE_NAME}}.log" - -# ============================================================================ -# Notifications (optional) -# ============================================================================ -# -# Uncomment and configure to receive alerts via webhook or email. - -# [notifications.webhook] -# url = "https://example.com/hooks/vordr" -# method = "POST" -# headers = { "Content-Type" = "application/json" } -# on = ["failure", "recovery", "resource_critical"] - -# [notifications.email] -# to = "{{EMAIL}}" -# from = "vordr@{{SERVICE_NAME}}.local" -# smtp = "smtp://localhost:25" -# on = ["failure", "resource_critical"] diff --git a/k9-svc/pandoc/contractile.just b/k9-svc/pandoc/contractile.just deleted file mode 100644 index 9a5827ba..00000000 --- a/k9-svc/pandoc/contractile.just +++ /dev/null @@ -1,75 +0,0 @@ -# Auto-generated by: contractile gen-just -# Source directory: contractiles -# Re-generate with: contractile gen-just --dir contractiles -# -# SPDX-License-Identifier: MPL-2.0 - -# === DUST (Recovery & Rollback) === -# Source: Dustfile.a2ml - -# List available dust recovery actions -dust-status: - @echo ' dust-source-rollback: Revert all source changes to last commit [rollback]' - -# Revert all source changes to last commit -dust-source-rollback: - @echo 'Executing rollback for source-rollback' - git checkout HEAD -- . - - -# === INTEND (Declared Future Intent) === -# Source: Intentfile.a2ml - -# Display declared future intents -intend-list: - @echo '=== Declared Intent ===' - @echo '' - @echo 'Features:' - @echo '' - @echo 'Quality:' - - -# === MUST (Physical State Checks) === -# Source: Mustfile.a2ml - -# Run all must checks -must-check: must-license-present must-readme-present must-spdx-headers must-no-banned-files - @echo 'All must checks passed' - -# LICENSE file must exist -must-license-present: - test -f LICENSE - -# README must exist -must-readme-present: - test -f README.adoc || test -f README.md - -# Source files should have SPDX license headers -must-spdx-headers: - find . -name '*.rs' -o -name '*.res' -o -name '*.gleam' | head -20 | xargs -r grep -L 'SPDX-License-Identifier' | wc -l | grep -q '^0$' - -# No Dockerfiles or Makefiles -must-no-banned-files: - test ! -f Dockerfile && test ! -f Makefile - - -# === TRUST (Integrity & Provenance Verification) === -# Source: Trustfile.a2ml - -# Run all trust verifications -trust-verify: trust-license-content trust-no-secrets-committed trust-container-images-pinned - @echo 'All trust verifications passed' - -# LICENSE contains expected SPDX identifier -trust-license-content: - grep -q 'SPDX\|License\|MIT\|Apache\|PMPL\|MPL' LICENSE - -# No .env or credential files in repo -trust-no-secrets-committed: - test ! -f .env && test ! -f credentials.json && test ! -f .env.local - -# Containerfile base images use pinned digests -trust-container-images-pinned: - test ! -f Containerfile || grep -q '@sha256:' Containerfile - - diff --git a/k9-svc/pandoc/docs/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 7f79301e..00000000 --- a/k9-svc/pandoc/docs/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,33 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "docs-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Technical documentation hub. The root contains high-level orientation - (README, Quickstart, State-Visualizer). Specialized tracks live in - subdirectories. - -canonical_locations: - quickstart: "QUICKSTART.adoc" - state_visualizer: "STATE-VISUALIZER.adoc" - governance: "governance/" - architecture: "architecture/" - decisions: "decisions/" - theory: "theory/" - practice: "practice/" - developer: "developer/" - attribution: "attribution/" - reports: "reports/" - whitepapers: "whitepapers/" - standards: "standards/" - legal: "legal/" - wikis: "wikis/" - -invariants: - - "Primary documentation format MUST be AsciiDoc (.adoc)" - - "Root docs/ MUST only contain pillar entry points" diff --git a/k9-svc/pandoc/docs/QUICKSTART.adoc b/k9-svc/pandoc/docs/QUICKSTART.adoc deleted file mode 100644 index d97c31ec..00000000 --- a/k9-svc/pandoc/docs/QUICKSTART.adoc +++ /dev/null @@ -1,24 +0,0 @@ -= Quickstart -:toc: preamble - -Get up and running in 60 seconds. - -== Prerequisites - -* Git 2.40+ -* just (command runner) -* Your language toolchain (see Justfile for details) - -== From Template (New Project) - -[source,bash] ----- -git clone https://github.com/{{OWNER}}/rsr-template-repo my-project -cd my-project -rm -rf .git && git init -b main -just init # interactive placeholder replacement ----- - -== Project Structure - -See README.adoc in the root for the Dual-Track architecture summary. diff --git a/k9-svc/pandoc/docs/README.adoc b/k9-svc/pandoc/docs/README.adoc deleted file mode 100644 index df45be70..00000000 --- a/k9-svc/pandoc/docs/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= Documentation Layout - -Primary tracks: - -* `theory/` for formal and conceptual material -* `practice/` for operational and implementation material -* `maintenance/` for baseline checklists and release hard-pass runbooks -* `whitepapers/academic/` for research-facing whitepapers -* `whitepapers/industry/` for industry/outreach whitepapers - -Core docs: - -* `maintenance/MAINTENANCE-CHECKLIST.md` -* `practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` diff --git a/k9-svc/pandoc/docs/RSR_OUTLINE.adoc b/k9-svc/pandoc/docs/RSR_OUTLINE.adoc deleted file mode 100644 index 0ba0c97b..00000000 --- a/k9-svc/pandoc/docs/RSR_OUTLINE.adoc +++ /dev/null @@ -1,290 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="https://github.com/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="https://github.com/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all RSR-compliant repos. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.a2ml, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Interactive bootstrap — replaces all placeholders -just init - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.gitattributes` -|Line endings, diff drivers, binary detection - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`.machine_readable/` -|All machine-readable content: state files (6 a2ml), `bot_directives/`, `contractiles/` - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`Justfile` -|Task runner with 40+ recipes - -|`Containerfile` -|Container build (Wolfi base, Podman) - -|`LICENSE` -|PMPL-1.0-or-later (Palimpsest MPL) - -|`EXHIBIT-A-ETHICAL-USE.txt` -|Ethical use guidelines (LICENSE Exhibit A) - -|`EXHIBIT-B-QUANTUM-SAFE.txt` -|Quantum-safe provenance spec (LICENSE Exhibit B) - -|`README.adoc` -|Project overview - -|`TOPOLOGY.md` -|Architecture diagram and completion dashboard - -|`PLACEHOLDERS.md` -|Template variable reference and replacement guide - -|`0-AI-MANIFEST.a2ml` -|Universal AI agent entry point - -|`AI.a2ml` -|Claude-specific instructions - -|`src/abi/` -|Idris2 ABI definitions (Types, Layout, Foreign) - -|`ffi/zig/` -|Zig FFI implementation - -|`generated/abi/` -|Auto-generated C headers from Idris2 ABI -|=== - -== Justfile Features - -The template Justfile provides: - -* **Combinatoric matrix recipes** for build, test, container, CI -* **Cookbook generation**: `just cookbook` -> `docs/just-cookbook.adoc` -* **Man page generation**: `just man` -> `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.a2ml management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .gitattributes # Line endings, diff drivers -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── .machine_readable/ # ALL machine-readable content -│ ├── STATE.a2ml # Project state, progress, blockers -│ ├── META.a2ml # Architecture decisions, governance -│ ├── ECOSYSTEM.a2ml # Ecosystem position, relationships -│ ├── AGENTIC.a2ml # AI agent interaction patterns -│ ├── NEUROSYM.a2ml # Neurosymbolic integration config -│ ├── PLAYBOOK.a2ml # Operational runbook -│ ├── bot_directives/ # Per-bot rules and constraints -│ └── contractiles/ # Policy enforcement contracts -│ ├── k9/ # Security levels (Kennel/Yard/Hunt) -│ ├── dust/Dustfile # Recovery and rollback -│ ├── lust/Intentfile # Future intent declarations -│ ├── must/Mustfile # Invariant checks -│ └── trust/Trustfile.hs # Cryptographic verification -├── docs/ # Documentation -│ ├── CITATIONS.adoc -│ ├── TOPOLOGY-GUIDE.adoc -│ ├── generated/ -│ └── man/ -├── src/abi/ # Idris2 ABI definitions -│ ├── Types.idr -│ ├── Layout.idr -│ └── Foreign.idr -├── ffi/zig/ # Zig FFI implementation -│ ├── build.zig -│ ├── src/main.zig -│ └── test/integration_test.zig -├── generated/abi/ # Auto-generated C headers -├── examples/ # Example code -├── guix.scm # Guix package -├── Justfile # Task runner -├── Containerfile # Container build -├── LICENSE # PMPL-1.0-or-later -├── EXHIBIT-A-ETHICAL-USE.txt # Ethical use guidelines -├── EXHIBIT-B-QUANTUM-SAFE.txt # Quantum-safe provenance -├── README.adoc # Overview -├── TOPOLOGY.md # Architecture + completion -├── PLACEHOLDERS.md # Template variable guide -├── 0-AI-MANIFEST.a2ml # Universal AI entry point -└── AI.a2ml # Claude-specific instructions ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust, Elixir, Zig, Ada, Haskell, ReScript, Gleam -* **Tier 2** (Silver): Nickel, Guile Scheme, Nix, Idris2, OCaml -* **Infrastructure**: Guix channels, derivations, Julia batch scripts - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `Justfile` -* `README.adoc` -* `LICENSE` (PMPL-1.0-or-later) -* `.machine_readable/STATE.a2ml` -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript (use ReScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) -* npm, Bun, pnpm, yarn (use Deno) -* Go (use Rust) - -== STATE.a2ml - -The STATE.a2ml file tracks project state: - -[source] ----- -# STATE — Project State Checkpoint -# Format: a2ml (AI-readable markup) - -project: v-graphql -version: 0.1.0 -last-updated: 2026-02-14 -status: active - -phase: implementation -maturity: beta - -ecosystem: - part-of: RSR Framework - depends-on: [] - -milestones: - - name: Initial setup - completion: 100 - - name: Core implementation - completion: 0 ----- - -== Badge Schema - -Generate badges from STATE.a2ml: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.a2ml Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance -* **Hypatia**: Neurosymbolic security scanning -* **gitbot-fleet**: Bot orchestration - -== License - -SPDX-License-Identifier: MPL-2.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/k9-svc/pandoc/docs/STATE-VISUALIZER.adoc b/k9-svc/pandoc/docs/STATE-VISUALIZER.adoc deleted file mode 100644 index 2af3297c..00000000 --- a/k9-svc/pandoc/docs/STATE-VISUALIZER.adoc +++ /dev/null @@ -1,128 +0,0 @@ -= Project State Visualizer -[source] ----- - - - - -# RSR Template Repo — Project Topology - -## System Architecture - -``` - ┌─────────────────────────────────────────┐ - │ NEW REPOSITORY │ - │ (Consumer of this Template) │ - └───────────────────┬─────────────────────┘ - │ Scaffolding - ▼ - ┌─────────────────────────────────────────┐ - │ RSR TEMPLATE HUB │ - │ │ - │ ┌───────────┐ ┌───────────────────┐ │ - │ │ AI Gate- │ │ ABI / FFI │ │ - │ │ keeper │ │ Standard │ │ - │ │ (0-AI-M) │ │ (Idris2/Zig) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────┐ ┌────────▼──────────┐ │ - │ │ Topology │ │ SCM / 6SCM │ │ - │ │ Guide │ │ Metadata │ │ - │ │ (Visual) │ │ (machine_read) │ │ - │ └─────┬─────┘ └────────┬──────────┘ │ - │ │ │ │ - │ ┌─────▼─────────────────▼──────────┐ │ - │ │ CONTAINER ECOSYSTEM │ │ - │ │ ┌──────────┐ ┌───────────────┐ │ │ - │ │ │ Podman / │ │ selur-compose │ │ │ - │ │ │ OCI │ │ cerro-torre │ │ │ - │ │ │ Build │ │ svalinn/vordr │ │ │ - │ │ └──────────┘ └───────────────┘ │ │ - │ │ ct-build.sh deploy.k9.ncl │ │ - │ └──────────────────────────────────┘ │ - └────────│─────────────────│──────────────┘ - │ │ - ▼ ▼ - ┌─────────────────────────────────────────┐ - │ PLATFORM INTEGRATION │ - │ ┌───────────┐ ┌───────────┐ ┌───────┐│ - │ │ GitHub │ │ GitLab │ │ Nix / ││ - │ │ Workflows │ │ CI/CD │ │ Guix ││ - │ └───────────┘ └───────────┘ └───────┘│ - └─────────────────────────────────────────┘ - - ┌─────────────────────────────────────────┐ - │ REPO INFRASTRUCTURE │ - │ Justfile / Mustfile .machine_readable/ │ - │ Codeowners / Reuse 0-AI-MANIFEST.a2ml │ - └─────────────────────────────────────────┘ -``` - -## Completion Dashboard - -``` -COMPONENT STATUS NOTES -───────────────────────────────── ────────────────── ───────────────────────────────── -CORE STANDARDS - ABI/FFI Standard (Idris2/Zig) ██████████ 100% Universal interface stable - AI Gatekeeper (0-AI-MANIFEST) ██████████ 100% Universal entry point active - TOPOLOGY.md Standard ██████████ 100% Visual summary guide active - 6SCM Metadata Structure ██████████ 100% Machine-readable state stable - -INFRASTRUCTURE - Justfile Automation ██████████ 100% Standard build/verify tasks - CI/CD Workflow Templates ██████████ 100% GH/GL scaffolding verified - Multi-Forge Sync ██████████ 100% Hub-and-spoke mirroring stable - -CONTAINER ECOSYSTEM (Phase 2) - Containerfile (OCI build) ██████████ 100% Multi-stage Chainguard base - selur-compose orchestration ██████████ 100% Template + concrete example - cerro-torre manifest ██████████ 100% Bundle metadata & signing - svalinn gateway policy ██████████ 100% .gatekeeper.yaml active - vordr runtime monitoring ██████████ 100% Runtime config template - k9-svc deployment (Nickel) ██████████ 100% Hunt-level deploy descriptor - ct-build.sh pipeline ██████████ 100% Build/sign/verify script - Justfile container-* recipes ██████████ 100% 8 recipes integrated - Trustfile CONTAINER_SUPPLY_CHAIN ██████████ 100% Supply chain section added - -REPO INFRASTRUCTURE - .machine_readable/ ██████████ 100% STATE/META/ECOSYSTEM active - Governance & License ██████████ 100% PMPL & Ethical use verified - Development Shells (Nix/Guix) ██████████ 100% Reproducible env stable - -───────────────────────────────────────────────────────────────────────────── -OVERALL: ██████████ 100% RSR Template Stable & Certified -``` - -## Key Dependencies - -``` -Philosophy ──────► RSR Standard ──────► Template Scaffolding ──► New Repo - │ │ │ │ - ▼ ▼ ▼ ▼ -CCCP Policy ─────► 0-AI-MANIFEST ────────► Justfile ──────────► Compliance - │ - ▼ - Container Ecosystem - ┌──────────┼──────────┐ - ▼ ▼ ▼ - selur-compose cerro- svalinn/ - (orchestrate) torre vordr - (sign) (monitor) - │ - ▼ - k9-svc deploy -``` - -## Update Protocol - -This file is maintained by both humans and AI agents. When updating: - -1. **After completing a component**: Change its bar and percentage -2. **After adding a component**: Add a new row in the appropriate section -3. **After architectural changes**: Update the ASCII diagram -4. **Date**: Update the `Last updated` comment at the top of this file - -Progress bars use: `█` (filled) and `░` (empty), 10 characters wide. -Percentages: 0%, 10%, 20%, ... 100% (in 10% increments). ----- diff --git a/k9-svc/pandoc/docs/architecture/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/architecture/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 028b503d..00000000 --- a/k9-svc/pandoc/docs/architecture/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "architecture-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for system architecture and threat models. - -canonical_locations: - threat_model: "THREAT-MODEL.adoc" - -invariants: - - "Visual diagrams MUST include ASCII or Mermaid representations" diff --git a/k9-svc/pandoc/docs/architecture/THREAT-MODEL.adoc b/k9-svc/pandoc/docs/architecture/THREAT-MODEL.adoc deleted file mode 100644 index df5e0380..00000000 --- a/k9-svc/pandoc/docs/architecture/THREAT-MODEL.adoc +++ /dev/null @@ -1,162 +0,0 @@ -= Threat Model - - - -# Threat Model: {{PROJECT_NAME}} - -## Document Info - -| Field | Value | -|---------------|--------------------------------| -| Project | {{PROJECT_NAME}} | -| Version | 1.0 | -| Last Reviewed | {{DATE}} | -| Author | {{AUTHOR}} | -| Methodology | STRIDE | - -## Scope - -### In Scope - -- Application source code and build pipeline -- CI/CD workflows (GitHub Actions) -- Container images and runtime environment -- Secrets and credential management -- Dependencies (direct and transitive) -- Deployment artifacts (binaries, containers, SBOM) - -### Out of Scope - -- Physical security of hosting infrastructure -- GitHub/GitLab platform-level vulnerabilities -- End-user device security -- Social engineering attacks against maintainers (handled by org policy) - -## System Overview - -Brief description of {{PROJECT_NAME}} and its architecture. - -> See [STATE-VISUALIZER.adoc](../STATE-VISUALIZER.adoc) for the full architecture diagram and completion dashboard. - -## Assets - -| Asset | Classification | Owner | Notes | -|----------------------|----------------|-------------|--------------------------------------------| -| Source code | Internal | Maintainers | Public repos are still internal-integrity | -| Signing keys | Restricted | Release lead | Signing keys (e.g., Ed25519), GPG keys | -| CI/CD secrets | Restricted | Maintainers | GITHUB_TOKEN, deploy tokens, PATs | -| User/contributor data | Confidential | Org | Emails, contributor identity | -| Build artifacts | Internal | CI pipeline | Binaries, WASM bundles | -| Container images | Internal | CI pipeline | Chainguard-based, signed via image signing tool | -| SBOM / provenance | Public | CI pipeline | SLSA attestations | -| Dependencies | Public | Lockfile | Cargo.lock, deno.lock, gleam.toml | -| Infrastructure config | Confidential | Maintainers | Containerfiles, compose files, orchestration config | - -## Trust Boundaries - -| Boundary | From (Lower Trust) | To (Higher Trust) | -|-----------------------------|---------------------------|----------------------------| -| Pull request submission | External contributor | Repository codebase | -| CI/CD workflow execution | Workflow definition | Runner with secrets access | -| Container build boundary | Build stage | Runtime stage | -| External API calls | Third-party service | Application internals | -| User input (CLI/Web) | End user | Application logic | -| Dependency resolution | Package registry | Build environment | -| Forge mirroring | GitHub | GitLab / Bitbucket | - -## Threat Actors - -| Actor | Motivation | Capability | -|--------------------------|-------------------------------|------------| -| Script kiddie | Vandalism, clout | Low | -| Disgruntled contributor | Sabotage, backdoor insertion | Medium | -| Supply chain attacker | Wide-impact compromise | High | -| Nation state | Espionage, disruption | Very High | -| Automated bot | Credential stuffing, spam PRs | Low-Medium | - -## STRIDE Analysis - -### Spoofing - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unsigned commits impersonate maintainer | Source code | Medium | High | High | Require GPG-signed commits; vigilant code review | -| Forged bot actions (automated agents) | CI/CD pipeline | Low | High | Medium | Bot tokens scoped minimally; audit bot activity | -| Spoofed package registry identity | Dependencies | Low | High | Medium | Pin dependencies by hash; verify provenance | - -### Tampering - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Malicious pull request | Source code | Medium | High | High | Branch protection; required reviews; CodeQL | -| Dependency poisoning (typosquat) | Dependencies | Medium | High | High | Lockfiles; secret-scanner; security scans | -| Tampered container base image | Container images | Low | High | Medium | Chainguard images; image signing verification | -| Workflow file modification | CI/CD pipeline | Low | High | Medium | CODEOWNERS on .github/; workflow-linter | - -### Repudiation - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Unlogged deployment | Build artifacts | Medium | Medium | Medium | SLSA provenance; deployment audit trail | -| Denied merge of vulnerable code | Source code | Low | Medium | Low | Git history is immutable; signed commits | -| Secret rotation without record | CI/CD secrets | Low | Low | Low | Secret rotation logged in STATE.a2ml | - -### Information Disclosure - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Secrets leaked in git history | CI/CD secrets | Medium | High | High | TruffleHog in CI; secret-scanner workflow | -| Verbose error messages in prod | Application logic | Medium | Medium | Medium | Sanitize outputs; structured logging | -| SBOM reveals internal structure | Infrastructure | Low | Low | Low | Accepted risk; SBOM is intentionally public | - -### Denial of Service - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| CI resource exhaustion (fork bomb in PR) | CI/CD pipeline | Medium | Medium | Medium | Concurrency limits; timeout on workflows | -| Spam issues/PRs flooding triage | Maintainer time | Medium | Low | Low | GitHub rate limits; bot auto-close stale | -| Large binary commits bloating repo | Source code | Low | Medium | Low | .gitattributes LFS policy; pre-commit hooks | - -### Elevation of Privilege - -| Threat | Affected Asset | Likelihood | Impact | Risk | Mitigation | -|---------------------------------|-------------------|------------|--------|--------|------------------------------------------------| -| Workflow injection via PR title/body | CI/CD pipeline | Medium | High | High | Never interpolate PR fields in `run:`; use env vars | -| GITHUB_TOKEN over-scoped | CI/CD secrets | Medium | High | High | `permissions: read-all` default; per-job scoping | -| Container escape | Runtime environment | Low | High | Medium | Hardened container runtime; read-only rootfs; no-new-privileges | -| Compromised action dependency | CI/CD pipeline | Medium | High | High | SHA-pin all actions; never use `@latest` tags | - -## Mitigations in Place - -- **SLSA Provenance**: Build attestations via slsa-github-generator -- **Secret Scanning**: TruffleHog + secret-scanner workflow on every push -- **Static Analysis**: CodeQL on supported languages -- **Supply Chain**: OpenSSF Scorecard (scorecard.yml + scorecard-enforcer.yml) -- **Container Signing**: Ed25519 signatures on all published images (optional: use your signing tool) -- **Container Runtime**: Hardened container runtime with formal verification (optional) -- **Dependency Pinning**: All GitHub Actions SHA-pinned; lockfiles committed -- **Workflow Validation**: workflow-linter.yml checks all workflow changes -- **Security Scanning**: Neurosymbolic scanning (hypatia-scan.yml, optional) -- **Bot Governance**: Bot orchestration with confidence thresholds (optional) -- **Edge Security**: Gateway with policy enforcement (optional, where applicable) -- **SBOM**: Generated and published with releases - -## Residual Risks - -| Risk | Accepted Because | Review Trigger | -|-----------------------------------------------|---------------------------------------------------|-------------------------| -| Zero-day in GitHub Actions runner | Platform responsibility; no feasible mitigation | GitHub advisory | -| Maintainer account compromise | Mitigated by 2FA requirement; residual remains | Any suspicious activity | -| Transitive dependency vulnerability (0-day) | Lockfiles limit blast radius; scanning catches known CVEs | CVE database update | -| SBOM exposes internal component names | Transparency is a design goal | Policy change | - -## Review Schedule - -This threat model should be reviewed: - -- **Quarterly** as a standing item -- **When architecture changes** (new services, new trust boundaries, new deployment targets) -- **Before major releases** (v1.0, v2.0, etc.) -- **After any security incident** affecting this project or its dependencies - -Reviewer should update the "Last Reviewed" date and version in Document Info above. diff --git a/k9-svc/pandoc/docs/attribution/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/attribution/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 52beaea4..00000000 --- a/k9-svc/pandoc/docs/attribution/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "attribution-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on attribution. diff --git a/k9-svc/pandoc/docs/attribution/CITATION.cff b/k9-svc/pandoc/docs/attribution/CITATION.cff deleted file mode 100644 index 4d562f43..00000000 --- a/k9-svc/pandoc/docs/attribution/CITATION.cff +++ /dev/null @@ -1,17 +0,0 @@ -cff-version: 1.2.0 -message: "If you use this software, please cite it as below." -authors: -- family-names: "{{AUTHOR_LAST}}" - given-names: "{{AUTHOR_FIRST}}" - orcid: "https://orcid.org/0000-0000-0000-0000" # Placeholder -title: "{{PROJECT_NAME}}" -version: 0.1.0 -date-released: {{CURRENT_DATE}} -url: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -repository-code: "https://{{FORGE}}/{{OWNER}}/{{REPO}}" -license: PMPL-1.0-or-later -keywords: - - "rsr" - - "formal-verification" - - "neurosymbolic" - - "provenance" diff --git a/k9-svc/pandoc/docs/attribution/CITATIONS.adoc b/k9-svc/pandoc/docs/attribution/CITATIONS.adoc deleted file mode 100644 index eeee45fb..00000000 --- a/k9-svc/pandoc/docs/attribution/CITATIONS.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= {{PROJECT_NAME}} - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{{{PROJECT_NAME}}_{{CURRENT_YEAR}}, - author = {{{AUTHOR_LAST}}, {{AUTHOR_FIRST}}}, - title = {{{PROJECT_NAME}}}, - year = {{{CURRENT_YEAR}}}, - url = {https://github.com/{{OWNER}}/{{PROJECT_NAME}}}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}) _{{PROJECT_NAME}}_ [Computer software]. Available at: https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== OSCOLA - -{{AUTHOR}}, '{{PROJECT_NAME}}' ({{CURRENT_YEAR}}) - -== MLA - -{{AUTHOR_LAST}}, {{AUTHOR_FIRST}} "{{PROJECT_NAME}}." {{CURRENT_YEAR}}, github.com/{{OWNER}}/{{PROJECT_NAME}}. - -== APA 7 - -{{AUTHOR_LAST}}, {{AUTHOR_INITIALS}} ({{CURRENT_YEAR}}). _{{PROJECT_NAME}}_ [Computer software]. GitHub. https://github.com/{{OWNER}}/{{PROJECT_NAME}} - -== See Also - -* link:CITATION.cff[CITATION.cff] diff --git a/k9-svc/pandoc/docs/attribution/CODEOWNERS.adoc b/k9-svc/pandoc/docs/attribution/CODEOWNERS.adoc deleted file mode 100644 index 3714055f..00000000 --- a/k9-svc/pandoc/docs/attribution/CODEOWNERS.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Code Ownership -:icons: font - -This project utilizes a formally defined code ownership structure to ensure that specific components are reviewed by domain experts. - -== Authority Model - -Our ownership model is based on the "Perimeter" architecture: -* **Perimeter 1 (Core):** Strictly controlled by Lead Maintainers. -* **Perimeter 2 (Extensions):** Maintained by component owners. -* **Perimeter 3 (Community):** Open for broader community participation. - -== Automated Enforcement - -The technical rules for automatic review assignments are maintained in the machine-readable link:../../.github/CODEOWNERS[.github/CODEOWNERS] file. GitHub uses this to automatically notify owners when changes are proposed to their sections. - -== Component Owners - -A full list of maintainers and their contact information can be found in link:MAINTAINERS.adoc[MAINTAINERS.adoc]. diff --git a/k9-svc/pandoc/docs/attribution/MAINTAINERS.adoc b/k9-svc/pandoc/docs/attribution/MAINTAINERS.adoc deleted file mode 100644 index d829dd95..00000000 --- a/k9-svc/pandoc/docs/attribution/MAINTAINERS.adoc +++ /dev/null @@ -1,47 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| {{AUTHOR}} -| Lead Maintainer -| https://github.com/{{OWNER}}[@{{OWNER}}] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/k9-svc/pandoc/docs/attribution/README.adoc b/k9-svc/pandoc/docs/attribution/README.adoc deleted file mode 100644 index b095612c..00000000 --- a/k9-svc/pandoc/docs/attribution/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= attribution Unit diff --git a/k9-svc/pandoc/docs/decisions/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/decisions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index ac26298b..00000000 --- a/k9-svc/pandoc/docs/decisions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "decisions-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on decisions. diff --git a/k9-svc/pandoc/docs/decisions/0000-template.adoc b/k9-svc/pandoc/docs/decisions/0000-template.adoc deleted file mode 100644 index 763eab1e..00000000 --- a/k9-svc/pandoc/docs/decisions/0000-template.adoc +++ /dev/null @@ -1,35 +0,0 @@ -= Architecture Decision Record: 0000-template - - - -# [NUMBER]. [TITLE] - -Date: YYYY-MM-DD - -## Status - -[Proposed | Accepted | Deprecated | Superseded by [ADR-NNNN](NNNN-title.md) | Rejected] - -## Context - -What is the issue that we're seeing that is motivating this decision or change? - -## Decision - -What is the change that we're proposing and/or doing? - -## Consequences - -What becomes easier or more difficult to do because of this change? - -### Positive - -- ... - -### Negative - -- ... - -### Neutral - -- ... diff --git a/k9-svc/pandoc/docs/decisions/0001-adopt-rsr-standard.adoc b/k9-svc/pandoc/docs/decisions/0001-adopt-rsr-standard.adoc deleted file mode 100644 index 85f414be..00000000 --- a/k9-svc/pandoc/docs/decisions/0001-adopt-rsr-standard.adoc +++ /dev/null @@ -1,86 +0,0 @@ -= Architecture Decision Record: 0001-adopt-rsr-standard - - - -# 1. Adopt Rhodium Standard Repository (RSR) Template - -Date: 2026-02-14 - -## Status - -Accepted - -## Context - -Managing multiple repositories with an ad-hoc approach led to significant -inconsistencies across the ecosystem. Common problems included: - -- Missing or incomplete configuration files (SECURITY.md, CONTRIBUTING.md, - .editorconfig, etc.) -- State files (STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml) placed in the repository - root instead of the canonical `.machine_readable/` directory -- Duplicate or conflicting workflow definitions across repos -- No standardized entry point for AI agents interacting with repositories -- Inconsistent bot directive configurations leading to unreliable automation -- No contractile enforcement or Justfile automation - -Without a single source of truth for repository structure, each new repo -required manual setup and inevitably drifted from best practices over time. - -## Decision - -Adopt the Rhodium Standard Repository (RSR) template (`rsr-template-repo`) as -the canonical starting point for all new repositories. Existing repositories -will migrate incrementally as they receive active development. - -The RSR template provides: - -- **Machine-readable state files** in `.machine_readable/` (STATE.a2ml, - ECOSYSTEM.a2ml, META.a2ml, AGENTIC.a2ml, NEUROSYM.a2ml, PLAYBOOK.a2ml) -- **AI manifest** (`0-AI-MANIFEST.a2ml`) as a universal entry point for all - AI agents -- **Bot directives** in `.machine_readable/bot_directives/` for bot orchestration integration -- **Contractiles** in `.machine_readable/contractiles/` (k9, dust, lust, must, trust) for - policy enforcement -- **Standardized workflows** (16+ GitHub Actions workflows, all SHA-pinned) -- **Justfile automation** with standard recipes for common tasks -- **Security and governance files**: SECURITY.md, CONTRIBUTING.md, - CODE_OF_CONDUCT.md, LICENSE (PMPL-1.0-or-later) -- **Architecture Decision Records** in `docs/decisions/` - -New repositories are created by cloning the template: - -```bash -git clone https://github.com/{{OWNER}}/rsr-template-repo new-repo-name -cd new-repo-name -rm -rf .git && git init -``` - -## Consequences - -### Positive - -- Consistency across all repositories, enforced from creation -- Automated compliance checking via `rsr-antipattern.yml` workflow -- Bot fleet can operate reliably across all repos with predictable structure -- AI agents (Claude, Gemini, etc.) have a standardized entry point via - `0-AI-MANIFEST.a2ml` -- New contributors can onboard faster with familiar, documented structure -- Reduced maintenance burden: fix once in template, propagate to all repos -- Machine-readable state enables tooling and automation pipelines - -### Negative - -- Migration effort for existing repos requires time and attention -- Learning curve for contributors unfamiliar with RSR conventions -- Template updates need propagation mechanism to existing repos -- Some repos may have unique needs that do not fit the standard template - without customization - -### Neutral - -- Existing CI/CD pipelines continue to work; RSR workflows are additive -- Third-party dependencies retain their original licenses regardless of - repo structure -- ADR process itself is part of the template, enabling future decisions - to be recorded consistently diff --git a/k9-svc/pandoc/docs/decisions/README.adoc b/k9-svc/pandoc/docs/decisions/README.adoc deleted file mode 100644 index 153a5e78..00000000 --- a/k9-svc/pandoc/docs/decisions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= decisions Unit diff --git a/k9-svc/pandoc/docs/developer/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/developer/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c16fcc74..00000000 --- a/k9-svc/pandoc/docs/developer/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "developer-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on developer. diff --git a/k9-svc/pandoc/docs/developer/ABI-FFI-README.adoc b/k9-svc/pandoc/docs/developer/ABI-FFI-README.adoc deleted file mode 100644 index 65d2afe1..00000000 --- a/k9-svc/pandoc/docs/developer/ABI-FFI-README.adoc +++ /dev/null @@ -1,384 +0,0 @@ -= ABI/FFI Standards -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -{{LICENSE}} - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/{{OWNER}}/rhodium-standard-repositories) diff --git a/k9-svc/pandoc/docs/developer/README.adoc b/k9-svc/pandoc/docs/developer/README.adoc deleted file mode 100644 index 1d00529d..00000000 --- a/k9-svc/pandoc/docs/developer/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= developer Unit diff --git a/k9-svc/pandoc/docs/governance/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 6e373bd2..00000000 --- a/k9-svc/pandoc/docs/governance/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary governance pillar implementing the Triaxial Software Development - Methodology (TSDM). Contains planning, maintenance, and audit tracks. - -canonical_locations: - tsdm_spec: "TSDM.adoc" - planning: "planning/" - maintenance: "maintenance/" - audit: "audit/" - crg: "CRG-CRITERIA.adoc" - checklist: "MAINTENANCE-CHECKLIST.adoc" - approach: "SOFTWARE-DEVELOPMENT-APPROACH.adoc" diff --git a/k9-svc/pandoc/docs/governance/CRG-CRITERIA.a2ml b/k9-svc/pandoc/docs/governance/CRG-CRITERIA.a2ml deleted file mode 100644 index 99a1c4e0..00000000 --- a/k9-svc/pandoc/docs/governance/CRG-CRITERIA.a2ml +++ /dev/null @@ -1,108 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -; Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) - -; Component Readiness Grades (CRG) — Machine-readable specification -; Format: A2ML (AI-to-Machine Language) -; Standard: CRG v1.0 - -(standard - (name "Component Readiness Grades") - (abbreviation "CRG") - (version "1.0") - (date "2026-02-28") - (author "Jonathan D.A. Jewell ") - (license "PMPL-1.0-or-later") - (family "RSR")) - -(grades - (grade - (code X) - (name "Untested") - (release-stage #f) - (ordinal 0) - (description "No testing has been performed. Status unknown.") - (evidence-required "none") - (minimum-for #f)) - (grade - (code F) - (name "Harmful / Wasteful") - (release-stage #f) - (ordinal 1) - (description "Actively harmful, wasteful, or better handled externally. Reject, deprecate, or delegate.") - (evidence-required "documented test results showing harm, waste, or redundancy; comparison with alternatives") - (minimum-for #f)) - (grade - (code E) - (name "Minimal / Salvageable") - (release-stage "pre-alpha") - (ordinal 2) - (description "Does something slight. Barely functional. Needs redesign or major work.") - (evidence-required "at least one successful test case; documented failures and limitations") - (minimum-for #f)) - (grade - (code D) - (name "Partial / Inconsistent") - (release-stage "alpha") - (ordinal 3) - (description "Works on some things but not systematically.") - (evidence-required "matrix of tested scenarios; documented scope vs actual capabilities") - (minimum-for "alpha")) - (grade - (code C) - (name "Self-Validated") - (release-stage "beta") - (ordinal 4) - (description "Tested on the tool/project itself (dogfooding). Reliable in home context.") - (evidence-required "active dogfooding; CI integration or equivalent; no known failures in home context") - (minimum-for "beta")) - (grade - (code B) - (name "Broadly Validated") - (release-stage "release-candidate") - (ordinal 5) - (description "Tested on at least 6 disparate, unrelated targets.") - (evidence-required "list of 6+ diverse targets with test results; evidence of feedback incorporation") - (minimum-for "release-candidate")) - (grade - (code A) - (name "Field-Proven") - (release-stage "stable") - (ordinal 6) - (description "Real-world external feedback confirms value. Does no harm in the wild.") - (evidence-required "real-world usage data; feedback incorporation evidence; no unresolved harm reports") - (minimum-for "stable"))) - -(transitions - (promotion - (from X) (to E) (requirement "Run at least one test. Document results.")) - (promotion - (from X) (to F) (requirement "Evaluate and determine harmful or wasteful.")) - (promotion - (from E) (to D) (requirement "Fix critical failures. Document scope.")) - (promotion - (from D) (to C) (requirement "Dogfood on own project. Fix what breaks.")) - (promotion - (from C) (to B) (requirement "Test on 6+ diverse external targets. Fix what breaks.")) - (promotion - (from B) (to A) (requirement "Ship. Collect external feedback. Demonstrate no harm.")) - (demotion - (from A) (to B) (trigger "External feedback dries up or reveals no longer useful.")) - (demotion - (from A) (to F) (trigger "External feedback reveals component causes harm.")) - (demotion - (from B) (to C) (trigger "Broad validation reveals unfixed failures.")) - (demotion - (from C) (to D) (trigger "Home context changes and component no longer reliable.")) - (demotion - (from C) (to F) (trigger "Dogfooding reveals net negative.")) - (demotion - (from D) (to E) (trigger "Scope narrows to barely functional.")) - (demotion - (from any) (to F) (trigger "Better external alternative makes this pure opportunity cost."))) - -(conformance - (rule "Each assessable component MUST have a grade from {X, F, E, D, C, B, A}.") - (rule "Each grade above X MUST be supported by evidence per section 4.") - (rule "Assessments MUST be recorded in a version-controlled location.") - (rule "Assessments MUST be reviewed at least once per release cycle.") - (rule "Release stages MUST respect minimum grade thresholds.")) diff --git a/k9-svc/pandoc/docs/governance/CRG-CRITERIA.adoc b/k9-svc/pandoc/docs/governance/CRG-CRITERIA.adoc deleted file mode 100644 index f8264e6d..00000000 --- a/k9-svc/pandoc/docs/governance/CRG-CRITERIA.adoc +++ /dev/null @@ -1,39 +0,0 @@ -= Component Readiness Grades (CRG) Criteria -:toc: preamble -:icons: font - -This document defines the quality assessment criteria for individual project components. - -== Grade Definitions - -[cols="1,2,3,4",options="header"] -|=== -| Grade | Name | Release Stage | Meaning - -| **A** | Field-Proven | Stable | Real-world feedback amassed; no harm in wild. -| **B** | Broadly Validated | Release Candidate | Tested on 6+ diverse external targets. -| **C** | Self-Validated | Beta | Reliable in home context (dogfooded). -| **D** | Partial | Alpha | Works on some inputs/cases but not systematically. -| **E** | Minimal | Pre-alpha | Barely functional; needs major work. -| **F** | Harmful/Wasteful | Reject/Delegate | Redundant or negative value. -| **X** | Untested | — | Status completely unknown. -|=== - -== Core Principles - -1. **Assess components, not projects:** Each feature gets its own grade. -2. **Evidence over intuition:** Every grade above X requires documented evidence. -3. **Honest assessment:** Grade the component as it is today, not as you hope it will be. -4. **Grades are earned and can be lost:** Regressions lead to demotion. - -== Assessment Checklist - -1. Has it been tested at all? (No → **X**) -2. Does it cause harm or duplicate something better? (Yes → **F**) -3. Does it do something, however slight? (Barely → **E**) -4. Does it work on some things but not others? (Partial → **D**) -5. Does it work reliably on our own project? (Dogfooded → **C**) -6. Has it been tested on 6+ diverse external targets? (Broad → **B**) -7. Do external users confirm it works and is useful? (Field-proven → **A**) - -See link:READINESS.adoc[READINESS.adoc] for the current project assessment. diff --git a/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.a2ml deleted file mode 100644 index eaee7205..00000000 --- a/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.a2ml +++ /dev/null @@ -1,159 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Cross-repo maintenance baseline (machine-readable canonical) - -[metadata] -version = "1.1.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/maintenance/MAINTENANCE-CHECKLIST.adoc" -companion-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" -companion-machine = ".machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml" - -[policy] -single-source = true -notes = "Use this file as canonical machine policy and keep markdown synchronized." - -[maintenance-axes] -scoping-first = true -execution-order = ["scoping", "axis-1", "axis-2", "axis-3"] -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" - -[scoping] -inputs_required = [ - "README", - "roadmap", - "status-docs", - "maintenance-checklist", - "ci-and-security-docs", -] - -marker_scan_required = [ - "TODO", - "FIXME", - "XXX", - "HACK", - "STUB", - "PARTIAL", -] - -idris_unsound_scan_required = [ - "believe_me", - "assert_total", -] - -scope_assembly_buckets = ["must", "intend", "like"] - -[axis-2-maintenance-rules] -corrective-first = true -adaptive-second = true -adaptive_examples = [ - "scope-change reconciliation", - "stale-reference removal", - "obsolete-work culling", -] -perfective-third = true -perfective_source = "axis-1 honest state after corrective/adaptive updates" - -[axis-3-audit-rules] -systems-check = true -documentation-honesty-check = true -safety-security-accounted-check = true -effects-review-check = true -benchmark-evidence-required = true -maintainer-dialogue-review-required = true -compliance-seams-check = true -exception-register-required = true -exception-bounded-scope-required = true -policy-drift-contamination-check = true -example-drift-risk = "single TypeScript exception causing broad ReScript->TypeScript migration" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[generic-cleanup-finish-off] -root-cleanup-required = true -stale-work-cull-required = true -docs-parity-required = true -machine-human-sync-required = true -compliance-finish-off-required = true -effects-finish-off-required = true -release-prep-summary-required = true -next-actions-required = ["corrective", "adaptive", "perfective"] - -[must] -root_control_files = [ - ".gitignore", - ".gitattributes", - ".editorconfig", - ".tool-versions", - "Containerfile", - "Justfile", -] - -root_hosting_files = [ - "CNAME", - ".nojekyll", -] - -ownership_files = [ - "MAINTAINER", - ".github/CODEOWNERS", -] - -machine_readable_required = [ - ".machine_readable/anchors/ANCHOR.a2ml", - ".machine_readable/contractiles/", - ".machine_readable/ai/", - ".machine_readable/bot_directives/", -] - -contractiles_required = [ - "Mustfile", - "Trustfile", - "Intentfile", -] - -security_required = [ - ".well-known/security.txt", - "ci-security-scan", -] - -quality_gate_required = [ - "format", - "lint", - "unit-tests", - "integration-tests", - "p2p-tests", - "e2e-tests", - "bench-smoke", - "docs-check", - "security-scan", -] - -abi_ffi_policy = [ - "ABI Idris2 in src/interface/abi/*.idr", - "FFI Zig in ffi/**/*.zig", -] - -[should] -docs_primary_format = "adoc" -docs_structure = [ - "docs/theory", - "docs/practice", - "docs/whitepapers/academic", - "docs/whitepapers/industry", - "docs/proofs", - "docs/reports", -] - -root_minimization = true -well_known_metadata = true -roadmap_honesty_with_dates = true -ci_doc_format_policy = true - -[could] -generate_human_from_machine = true -mode_aware_bots = ["corrective", "adaptive", "perfective", "audit"] -topology_dashboard = true -exception_registry = true diff --git a/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.adoc b/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.adoc deleted file mode 100644 index 27f577a0..00000000 --- a/k9-svc/pandoc/docs/governance/MAINTENANCE-CHECKLIST.adoc +++ /dev/null @@ -1,569 +0,0 @@ -= Maintenance Checklist -# Maintenance Checklist (Cross-Repo) - -Use this as a repeatable maintenance runbook for any repo. - -Companion policy: - -- `docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc` (human-readable) -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` (machine-readable) - -## Canonical Repo Baseline (Final) - -Apply this baseline to every repo unless an explicit exception is recorded. - -### Three-Axis Default Model - -- [ ] Axis 1 (scope priority, runs first): `must > intend > like` -- [ ] Axis 2 (maintenance priority): `corrective > adaptive > perfective` -- [ ] Axis 3 (audit priority): `systems > compliance > effects` -- [ ] Perfective items are derived from Axis 1 honest state (not started independently). - -### Axis 1 Scoping Pass (Mandatory) - -Before Axis 2/3 execution, assemble a scoped worklist from evidence: - -- [ ] Read and reconcile: `README`, roadmap, status docs, maintenance checklist, and current CI/security docs. -- [ ] Scan for unfinished markers: `TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`. -- [ ] If Idris is present, scan unsoundness markers: `believe_me`, `assert_total`. -- [ ] Identify declared intent vs actual implementation (docs honesty check). -- [ ] Produce a scope assembly artifact with prioritized entries under: - - `must` (release blockers / safety / correctness) - - `intend` (planned near-term) - - `like` (nice-to-have) - -### Axis 2 Maintenance Execution Rules - -- [ ] Corrective first: fix breakage, defects, regressions, safety issues. -- [ ] Adaptive second: reconcile changed scope, remove stale references, cull no-longer-relevant work. -- [ ] Perfective third: only from current honest state established by Axis 1 and updated by corrective/adaptive actions. - -### Axis 3 Audit Rules - -- [ ] Verify systems are in place and actually operating. -- [ ] Verify documentation explains the real/current state (not aspirational-only), including documented exceptions. -- [ ] Verify safety and security controls are present, active, and evidenced. -- [ ] Verify observed effects/impacts are captured and reviewed. -- [ ] Effects audit includes: - - benchmark execution and recorded results (with before/after where relevant) - - explicit maintainer dialogue/status review on what changed, why, and next risks -- [ ] Audit compliance seams/compromises explicitly: - - policy exceptions are recorded with rationale, scope, and expiry/review - - exception does not silently broaden into general policy drift - - language-policy contamination checks run (example: a single TS exception must not trigger broad TypeScript conversion) - - run `panic-attack` as the compliance-audit scanner - - run ecological checking under effects (using sustainabot guidance as current baseline) - -### Generic Cleanup And Finish-Off Pass - -Run this pass at the end of a corrective/adaptive/perfective cycle: - -- [ ] Root cleanup: - - keep only required control/entry files in root - - move non-essential docs/reports/fixtures to canonical folders -- [ ] Remove or archive stale work: - - close out completed TODO/STUB/PARTIAL items - - cull obsolete references, dead files, and superseded plans -- [ ] Documentation finish-off: - - ensure README, roadmap, status, and wiki match actual implementation state - - ensure machine-readable policy/state files match human docs -- [ ] Security/compliance finish-off: - - run compliance scanner (`panic-attack`) and resolve high-priority findings - - verify exception register and seams/compromises are explicitly bounded -- [ ] Effects finish-off: - - run benchmark/effects checks and record evidence - - conduct explicit maintainer review dialogue (what changed, why, remaining risks) -- [ ] Release-prep finish-off: - - produce Must/Should/Could summary - - produce immediate corrective/adaptive/perfective next-actions list - -### Must - -- [ ] Keep required control files at repository root: - - `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` - - `Containerfile` - - `.containerignore` (or `.dockerignore` only when required for compatibility) - - `CNAME` and `.nojekyll` when using GitHub Pages/custom domain - - `Justfile` (root by convention) -- [ ] Keep ownership/governance files present: - - `MAINTAINER` in root - - `.github/CODEOWNERS` -- [ ] Keep machine-readable canonical structure under `.machine_readable/`: - - state/meta/ecosystem files (`*.a2ml` or repo standard) - - `anchors/ANCHOR.a2ml` - - `contractiles/` (`must`, `trust`, `lust`, and related) - - `ai/` for AI guidance files - - `bot_directives/` for bot control files -- [ ] Keep contractiles/invariants present and wired: - - root `Mustfile` (or equivalent) with enforceable checks - - `Trustfile` and `Intentfile` present -- [ ] Keep security metadata present: - - `.well-known/security.txt` and relevant policy metadata - - CI security scanning configured and runnable -- [ ] Keep docs and navigation coherent: - - single navigation entry point in root (`NAVIGATION.adoc` or equivalent) - - no duplicate conflicting docs for same purpose (for example both `.md` and `.adoc` in root unless intentionally required) -- [ ] Enforce ABI/FFI purity where the policy applies: - - ABI definitions in Idris2 (`src/abi/*.idr`) - - FFI implementations in Zig (`ffi/**/*.zig`) -- [ ] Ensure quality gate includes: formatting, lint, unit/integration tests, p2p/e2e checks, benchmark smoke, docs checks, security scan. - -### Should - -- [ ] Keep human docs primarily in AsciiDoc (`.adoc`) except where ecosystem rules require other formats (GitHub/community health, legal text, tool-specific files). -- [ ] Keep non-essential root files moved into structured folders: - - `docs/` (theory/practice/whitepapers/proofs/reports) - - `tests/` (fixtures/outputs) - - `docs/legal/` (while retaining root `LICENSE` when forge detection needs it) -- [ ] Maintain `.well-known/` for public metadata where applicable (`security.txt`, `humans.txt`, `ads.txt` mirrors if used). -- [ ] Keep CI policy checks for doc-format conventions and canonical file placement. -- [ ] Keep roadmap/status docs honest with dated evidence. - -### Could - -- [ ] Maintain both human and machine views of maintenance policy from a single source (generate one from the other). -- [ ] Add policy bots for corrective/adaptive/perfective/audit modes. -- [ ] Add repo-level architecture map (`TOPOLOGY.md`) and release-readiness dashboards. -- [ ] Add per-repo exception registry for approved policy deviations. - -### Explicit Root-Placement Rule - -Do **not** move the following out of root if you want default tool behavior: - -- `.gitignore`, `.gitattributes`, `.editorconfig`, `.tool-versions` -- `Containerfile` and ignore file (`.containerignore`/`.dockerignore`) -- `CNAME` and `.nojekyll` for GitHub Pages -- `Justfile` - -## Quick Automated Run (Script) - -Use the helper script first, then use the checklist for deeper/manual follow-up. - -Script locations: -- `$REPOS_DIR/run-maintenance.sh` -- `~/Desktop/run-maintenance.sh` - -```bash -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --output /tmp/maintenance-report.json -jq . /tmp/maintenance-report.json -``` - -Useful flags: - -```bash -# Strict mode: fail process on failed checks -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --strict - -# Skip expensive checks when needed -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --skip-panic - -# Explicit language selection -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --rust --python - -# Release hard-pass mode (fails on warnings or failures) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fail-on-warn -``` - -Permission policy in script: -- Flags `g+w/o+w` files/dirs -- Flags suspicious executable files -- Flags shebang scripts missing executable bit -- Supports repo-local exceptions via `.maintenance-perms-ignore` (regex per line) -- **Audit-first by default** (non-mutating) -- `--fix-perms` is explicit opt-in only (never implicit) -- For reversible local hardening, pair snapshot/restore scripts where available: - - `scripts/maintenance/perms-state.sh snapshot` - - `scripts/maintenance/perms-state.sh lock` - - `scripts/maintenance/perms-state.sh restore` - -Important git behavior: -- Git generally tracks execute bit, not full UNIX mode matrix. -- Permission hardening audits do not force collaborators to re-unlock every file on pull. -- Keep lock mode opt-in, with restore path documented. - -```bash -# Audit-only (recommended default) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo - -# Opt-in permission fixes (review output before commit) -~/Desktop/run-maintenance.sh --repo /absolute/path/to/repo --fix-perms -``` - -## 0) Setup - -```bash -REPO="/absolute/path/to/repo" -cd "$REPO" -``` - -```bash -date -u -git rev-parse --abbrev-ref HEAD -git rev-parse HEAD -git status --porcelain -``` - -## 1) Preflight - -- [ ] Confirm clean intent: note existing unrelated dirty files before edits. -- [ ] Confirm runtime/toolchain versions. -- [ ] Confirm container mode expectation (`podman`/`podman-compose`) if required. - -```bash -command -v rg git jq || true -command -v podman podman-compose || true -``` - -## 2) Dependency/Env Prereqs - -- [ ] Python deps in active interpreter (for Python paths). -- [ ] Language-specific tooling installed. - -```bash -python -c "import sys; print(sys.executable)" -python -c "import pydantic; print(pydantic.__version__)" || echo "pydantic missing" -``` - -## 3) Corrective Maintenance First - -- [ ] Fix regressions, runtime errors, panics, broken commands, failing tests. -- [ ] Re-run failing checks immediately after each fix. - -## 4) Code Health Scans - -- [ ] `TODO/FIXME/XXX/HACK/STUB/PARTIAL` scan. -- [ ] Permission policy scan (`g+w/o+w`, executable hygiene). -- [ ] ABI/FFI policy scan (if applicable: Idris2 ABI, Zig FFI). - -```bash -rg -n "TODO|FIXME|XXX|HACK|STUB|PARTIAL" -g '!**/.git/**' -g '!**/target/**' . -``` - -```bash -# Optional per-repo exceptions (regex per line): -# .maintenance-perms-ignore -# ^vendor/ -# ^third_party/ -``` - -```bash -# Adjust paths for your repo layout -find . -type f \( -name '*.idr' -o -name '*.idris2' -o -name '*.zig' \) -``` - -## 5) Panic/Safety/Security Pass - -- [ ] Run `panic-attacker` assail/assault. -- [ ] Triage findings by severity. -- [ ] Fix high first, then medium. -- [ ] Re-run until acceptable. - -```bash -PANIC_BIN="${REPOS_DIR:-$HOME/Documents/hyperpolymath-repos}/panic-attacker/target/release/panic-attack" -"$PANIC_BIN" assail "$REPO" --output /tmp/assail.json --output-format json --quiet -jq -r '.weak_points | length' /tmp/assail.json -jq -r '.weak_points[] | "\(.severity)|\(.location)|\(.description)"' /tmp/assail.json -``` - -```bash -# If repo has production-only source builder, prefer this for baseline checks: -./scripts/ci/build-panic-assail-source.sh /tmp/panic-src -"$PANIC_BIN" assail /tmp/panic-src --output /tmp/assail-prod.json --output-format json --quiet -``` - -## 6) Language-Specific Validation - -### Rust - -- [ ] Format -- [ ] Lint -- [ ] Tests -- [ ] Doc tests -- [ ] Benches (where relevant) - -```bash -cargo fmt --all --check -cargo clippy --workspace --all-targets -- -D warnings -cargo test --workspace -cargo test --workspace --doc -# Optional targeted benchmarks: -cargo bench -``` - -### Python - -- [ ] Format/lint -- [ ] Type check -- [ ] Tests - -```bash -ruff check . -ruff format --check . -mypy . -pytest -q -``` - -### Elixir - -- [ ] Format check -- [ ] Lint/static checks -- [ ] Tests - -```bash -mix format --check-formatted -mix credo --strict -mix test -``` - -## 7) Container/Runtime Checks (Podman) - -- [ ] Build container path. -- [ ] Run smoke tests inside containerized flow. -- [ ] Compare host vs container behavior for parity. - -```bash -podman --version -podman compose version || podman-compose --version -``` - -## 8) Benchmark + Regression Check - -- [ ] Capture before/after metrics for touched hot paths. -- [ ] Record command + sample size + output. -- [ ] Fail change if critical path regresses beyond threshold. - -## 9) Adaptive and Perfective Maintenance - -- [ ] Adaptive: compatibility updates (tooling/API/deprecations/config flags). -- [ ] Perfective: clarity, docs parity, developer workflow improvements. -- [ ] Update roadmap/checklist/docs to match actual implementation state. - -## 10) Final QA and Release Hygiene - -- [ ] Re-run full relevant checks one final time. -- [ ] Confirm no unintended file changes. -- [ ] Commit scoped changes with clear message. -- [ ] Push and capture commit SHA. - -```bash -git status --short -git diff --stat -git add -git commit -m "maint: " -git push -``` - -## 11) Maintenance Report Template - -Copy this block per repo run: - -```text -Repo: -Branch: -Start UTC: -End UTC: - -Scope: -- Corrective: -- Adaptive: -- Perfective: - -Checks Run: -- TODO/FIXME scan: -- Panic-attacker: -- Rust/Python/Elixir checks: -- Container checks: -- Benchmark checks: - -Findings: -- High: -- Medium: -- Low: - -Fixes Applied: -1. -2. -3. - -Validation Results: -- Tests: -- Benchmarks: -- Panic-attacker rerun: - -Artifacts: -- assail report: -- benchmark output: -- logs: - -Commit(s): -- SHA: - -Remaining Risks / Follow-ups: -1. -2. -``` - -## 12) Language-Repo Additions (Eclexia-Specific) - -Add these checks for language/compiler repositories with formal ABI/FFI constraints: - -- [x] README structure restored (index/TOC, audience paths, quickstart sanity). -- [x] Wiki split by audience (laypeople/users/developers) and linked from docs index. -- [x] Root-level clutter reduced (archive, analysis, reports relegated to `docs/` subtrees). -- [x] Machine-readable docs synchronized (`STATE.a2ml`, `META.a2ml`, `ECOSYSTEM.a2ml`, contractiles). -- [x] Human-readable docs synchronized (`README`, `QUICK_STATUS`, roadmap, wiki home). -- [x] `Mustfile` invariants present and enforceable in CI. -- [x] `Trustfile` and `Intentfile` present and complete. -- [x] FFI/ABI purity policy enforced (`*.zig` for FFI, `*.idr`/Idris2 for ABI). -- [x] `panic-attack` findings triaged with explicit severity budget for release. -- [x] Point-to-point, end-to-end, and benchmark checks wired in one quality gate. -- [x] CI workflows include quality + security + docs checks with explicit policy. -- [x] Release audit includes corrective/adaptive/perfective + Must/Should/Could. -- [x] Roadmap/status honesty pass completed (dates and current evidence updated). - -## 13) Latest Execution Record (Eclexia, 2026-02-24) - -Repo: `/tmp/eclexia-releaseprep` (branch `release-prep`, base `533ec9e9447f374135cc9e2e81021624ddb3c0ad`) - -### 13.1 Setup/Preflight - -- [x] Captured UTC timestamp and git state. -- [x] Tooling presence verified (`rg`, `git`, `jq`, `cargo`, `rustc`, `just`). -- [x] Runtime/toolchain versions captured. -- [x] Container tooling checked (`podman`, `podman-compose`). - -### 13.2 Corrective Maintenance - -- [x] Fixed `panic-attack` script path handling (`mktemp` output + local fallback binary detection). -- [x] Removed Idris `believe_me` usage from ABI wrappers. -- [x] Fixed conformance crash-noise path by skipping known intentional stack-overflow case in default runner. -- [x] Re-ran affected checks after each fix. - -### 13.3 Code-Health Scans - -- [x] TODO/FIXME/STUB/PARTIAL scan run on active code paths. -- [x] ABI/FFI file inventory run (`*.idr`, `*.zig`). -- [x] Active-code marker count reduced/triaged; remaining items tracked in release audit. - -### 13.4 Security/Panic Pass - -- [x] `panic-attack` run and triaged. -- [x] Critical findings cleared (Idris unsoundness markers removed). -- [x] Current baseline: 0 weak points (Critical 0, High 0, Medium 0, Low 0). -- [x] High/Medium backlog fully eliminated. - -### 13.5 Language Validation - -- [x] Final `just quality-gate` pass completed (docs, fmt, lint, unit, conformance, integration, p2p, e2e, bench). -- [x] Additional targeted reruns completed (`just test-conformance`, `just panic-attack`, `just docs-check`). - -### 13.6 Adaptive/Perfective/Docs - -- [x] README/wiki/docs structure and indexing restored. -- [x] Root tidy/relegation pass executed. -- [x] Roadmap/status honesty update performed with current date and evidence links. -- [x] Release audit created with corrective/adaptive/perfective + Must/Should/Could. -- [x] Full quality-gate rerun passed after hardening updates. -- [x] ABI/FFI extension lane added without breaking stable symbols (`ecl_abi_get_info`, `ecl_tracker_create_ex`, `ecl_tracker_snapshot`). -- [x] CI quality workflow now validates sibling `proven` repo presence and critical binding files. -- [x] Proven roadmap now includes explicit "critical core, not full rewrite" adoption guidance and flowchart. - -### 13.7 Outstanding Items (Explicit) - -- [x] Stable `v1.0.0` technical gate readiness met (quality + panic scan clean). -- [x] Parser/codegen/runtime panic-path hardening completed for scanner-flagged paths. -- [x] Non-eclexia `proven` library checked: already Idris2-first with Zig ABI bridge; no additional integration changes required in this run. -- [ ] Remote push blocked by token scope: GitHub rejected branch updates (`release-prep`, `release-prep-pushable`) due missing `workflow` OAuth scope. - -### 13.8 Artifacts - -- Release audit: `docs/reports/V1-READINESS-AUDIT-2026-02-24.md` -- Panic report: `/tmp/eclexia-panic-attack.KZ1jpC.json` (0 weak points) -- Final quality gate log: `/tmp/eclexia-quality-gate-final2.log` (plus post-change reruns via terminal sessions) -- Local commits: `88fa2af` (`release-prep`), `baa3d1c` (`release-prep-pushable`) + pending new commit from this pass - -## 12) LLM Operator Instructions - -Use this prompt with an LLM agent when you want the process run end-to-end: - -```text -Run the maintenance workflow for this repo using MAINTENANCE-CHECKLIST.md. - -Required behavior: -1. Run ~/Desktop/run-maintenance.sh first and collect the JSON report. -2. Triage report results by severity: fail > warn > pass. -3. Execute corrective maintenance first (fix regressions, panics, broken tests/commands). -4. Run TODO/FIXME/stub scan and address relevant items. -5. Run panic-attacker and fix findings in priority order; rerun to confirm. -6. Run language-specific checks (Rust/Python/Elixir) relevant to this repo. -7. Run benchmark/regression checks for touched hot paths. -8. Enforce permission policy: - - no group/world writable source files unless justified - - executable bit only where intended - - use .maintenance-perms-ignore for justified exceptions -9. Update docs/roadmap/checklist entries to reflect actual state. -10. Produce a final report using the template in MAINTENANCE-CHECKLIST.md. - -Constraints: -- Do not revert unrelated existing dirty changes. -- Stage and commit only scoped intended files. -- If blocked, state exactly what is blocked and why. -``` - -## 13) AI Execution Integrity Contract (Mandatory) - -Use this when delegating maintenance to any AI (Gemini/Claude/ChatGPT/etc.). - -```text -You must execute this maintenance run with strict integrity. - -Non-negotiable rules: -1. Do not claim any step is complete unless you actually ran it. -2. Do not silently skip checklist items. If skipped, state SKIPPED + exact reason. -3. For every check, provide evidence: - - command executed - - pass/fail/warn - - key output summary - - artifact/log path -4. If a command fails, stop claiming success and report the failure clearly. -5. After each fix, re-run the relevant failing check and report the rerun result. -6. Do not hide uncertainty. If unsure, say so and run additional verification. -7. Never mark “all done” while any fail/warn remains unexplained. -8. Do not make destructive or broad permission changes by default. - - permission changes must be audit-first - - use --fix-perms only with explicit intent -9. Final output must include: - - checklist coverage matrix (each item: PASS/FAIL/WARN/SKIPPED) - - unresolved risks - - exact next actions -10. Prioritize user safety and reputation: no “looks fine” claims without evidence. -``` - -Recommended enforcement line for AI prompts: - -```text -Fail closed: if evidence is missing for any checklist item, treat that item as NOT DONE. -``` - -## 14) Fleet Enrollment Automation (Gitbot + Hypatia) - -For centralized coverage across existing and new repos: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos -``` - -Optional directive write-back to repos that already have `.machine_readable/`: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just enroll-repos "$REPOS_DIR" true -``` - -Release hard gate from fleet: - -```bash -cd "$REPOS_DIR/gitbot-fleet" -just maintenance-hard-pass /absolute/path/to/repo -``` diff --git a/k9-svc/pandoc/docs/governance/README.adoc b/k9-svc/pandoc/docs/governance/README.adoc deleted file mode 100644 index 114ee94b..00000000 --- a/k9-svc/pandoc/docs/governance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Governance Pillar (TSDM) diff --git a/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml b/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml deleted file mode 100644 index 093573a0..00000000 --- a/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.a2ml +++ /dev/null @@ -1,53 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# General software development approach (machine-readable) - -[metadata] -version = "1.0.0" -last-updated = "2026-02-24" -scope = "cross-repo" -source-human = "docs/practice/SOFTWARE-DEVELOPMENT-APPROACH.adoc" - -[execution] -order = ["axis-1", "axis-2", "axis-3"] - -[axis-1] -name = "scope" -priority = "must > intend > like" -inputs = [ - "README", - "roadmap", - "status-docs", - "ci-and-security-docs", -] -marker-scan = ["TODO", "FIXME", "XXX", "HACK", "STUB", "PARTIAL"] -idris-unsound-scan = ["believe_me", "assert_total"] -output = "scoped-work-assembly" - -[axis-2] -name = "maintenance" -priority = "corrective > adaptive > perfective" -corrective = "defect/regression/safety/security fixes" -adaptive = "scope reconciliation, stale-reference removal, obsolete-work culling" -perfective = "quality improvements derived from axis-1 honest state" - -[axis-3] -name = "audit" -priority = "systems > compliance > effects" -systems = "required systems present and operating" -compliance = "exceptions explicit, bounded, and drift-resistant" -effects = "benchmark/operational impact evidence captured and reviewed" -compliance-tooling = "panic-attack" -effects-tooling = "ecological checking with sustainabot guidance" - -[cleanup-finish-off] -root-cleanup = true -stale-work-cull = true -docs-sync-human-machine = true -compliance-audit = true -effects-audit = true -release-summary = ["must", "should", "could"] -next-actions = ["corrective", "adaptive", "perfective"] - -[collaboration] -maintainer-dialogue-required = true -dialogue-topics = ["what changed", "why", "remaining risks"] diff --git a/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc b/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc deleted file mode 100644 index e8805c68..00000000 --- a/k9-svc/pandoc/docs/governance/SOFTWARE-DEVELOPMENT-APPROACH.adoc +++ /dev/null @@ -1,63 +0,0 @@ -= Software Development Approach (General) -:toc: left -:toclevels: 2 - -This is the general operating policy for software development across repositories. - -== Core Sequence - -Always run work in this order: - -1. Scope first (Axis 1) -2. Maintenance second (Axis 2) -3. Audit third (Axis 3) - -== Axis Definitions - -=== Axis 1: Scope - -Priority order: `must > intend > like` - -Axis 1 output is a scoped assembly of work based on: - -* README, roadmap, status, CI/security docs -* marker scans (`TODO`, `FIXME`, `XXX`, `HACK`, `STUB`, `PARTIAL`) -* Idris unsoundness scan when Idris exists (`believe_me`, `assert_total`) -* docs honesty check (intent vs actual implementation) - -=== Axis 2: Maintenance - -Priority order: `corrective > adaptive > perfective` - -* Corrective: fix defects, regressions, breakage, security/safety failures -* Adaptive: reconcile scope changes, remove stale references, cull obsolete work -* Perfective: improve quality/clarity/performance only from the honest Axis 1 state - -=== Axis 3: Audit - -Priority order: `systems > compliance > effects` - -* Systems: required mechanisms exist and are operating -* Compliance: seams/compromises/exceptions are explicit, bounded, and do not drift -* Effects: benchmark and operational impact evidence is captured and reviewed - -Compliance scanner baseline: `panic-attack` + -Effects/ecological baseline: sustainabot-guided ecological checking - -== Generic Cleanup And Finish-Off - -At cycle end: - -* reduce root clutter to required control/entry files -* archive/remove stale or superseded work -* synchronize human and machine docs -* run compliance and effects audits with evidence capture -* produce Must/Should/Could summary and immediate next-actions list - -== Collaboration Rule - -Effects review must include explicit maintainer dialogue: - -* what changed -* why it changed -* what risks remain diff --git a/k9-svc/pandoc/docs/governance/TSDM.a2ml b/k9-svc/pandoc/docs/governance/TSDM.a2ml deleted file mode 100644 index f27036cc..00000000 --- a/k9-svc/pandoc/docs/governance/TSDM.a2ml +++ /dev/null @@ -1,22 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [TSDM_SPEC] -id: "tsdm-standard" -version: "1.0.0" - -axes: - axis_1: - name: "Planning" - levels: ["must", "should", "could"] - axis_2: - name: "Maintenance" - levels: ["corrective", "adaptive", "perfective"] - axis_3: - name: "Audit" - levels: ["systems", "compliance", "effects"] - -invariants: - - "Every task MUST map to at least one TSDM coordinate" - - "Axis 1 priority governs resource allocation" - - "Axis 2 type governs commit categorisation" - - "Axis 3 focus governs audit depth" diff --git a/k9-svc/pandoc/docs/governance/TSDM.adoc b/k9-svc/pandoc/docs/governance/TSDM.adoc deleted file mode 100644 index cbd582c0..00000000 --- a/k9-svc/pandoc/docs/governance/TSDM.adoc +++ /dev/null @@ -1,26 +0,0 @@ -= Triaxial Software Development Methodology (TSDM) -:toc: preamble -:icons: font - -TSDM is a three-dimensional governance framework designed for high-assurance, long-lived software systems. It ensures that every project decision is mapped across three critical axes: Planning, Maintenance, and Audit. - -== The Three Axes - -=== Axis 1: Planning (Scope Priority) -* **Must:** Non-negotiable core invariants and safety requirements. -* **Should:** Essential features and planned improvements. -* **Could:** Desired enhancements and future-proofing. - -=== Axis 2: Maintenance (Execution Type) -* **Corrective:** Fixing bugs, vulnerabilities, and failures. -* **Adaptive:** Responding to environment or dependency changes. -* **Perfective:** Improving performance, refactoring, and documentation. - -=== Axis 3: Audit (Verification Focus) -* **Systems:** Integrity of tools, infrastructure, and automation. -* **Compliance:** Adherence to standards, licenses, and verified seams. -* **Effects:** Real-world impact, ecological footprint, and user feedback. - -== Integration - -TSDM is the operational core of the Rhodium Standard. Every task in the `Justfile` and every state change in `STATE.a2ml` should be justifiable within this framework. diff --git a/k9-svc/pandoc/docs/governance/audit/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/audit/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 47224869..00000000 --- a/k9-svc/pandoc/docs/governance/audit/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-audit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Audit track. diff --git a/k9-svc/pandoc/docs/governance/audit/README.adoc b/k9-svc/pandoc/docs/governance/audit/README.adoc deleted file mode 100644 index fac37404..00000000 --- a/k9-svc/pandoc/docs/governance/audit/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Audit Axis diff --git a/k9-svc/pandoc/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index b13ec695..00000000 --- a/k9-svc/pandoc/docs/governance/audit/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM compliance unit within the Audit axis. diff --git a/k9-svc/pandoc/docs/governance/audit/compliance/README.adoc b/k9-svc/pandoc/docs/governance/audit/compliance/README.adoc deleted file mode 100644 index 876954fd..00000000 --- a/k9-svc/pandoc/docs/governance/audit/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Unit diff --git a/k9-svc/pandoc/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0bccae0d..00000000 --- a/k9-svc/pandoc/docs/governance/audit/effects/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-effects" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM effects unit within the Audit axis. diff --git a/k9-svc/pandoc/docs/governance/audit/effects/README.adoc b/k9-svc/pandoc/docs/governance/audit/effects/README.adoc deleted file mode 100644 index 36347994..00000000 --- a/k9-svc/pandoc/docs/governance/audit/effects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Effects Unit diff --git a/k9-svc/pandoc/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f97bc9cc..00000000 --- a/k9-svc/pandoc/docs/governance/audit/systems/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-systems" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM systems unit within the Audit axis. diff --git a/k9-svc/pandoc/docs/governance/audit/systems/README.adoc b/k9-svc/pandoc/docs/governance/audit/systems/README.adoc deleted file mode 100644 index 8d179b4a..00000000 --- a/k9-svc/pandoc/docs/governance/audit/systems/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Systems Unit diff --git a/k9-svc/pandoc/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 8e0dff5e..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-maintenance" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Maintenance track. diff --git a/k9-svc/pandoc/docs/governance/maintenance/README.adoc b/k9-svc/pandoc/docs/governance/maintenance/README.adoc deleted file mode 100644 index 0ed2f1b5..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Axis diff --git a/k9-svc/pandoc/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 63d1a999..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/adaptive/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-adaptive" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM adaptive unit within the Maintenance axis. diff --git a/k9-svc/pandoc/docs/governance/maintenance/adaptive/README.adoc b/k9-svc/pandoc/docs/governance/maintenance/adaptive/README.adoc deleted file mode 100644 index 7b60992a..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/adaptive/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Adaptive Unit diff --git a/k9-svc/pandoc/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 05cb89da..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/corrective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-corrective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM corrective unit within the Maintenance axis. diff --git a/k9-svc/pandoc/docs/governance/maintenance/corrective/README.adoc b/k9-svc/pandoc/docs/governance/maintenance/corrective/README.adoc deleted file mode 100644 index ed904a81..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/corrective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Corrective Unit diff --git a/k9-svc/pandoc/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 832762fe..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/perfective/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-perfective" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM perfective unit within the Maintenance axis. diff --git a/k9-svc/pandoc/docs/governance/maintenance/perfective/README.adoc b/k9-svc/pandoc/docs/governance/maintenance/perfective/README.adoc deleted file mode 100644 index 8759d74d..00000000 --- a/k9-svc/pandoc/docs/governance/maintenance/perfective/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Perfective Unit diff --git a/k9-svc/pandoc/docs/governance/planning/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/planning/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 80339e77..00000000 --- a/k9-svc/pandoc/docs/governance/planning/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-axis-planning" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM Planning track. diff --git a/k9-svc/pandoc/docs/governance/planning/README.adoc b/k9-svc/pandoc/docs/governance/planning/README.adoc deleted file mode 100644 index 62aa375f..00000000 --- a/k9-svc/pandoc/docs/governance/planning/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Planning Axis diff --git a/k9-svc/pandoc/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index fc17a27d..00000000 --- a/k9-svc/pandoc/docs/governance/planning/could/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-could" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM could unit within the Planning axis. diff --git a/k9-svc/pandoc/docs/governance/planning/could/README.adoc b/k9-svc/pandoc/docs/governance/planning/could/README.adoc deleted file mode 100644 index ad5a6b82..00000000 --- a/k9-svc/pandoc/docs/governance/planning/could/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Could Unit diff --git a/k9-svc/pandoc/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0987daee..00000000 --- a/k9-svc/pandoc/docs/governance/planning/must/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-must" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM must unit within the Planning axis. diff --git a/k9-svc/pandoc/docs/governance/planning/must/README.adoc b/k9-svc/pandoc/docs/governance/planning/must/README.adoc deleted file mode 100644 index 47eb46dc..00000000 --- a/k9-svc/pandoc/docs/governance/planning/must/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Must Unit diff --git a/k9-svc/pandoc/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f492289a..00000000 --- a/k9-svc/pandoc/docs/governance/planning/should/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "governance-unit-should" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - TSDM should unit within the Planning axis. diff --git a/k9-svc/pandoc/docs/governance/planning/should/README.adoc b/k9-svc/pandoc/docs/governance/planning/should/README.adoc deleted file mode 100644 index 605489c8..00000000 --- a/k9-svc/pandoc/docs/governance/planning/should/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Should Unit diff --git a/k9-svc/pandoc/docs/legal/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/legal/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e5477983..00000000 --- a/k9-svc/pandoc/docs/legal/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "legal-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit for legal and licensing documentation. Contains framework - exhibits and archival license texts. - -canonical_locations: - exhibits: "exhibits/" - texts: "texts/" diff --git a/k9-svc/pandoc/docs/legal/EXHIBIT-A-ETHICAL-USE.txt b/k9-svc/pandoc/docs/legal/EXHIBIT-A-ETHICAL-USE.txt deleted file mode 100644 index 0b20fca2..00000000 --- a/k9-svc/pandoc/docs/legal/EXHIBIT-A-ETHICAL-USE.txt +++ /dev/null @@ -1,68 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT A — ETHICAL USE GUIDELINES -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - These guidelines define ethical use expectations for software distributed - under the Palimpsest-MPL License. They are not legally binding restrictions - but represent the community's shared values and expectations. - -2. PRINCIPLES - - 2.1. Respect for Emotional Lineage - Users and distributors should acknowledge and preserve the cultural, - narrative, and symbolic meaning embedded in Covered Software. This - includes protest traditions, cultural heritage, trauma narratives, - and community stories where documented. - - 2.2. Transparency in Automated Processing - When Covered Software is processed by Non-Interpretive Systems - (AI training, content aggregation, automated summarization), such - use should be documented publicly and not misrepresent the - provenance of outputs. - - 2.3. Good Faith Attribution - Contributors should be credited accurately. Derivative works should - maintain the attribution chain and not obscure the origins of - contributions. - - 2.4. Community Benefit - Commercial use of Covered Software should contribute to the broader - community through bug fixes, documentation, or other improvements - where feasible. - -3. SPECIFIC GUIDANCE - - 3.1. AI and Machine Learning - - Training on Covered Software requires disclosure - - Generated outputs must not claim Emotional Lineage of the original - - Model cards should reference source materials - - 3.2. Content Aggregation - - Aggregators must link back to original sources - - Context must not be stripped in ways that distort meaning - - Cultural and narrative context should be preserved - - 3.3. Commercial Products - - Products built on Covered Software should acknowledge it - - Pricing should not exploit communities that created the work - - Support and improvements should flow back to the community - -4. ENFORCEMENT - - These guidelines are enforced through community norms, not legal action. - Disputes should be raised with the Palimpsest Stewardship Council for - non-binding guidance. - -5. AMENDMENTS - - These guidelines may be updated by the Palimpsest Stewardship Council. - Updates apply to new distributions, not retroactively. - -================================================================================ -END OF EXHIBIT A -================================================================================ diff --git a/k9-svc/pandoc/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt b/k9-svc/pandoc/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt deleted file mode 100644 index 7fba8c94..00000000 --- a/k9-svc/pandoc/docs/legal/EXHIBIT-B-QUANTUM-SAFE.txt +++ /dev/null @@ -1,102 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -================================================================================ -EXHIBIT B — QUANTUM-SAFE PROVENANCE SPECIFICATION -Palimpsest-MPL License Version 1.0 -================================================================================ - -1. PURPOSE - - This exhibit specifies the cryptographic algorithms and procedures for - quantum-safe provenance in software distributed under the Palimpsest-MPL - License. - -2. APPROVED ALGORITHMS - - The following post-quantum cryptographic algorithms are approved for - signing Provenance Metadata: - - 2.1. Digital Signatures - - ML-DSA (FIPS 204, formerly CRYSTALS-Dilithium) - Recommended: ML-DSA-65 (security level 3) or ML-DSA-87 (level 5) - - SLH-DSA (FIPS 205, formerly SPHINCS+) - Recommended: SLH-DSA-SHA2-256f or SLH-DSA-SHAKE-256f - - FALCON (NIST Round 3 finalist) - Recommended: FALCON-1024 - - 2.2. Key Encapsulation (for encrypted provenance) - - ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) - Recommended: ML-KEM-1024 - - 2.3. Hash Functions - - SHA-3 (FIPS 202) - Recommended: SHA3-256 or SHA3-512 - - SHAKE (FIPS 202 extendable output) - Recommended: SHAKE-256 - - 2.4. Key Derivation - - Argon2id (RFC 9106) - Parameters: t=3, m=65536, p=4 (minimum) - -3. PROVENANCE METADATA FORMAT - - Provenance Metadata should include: - - 3.1. Required Fields - - author-identity: Contributor name and contact - - timestamp: ISO 8601 with timezone - - content-hash: SHA3-256 hash of the contribution - - signature: Quantum-safe signature over all fields - - 3.2. Optional Fields - - parent-hash: Hash of the previous contribution in the chain - - emotional-lineage: Narrative context markers - - platform: Build/development environment - - witnesses: Third-party attestation signatures - -4. SIGNATURE PROCEDURE - - 4.1. Signing - a. Compute SHA3-256 hash of the contribution content - b. Construct metadata record with all required fields - c. Serialize metadata in canonical JSON form - d. Sign with ML-DSA-65 (or approved alternative) - e. Attach signature to distribution - - 4.2. Verification - a. Extract metadata and signature from distribution - b. Verify signature against contributor's public key - c. Verify content hash matches actual content - d. Verify timestamp is within acceptable range - e. Verify parent-hash chain if present - -5. KEY MANAGEMENT - - 5.1. Contributors should publish quantum-safe public keys via: - - OpenPGP keyservers (with PQ algorithm support) - - Repository .well-known/keys/ directory - - Contributor's personal website - - 5.2. Key rotation should occur: - - At least annually - - When algorithm recommendations change - - When key compromise is suspected - -6. TRANSITION PERIOD - - During the transition to quantum-safe cryptography: - - 6.1. Classical signatures (Ed25519, RSA) remain valid - 6.2. Hybrid signatures (classical + PQ) are encouraged - 6.3. Pure PQ signatures are preferred for new contributions - 6.4. Classical-only signatures will be deprecated in a future version - -7. COMPLIANCE - - Quantum-safe provenance is OPTIONAL under PMPL-1.0. When present, - it must follow this specification. Stripping quantum-safe signatures - from distributions is prohibited per Section 4.1 of the License. - -================================================================================ -END OF EXHIBIT B -================================================================================ diff --git a/k9-svc/pandoc/docs/practice/.gitkeep b/k9-svc/pandoc/docs/practice/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/docs/practice/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/practice/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 257f3a4f..00000000 --- a/k9-svc/pandoc/docs/practice/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "practice-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit of the docs pillar focusing on practice. diff --git a/k9-svc/pandoc/docs/practice/AI-CONVENTIONS.adoc b/k9-svc/pandoc/docs/practice/AI-CONVENTIONS.adoc deleted file mode 100644 index 3d9aa304..00000000 --- a/k9-svc/pandoc/docs/practice/AI-CONVENTIONS.adoc +++ /dev/null @@ -1,85 +0,0 @@ -= AI Conventions - - - -# AI Conventions (Authoritative Source) - -All AI coding agents working in this repository MUST follow these rules. -Per-tool config files (.cursorrules, .clinerules, etc.) reference this document. - -## Session Startup - -1. Read `0-AI-MANIFEST.a2ml` FIRST (mandatory gatekeeper). -2. Read `.machine_readable/STATE.a2ml` for current status and blockers. -3. Read `.machine_readable/anchors/ANCHOR.a2ml` for canonical authority boundaries. -4. Read `.machine_readable/policies/MAINTENANCE-AXES.a2ml` for maintenance/audit sequencing. -5. Read `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` for baseline controls. -6. Read `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` for execution order. -7. Read `.machine_readable/AGENTIC.a2ml` for agent constraints. - -## License - -- All original code: **MPL-2.0** -- Fallback (platform-required only): MPL-2.0 with comment explaining why. -- NEVER use AGPL-3.0. -- Preserve third-party licenses verbatim. -- Every source file needs `# SPDX-License-Identifier: MPL-2.0`. - -## Author Attribution - -- Name: **{{AUTHOR}}** -- Email: **{{AUTHOR_EMAIL}}** -- Copyright: `Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}>` - -## State Files - -State/metadata files, anchors, and policies (.a2ml) belong in `.machine_readable/` ONLY. -NEVER create STATE.a2ml, META.a2ml, ECOSYSTEM.a2ml, AGENTIC.a2ml, -NEUROSYM.a2ml, PLAYBOOK.a2ml, ANCHOR.a2ml, MAINTENANCE-AXES.a2ml, -MAINTENANCE-CHECKLIST.a2ml, or SOFTWARE-DEVELOPMENT-APPROACH.a2ml in the repository root. - -## Banned Patterns - -| Language | Banned | Reason | -|----------|-------------------------------------|---------------------------| -| Idris2 | `believe_me`, `assert_total` | Unsound escape hatches | -| Haskell | `unsafeCoerce`, `unsafePerformIO` | Breaks type safety | -| OCaml | `Obj.magic`, `Obj.repr`, `Obj.obj` | Unsafe casting | -| Coq | `Admitted` | Unproven assumption | -| Lean | `sorry` | Unproven assumption | -| Rust | `transmute` (unless FFI + SAFETY:) | Unsound reinterpret | - -## Banned Languages - -| Banned | Use Instead | -|---------------------|--------------------| -| TypeScript | ReScript | -| Node.js / npm / bun | Deno | -| Go | Rust | -| Python | Julia / Rust | - -## Container Standard - -- Runtime: **Podman** (never Docker). -- File: **Containerfile** (never Dockerfile). -- Base images: `cgr.dev/chainguard/wolfi-base:latest` or `cgr.dev/chainguard/static:latest`. - -## ABI/FFI Standard - -- ABI definitions: **Idris2** with dependent types (`src/abi/`). -- FFI implementation: **Zig** with C ABI compatibility (`ffi/zig/`). -- Generated C headers: `generated/abi/`. - -## Build System - -Use `just` (Justfile) for all build, test, lint, and format tasks. - -## References - -- `0-AI-MANIFEST.a2ml` -- universal AI entry point -- `.machine_readable/AGENTIC.a2ml` -- agent permissions and constraints -- `.machine_readable/STATE.a2ml` -- current project state -- `.machine_readable/anchors/ANCHOR.a2ml` -- canonical authority and policy boundary -- `.machine_readable/policies/MAINTENANCE-AXES.a2ml` -- canonical axis sequencing and audit requirements -- `.machine_readable/policies/MAINTENANCE-CHECKLIST.a2ml` -- baseline maintenance checklist policy -- `.machine_readable/policies/SOFTWARE-DEVELOPMENT-APPROACH.a2ml` -- axis execution approach policy diff --git a/k9-svc/pandoc/docs/practice/README.adoc b/k9-svc/pandoc/docs/practice/README.adoc deleted file mode 100644 index ae3326b9..00000000 --- a/k9-svc/pandoc/docs/practice/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= practice Unit diff --git a/k9-svc/pandoc/docs/practice/STATE-VISUALIZER-GUIDE.adoc b/k9-svc/pandoc/docs/practice/STATE-VISUALIZER-GUIDE.adoc deleted file mode 100644 index b355b468..00000000 --- a/k9-svc/pandoc/docs/practice/STATE-VISUALIZER-GUIDE.adoc +++ /dev/null @@ -1,155 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= TOPOLOGY.md — Generation Guide -{{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> -:toc: -:sectnums: - -== What Is TOPOLOGY.md? - -A single-file visual map of any project's architecture and completion status. -It lives in the repo root and contains: - -1. **ASCII architecture diagram** — the full system as it will look when complete -2. **Completion dashboard** — every component with a progress bar and status note -3. **Dependency graph** — what blocks what (the critical path) -4. **Update protocol** — how to keep it current - -It is designed to be readable by humans, AI agents, and rendered cleanly on any -forge (GitHub, GitLab, Codeberg, Bitbucket). - -== Why - -- Gives any contributor (human or AI) an instant picture of the whole project -- Replaces "read 20 files to understand the architecture" with one glance -- The completion dashboard makes project health visible without running anything -- Works offline, no tooling required, just a text file - -== How To Generate One - -=== Option 1: Ask an AI agent - -Use this prompt (works with Claude, Gemini, ChatGPT, or any LLM with repo access): - -[source,text] ----- -Read the entire repository and produce a TOPOLOGY.md file for the repo root. - -The file must contain exactly three sections: - -1. **System Architecture** — An ASCII box diagram showing the complete system - as it will look when finished. Use Unicode box-drawing characters - (┌ ┐ └ ┘ │ ─ ├ ┤ ┬ ┴ ┼), arrows (▲ ▼ ◄ ► → ←), and double lines - (═ ║) for boundaries. Show: - - All external services (DNS, CDN, gateways) at the top - - Application components in the middle - - Data layer (databases, caches, queues) below - - Repo infrastructure (CI, contractiles, SCM files) at the bottom - - Every box labelled, every connection labelled or obvious from context - - The diagram should be BESPOKE to this project, not generic - -2. **Completion Dashboard** — A table in a code block listing every component - from the diagram. For each component show: - - Name (left-aligned, padded to 35 chars) - - Progress bar: 10 characters using █ (done) and ░ (remaining) - - Percentage (0% to 100% in 10% increments) - - A short note explaining the status - Group components by layer/concern. End with an OVERALL summary line. - -3. **Key Dependencies** — An ASCII arrow diagram showing the critical path. - What must finish before what else can start. - -Add a header comment with SPDX-License-Identifier and Last updated date. -End with an "Update Protocol" section explaining how to maintain the file. - -Use the template at TOPOLOGY.md in rsr-template-repo as a structural reference, -but make the content completely specific to THIS project. ----- - -=== Option 2: Copy the template and fill it in - -[source,bash] ----- -cp /path/to/rsr-template-repo/TOPOLOGY.md ./TOPOLOGY.md -# Then edit: replace placeholders, draw the real architecture, fill the dashboard ----- - -=== Option 3: Batch generation across all repos - -[source,bash] ----- -# From the repos root, generate for every repo that lacks one -for repo in /path/to/your/repos/*/; do - if [ ! -f "$repo/TOPOLOGY.md" ]; then - echo "NEEDS TOPOLOGY: $(basename $repo)" - fi -done ----- - -Then feed each repo to an AI agent with the prompt above. Claude Code can do -this with a session per repo, or you can batch it. - -== Conventions - -=== Box-drawing characters - -Use Unicode, not ASCII art. This renders correctly everywhere. - -[cols="1,1", options="header"] -|=== -| Character | Use -| `┌ ┐ └ ┘` | Box corners -| `│ ─` | Vertical / horizontal lines -| `├ ┤ ┬ ┴ ┼` | T-junctions and crosses -| `═ ║` | Double lines for major boundaries -| `▲ ▼ ◄ ►` | Directional arrows -| `→ ← ↑ ↓` | Thin arrows (alternative) -|=== - -=== Progress bars - -Always 10 characters wide. Use full blocks only (no half-blocks). - -[source,text] ----- -░░░░░░░░░░ 0% Not started -█░░░░░░░░░ 10% Stub/skeleton exists -██░░░░░░░░ 20% Early work -███░░░░░░░ 30% Foundation laid -████░░░░░░ 40% Core logic started -█████░░░░░ 50% Half done -██████░░░░ 60% Most logic complete -███████░░░ 70% Working but rough -████████░░ 80% Needs polish/docs -█████████░ 90% Nearly done -██████████ 100% Complete and tested ----- - -=== Component naming - -- Use the actual names from the codebase (file names, service names, tool names) -- Group by architectural layer, not alphabetically -- Include repo infrastructure (CI, contractiles, SCM files) as a layer - -=== When to update - -- After completing a component → change bar + percentage -- After adding a component → add row -- After architectural change → redraw diagram -- After major milestone → update overall percentage -- Always update the `Last updated` date - -== Integration With Other RSR Files - -TOPOLOGY.md complements but does not replace: - -- **STATE.a2ml** — machine-readable state (tasks, blockers, next actions) -- **ECOSYSTEM.a2ml** — position in the wider project ecosystem -- **META.a2ml** — architecture decisions and design rationale -- **0-AI-MANIFEST.a2ml** — AI agent entry point and invariants - -TOPOLOGY.md is the _visual summary_ for humans; the a2ml files are the -_structured data_ for tooling. Both should agree. - -== Copyright - -Copyright (c) {{CURRENT_YEAR}} {{AUTHOR}} ({{OWNER}}) <{{AUTHOR_EMAIL}}> diff --git a/k9-svc/pandoc/docs/reports/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5eb265dc..00000000 --- a/k9-svc/pandoc/docs/reports/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,19 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "reports-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation unit for all automated and manual audit reports. Classified - by domain. - -canonical_locations: - maintenance: "maintenance/" - security: "security/" - performance: "performance/" - compliance: "compliance/" - quality: "quality/" diff --git a/k9-svc/pandoc/docs/reports/README.adoc b/k9-svc/pandoc/docs/reports/README.adoc deleted file mode 100644 index 0c06c31d..00000000 --- a/k9-svc/pandoc/docs/reports/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= reports Unit diff --git a/k9-svc/pandoc/docs/reports/compliance/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/compliance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 6b397528..00000000 --- a/k9-svc/pandoc/docs/reports/compliance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-compliance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for compliance findings and evidence. diff --git a/k9-svc/pandoc/docs/reports/compliance/README.adoc b/k9-svc/pandoc/docs/reports/compliance/README.adoc deleted file mode 100644 index c38c66a4..00000000 --- a/k9-svc/pandoc/docs/reports/compliance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Compliance Reports diff --git a/k9-svc/pandoc/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 43eefe29..00000000 --- a/k9-svc/pandoc/docs/reports/maintenance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-maintenance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Maintenance reports. diff --git a/k9-svc/pandoc/docs/reports/maintenance/README.adoc b/k9-svc/pandoc/docs/reports/maintenance/README.adoc deleted file mode 100644 index f13abf79..00000000 --- a/k9-svc/pandoc/docs/reports/maintenance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Maintenance Reports diff --git a/k9-svc/pandoc/docs/reports/performance/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/performance/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 40c09540..00000000 --- a/k9-svc/pandoc/docs/reports/performance/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-performance" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for performance findings and evidence. diff --git a/k9-svc/pandoc/docs/reports/performance/README.adoc b/k9-svc/pandoc/docs/reports/performance/README.adoc deleted file mode 100644 index 037767d3..00000000 --- a/k9-svc/pandoc/docs/reports/performance/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Performance Reports diff --git a/k9-svc/pandoc/docs/reports/quality/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/quality/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d460edcf..00000000 --- a/k9-svc/pandoc/docs/reports/quality/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-quality" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for quality findings and evidence. diff --git a/k9-svc/pandoc/docs/reports/quality/README.adoc b/k9-svc/pandoc/docs/reports/quality/README.adoc deleted file mode 100644 index d1be8484..00000000 --- a/k9-svc/pandoc/docs/reports/quality/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Quality Reports diff --git a/k9-svc/pandoc/docs/reports/security/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/reports/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 696ab590..00000000 --- a/k9-svc/pandoc/docs/reports/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "report-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised repository for security findings and evidence. diff --git a/k9-svc/pandoc/docs/reports/security/README.adoc b/k9-svc/pandoc/docs/reports/security/README.adoc deleted file mode 100644 index 9a78a8bc..00000000 --- a/k9-svc/pandoc/docs/reports/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Reports diff --git a/k9-svc/pandoc/docs/standards/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/standards/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c147c6f8..00000000 --- a/k9-svc/pandoc/docs/standards/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "standards-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Standards unit for high-rigor verification. diff --git a/k9-svc/pandoc/docs/standards/README.adoc b/k9-svc/pandoc/docs/standards/README.adoc deleted file mode 100644 index 34a94c4f..00000000 --- a/k9-svc/pandoc/docs/standards/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Standards Unit diff --git a/k9-svc/pandoc/docs/templates/contractiles/README.adoc b/k9-svc/pandoc/docs/templates/contractiles/README.adoc deleted file mode 100644 index 4eeac6b8..00000000 --- a/k9-svc/pandoc/docs/templates/contractiles/README.adoc +++ /dev/null @@ -1,11 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= Contractile Templates - -Blank templates for projects that want to replace the hyperpolymath -defaults with their own contractile definitions. - -Copy the relevant file to `.machine_readable/contractiles//` -and fill in your project-specific checks. - -The working examples in `.machine_readable/contractiles/` show the -full hyperpolymath setup — use those as reference. diff --git a/k9-svc/pandoc/docs/templates/contractiles/dust/Dustfile.a2ml b/k9-svc/pandoc/docs/templates/contractiles/dust/Dustfile.a2ml deleted file mode 100644 index 903af2c3..00000000 --- a/k9-svc/pandoc/docs/templates/contractiles/dust/Dustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/dust/Dustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's DUST contract goes here] -@end diff --git a/k9-svc/pandoc/docs/templates/contractiles/intend/Intentfile.a2ml b/k9-svc/pandoc/docs/templates/contractiles/intend/Intentfile.a2ml deleted file mode 100644 index c54c79a8..00000000 --- a/k9-svc/pandoc/docs/templates/contractiles/intend/Intentfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Intentfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/intend/Intentfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's INTEND contract goes here] -@end diff --git a/k9-svc/pandoc/docs/templates/contractiles/must/Mustfile.a2ml b/k9-svc/pandoc/docs/templates/contractiles/must/Mustfile.a2ml deleted file mode 100644 index d08796f9..00000000 --- a/k9-svc/pandoc/docs/templates/contractiles/must/Mustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/must/Mustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's MUST contract goes here] -@end diff --git a/k9-svc/pandoc/docs/templates/contractiles/trust/Trustfile.a2ml b/k9-svc/pandoc/docs/templates/contractiles/trust/Trustfile.a2ml deleted file mode 100644 index 842c6b06..00000000 --- a/k9-svc/pandoc/docs/templates/contractiles/trust/Trustfile.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Trustfile.a2ml — BLANK TEMPLATE -# Replace this with your project's contractile. -# See .machine_readable/contractiles/ for a working example. -# -# Copy this file to .machine_readable/contractiles/trust/Trustfile.a2ml -# and fill in your project-specific checks. - -@abstract: -[Your project's TRUST contract goes here] -@end diff --git a/k9-svc/pandoc/docs/theory/.gitkeep b/k9-svc/pandoc/docs/theory/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/docs/theory/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 93df1870..00000000 --- a/k9-svc/pandoc/docs/theory/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for domain-specific theory and research foundations. - Categorised by discipline. - -canonical_locations: - ontologies: "ontologies/" - mathematics: "mathematics/" - computing: "computing/" - socio_technical: "socio-technical/" - formalisms: "formalisms/" - other: "other/" - -invariants: - - "Theoretical claims MUST reference established academic or technical formalisms" diff --git a/k9-svc/pandoc/docs/theory/README.adoc b/k9-svc/pandoc/docs/theory/README.adoc deleted file mode 100644 index c0ddf280..00000000 --- a/k9-svc/pandoc/docs/theory/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= theory Unit diff --git a/k9-svc/pandoc/docs/theory/computing/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/computing/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f387d08e..00000000 --- a/k9-svc/pandoc/docs/theory/computing/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-computing" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for computing. diff --git a/k9-svc/pandoc/docs/theory/computing/README.adoc b/k9-svc/pandoc/docs/theory/computing/README.adoc deleted file mode 100644 index 4d0db25d..00000000 --- a/k9-svc/pandoc/docs/theory/computing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Computing Theory diff --git a/k9-svc/pandoc/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index cdc2baa1..00000000 --- a/k9-svc/pandoc/docs/theory/formalisms/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-formalisms" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for formalisms. diff --git a/k9-svc/pandoc/docs/theory/formalisms/README.adoc b/k9-svc/pandoc/docs/theory/formalisms/README.adoc deleted file mode 100644 index 5d064c39..00000000 --- a/k9-svc/pandoc/docs/theory/formalisms/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Formalisms Theory diff --git a/k9-svc/pandoc/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 677a4dac..00000000 --- a/k9-svc/pandoc/docs/theory/mathematics/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-mathematics" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for mathematics. diff --git a/k9-svc/pandoc/docs/theory/mathematics/README.adoc b/k9-svc/pandoc/docs/theory/mathematics/README.adoc deleted file mode 100644 index 356236f4..00000000 --- a/k9-svc/pandoc/docs/theory/mathematics/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Mathematics Theory diff --git a/k9-svc/pandoc/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index d888cee5..00000000 --- a/k9-svc/pandoc/docs/theory/ontologies/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-ontologies" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for ontologies. diff --git a/k9-svc/pandoc/docs/theory/ontologies/README.adoc b/k9-svc/pandoc/docs/theory/ontologies/README.adoc deleted file mode 100644 index 6d16ecf9..00000000 --- a/k9-svc/pandoc/docs/theory/ontologies/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ontologies Theory diff --git a/k9-svc/pandoc/docs/theory/other/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/other/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 166ed9e8..00000000 --- a/k9-svc/pandoc/docs/theory/other/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-other" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for other. diff --git a/k9-svc/pandoc/docs/theory/other/README.adoc b/k9-svc/pandoc/docs/theory/other/README.adoc deleted file mode 100644 index 1861d6d5..00000000 --- a/k9-svc/pandoc/docs/theory/other/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Other Theory diff --git a/k9-svc/pandoc/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 89195222..00000000 --- a/k9-svc/pandoc/docs/theory/socio-technical/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "theory-unit-socio-technical" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Theoretical foundation for socio technical. diff --git a/k9-svc/pandoc/docs/theory/socio-technical/README.adoc b/k9-svc/pandoc/docs/theory/socio-technical/README.adoc deleted file mode 100644 index 9ab4ee07..00000000 --- a/k9-svc/pandoc/docs/theory/socio-technical/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Socio technical Theory diff --git a/k9-svc/pandoc/docs/whitepapers/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/whitepapers/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c936101d..00000000 --- a/k9-svc/pandoc/docs/whitepapers/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Unit for strategic publications and whitepapers. Categorised by target - audience: Academic, Industry, and Outreach. - -canonical_locations: - academic: "academic/" - industry: "industry/" - outreach: "outreach/" - -invariants: - - "Each sub-track MUST have a clear audience definition in its README" diff --git a/k9-svc/pandoc/docs/whitepapers/README.adoc b/k9-svc/pandoc/docs/whitepapers/README.adoc deleted file mode 100644 index 88e83c5e..00000000 --- a/k9-svc/pandoc/docs/whitepapers/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= whitepapers Unit diff --git a/k9-svc/pandoc/docs/whitepapers/academic/.gitkeep b/k9-svc/pandoc/docs/whitepapers/academic/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ceb8a1e7..00000000 --- a/k9-svc/pandoc/docs/whitepapers/academic/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "academic-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Academic logic at level 3. diff --git a/k9-svc/pandoc/docs/whitepapers/academic/README.adoc b/k9-svc/pandoc/docs/whitepapers/academic/README.adoc deleted file mode 100644 index 16c3f453..00000000 --- a/k9-svc/pandoc/docs/whitepapers/academic/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Academic Logic diff --git a/k9-svc/pandoc/docs/whitepapers/industry/.gitkeep b/k9-svc/pandoc/docs/whitepapers/industry/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 20156dd5..00000000 --- a/k9-svc/pandoc/docs/whitepapers/industry/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "industry-unit" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Industry logic at level 3. diff --git a/k9-svc/pandoc/docs/whitepapers/industry/README.adoc b/k9-svc/pandoc/docs/whitepapers/industry/README.adoc deleted file mode 100644 index 7bc7fcd6..00000000 --- a/k9-svc/pandoc/docs/whitepapers/industry/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Industry Logic diff --git a/k9-svc/pandoc/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index ed7e1529..00000000 --- a/k9-svc/pandoc/docs/whitepapers/outreach/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "whitepapers-track-outreach" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Documentation track for outreach, education, and general-audience - engagement. Focuses on accessibility and high-level conceptual clarity. - -invariants: - - "Language MUST be accessible to non-technical audiences" - - "Avoid deep technical jargon without providing clear definitions" diff --git a/k9-svc/pandoc/docs/whitepapers/outreach/README.adoc b/k9-svc/pandoc/docs/whitepapers/outreach/README.adoc deleted file mode 100644 index 8141463f..00000000 --- a/k9-svc/pandoc/docs/whitepapers/outreach/README.adoc +++ /dev/null @@ -1,17 +0,0 @@ -= Outreach & Education -:toc: preamble -:icons: font - -This directory contains whitepapers, guides, and presentations tailored for a general audience, including schools, corporate partners, and special interest groups. - -== Target Audiences - -* **Schools & Education:** Introductory material on formal verification and sovereign systems. -* **Corporate:** High-level business value and compliance summaries. -* **Special Interest Groups:** Community-specific impact and ethical use cases. - -== Goals - -* De-mystify high-rigor engineering. -* Promote the adoption of the Rhodium Standard. -* Provide accessible entry points for non-technical stakeholders. diff --git a/k9-svc/pandoc/docs/wikis/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/docs/wikis/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f071ca8a..00000000 --- a/k9-svc/pandoc/docs/wikis/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "wikis-track" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Long-form collaborative documentation and project knowledge base. - This directory mirrors the content structure of the project wiki. - -invariants: - - "Primary wiki format MUST be AsciiDoc (.adoc)" diff --git a/k9-svc/pandoc/docs/wikis/README.adoc b/k9-svc/pandoc/docs/wikis/README.adoc deleted file mode 100644 index 71b60d1b..00000000 --- a/k9-svc/pandoc/docs/wikis/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -= Project Wikis -:toc: preamble -:icons: font - -This directory contains the source files for the project wiki. It is intended for long-form documentation, deep-dives, and community-maintained knowledge. - -== Structure - -* **Core Concepts:** Fundamental architectural ideas. -* **Workflows:** Step-by-step guides for contributors. -* **Glossary:** Definitions of project-specific terminology. - -== Wiki Synchronization - -Changes made here should be synchronised with the forge-hosted wiki (GitHub/GitLab) using the project's sync scripts. diff --git a/k9-svc/pandoc/examples/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/examples/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 0d69c905..00000000 --- a/k9-svc/pandoc/examples/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: examples diff --git a/k9-svc/pandoc/examples/README.adoc b/k9-svc/pandoc/examples/README.adoc deleted file mode 100644 index b9cdb487..00000000 --- a/k9-svc/pandoc/examples/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= examples Pillar diff --git a/k9-svc/pandoc/examples/web-project-deno.json b/k9-svc/pandoc/examples/web-project-deno.json deleted file mode 100644 index 028e4f1a..00000000 --- a/k9-svc/pandoc/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/{{OWNER}}/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/k9-svc/pandoc/features/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/features/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index dc3e4ee3..00000000 --- a/k9-svc/pandoc/features/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "features-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Optional project features and ecosystem integrations. Provides bootstrap - guides for high-rigor tools (Panic-Attacker, BoJ-Server, SSGs). - -canonical_locations: - panic_attacker: "panic-attacker/" - boj_server: "boj-server/" - ssg: "ssg/" diff --git a/k9-svc/pandoc/features/README.adoc b/k9-svc/pandoc/features/README.adoc deleted file mode 100644 index 3899280c..00000000 --- a/k9-svc/pandoc/features/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Project Features diff --git a/k9-svc/pandoc/features/boj-server/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/features/boj-server/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index c77798cd..00000000 --- a/k9-svc/pandoc/features/boj-server/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-boj-server" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the boj-server ecosystem component. diff --git a/k9-svc/pandoc/features/boj-server/README.adoc b/k9-svc/pandoc/features/boj-server/README.adoc deleted file mode 100644 index 0039c37d..00000000 --- a/k9-svc/pandoc/features/boj-server/README.adoc +++ /dev/null @@ -1,14 +0,0 @@ -= BoJ Server Integration -:icons: font - -This unit provides a "starting hand" for integrating with the **BoJ-Server** (Box of Justice) ecosystem — a high-rigor, verified server infrastructure. - -== Integration Options - -* **Core:** Use BoJ-Server as the primary verified backend for this project. -* **Bridge:** Utilize the BoJ-Server IPC bridge for cross-boundary communication. - -== Related Repository - -For the full specification and source, visit: -https://github.com/hyperpolymath/boj-server diff --git a/k9-svc/pandoc/features/panic-attacker/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/features/panic-attacker/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e61ad244..00000000 --- a/k9-svc/pandoc/features/panic-attacker/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-panic-attacker" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the panic-attacker ecosystem component. diff --git a/k9-svc/pandoc/features/panic-attacker/README.adoc b/k9-svc/pandoc/features/panic-attacker/README.adoc deleted file mode 100644 index 72d56a42..00000000 --- a/k9-svc/pandoc/features/panic-attacker/README.adoc +++ /dev/null @@ -1,25 +0,0 @@ -= Panic Attacker Feature -:icons: font - -This unit integrates the **Panic-Attacker** high-rigor stress testing tool into the project lifecycle. - -== Value Proposition - -Panic-Attacker goes beyond unit testing by applying: -* **Static Analysis (Assail):** Detecting logic-based bug signatures. -* **Multi-Axis Dynamic Attacks (Assault):** Stressing CPU, Memory, Disk, and Network boundaries. - -== Usage in this Template - -This template includes a pre-configured maintenance trigger: - -[source,bash] ----- -just maint-assault ----- - -This runs a medium-intensity assault on the project binary and emits a report to `docs/reports/security/`. - -== Related Repository - -https://github.com/hyperpolymath/panic-attacker diff --git a/k9-svc/pandoc/features/ssg/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/features/ssg/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 121c5ae2..00000000 --- a/k9-svc/pandoc/features/ssg/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "feature-unit-ssg" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Bootstrap and integration logic for the ssg ecosystem component. diff --git a/k9-svc/pandoc/features/ssg/README.adoc b/k9-svc/pandoc/features/ssg/README.adoc deleted file mode 100644 index e15687bf..00000000 --- a/k9-svc/pandoc/features/ssg/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Ssg Feature diff --git a/k9-svc/pandoc/features/ssg/ssg-bootstrap.sh b/k9-svc/pandoc/features/ssg/ssg-bootstrap.sh deleted file mode 100755 index 89c6fa5f..00000000 --- a/k9-svc/pandoc/features/ssg/ssg-bootstrap.sh +++ /dev/null @@ -1,48 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# -# ssg-bootstrap.sh — Universal SSG Initialisation Helper -# -# Provides a starting hand for creating a documentation site or blog -# using hyperpolymath-approved formal or pretty-formal SSGs. - -set -euo pipefail - -echo "═══════════════════════════════════════════════════" -echo " SSG BOOTSTRAP HELPER" -echo "═══════════════════════════════════════════════════" -echo "" -echo "Select an SSG to initialize in this project:" -echo " [1] Casket-SSG (Haskell) — Pretty-formal, high-rigor default" -echo " [2] Ddraig-SSG (Idris2) — Super-formal, dependent-type proofed" -echo " [3] Serum-SSG (Elixir) — Concurrent, robust, BEAM-based" -echo " [4] Zola (Rust) — Fast, standalone, standard" -echo "" - -read -rp "Enter choice [1-4]: " choice - -case "$choice" in - 1) - echo "Selected: Casket-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/casket-ssg docs/site" - ;; - 2) - echo "Selected: Ddraig-SSG" - echo "Integration: git clone https://github.com/hyperpolymath/ddraig-ssg docs/site" - ;; - 3) - echo "Selected: Serum-SSG" - echo "Integration: mix serum.new docs/site" - ;; - 4) - echo "Selected: Zola" - echo "Integration: zola init docs/site" - ;; - *) - echo "Invalid selection. Aborting." - exit 1 - ;; -esac - -echo "" -echo "Note: For more advanced polystack options, visit: https://github.com/hyperpolymath/polystack" diff --git a/k9-svc/pandoc/k9-filter.lua b/k9-svc/pandoc/k9-filter.lua deleted file mode 100644 index 805a3e09..00000000 --- a/k9-svc/pandoc/k9-filter.lua +++ /dev/null @@ -1,406 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) --- --- k9-filter.lua — Pandoc Lua filter for K9 Self-Validating Component documents. --- --- Provides post-processing passes over the Pandoc AST produced by the --- K9 reader (k9.lua). Designed to run as a filter (--lua-filter): --- --- pandoc -f k9.lua input.k9.ncl --lua-filter=k9-filter.lua -o output.html --- --- Capabilities: --- 1. Security badge colouring: Kennel=green, Yard=amber, Hunt=red --- 2. Contract highlighting: Nickel contract annotations get distinct styling --- 3. Recipe validation: check recipe commands reference real tools --- 4. Pedigree completeness: warn if name/version/description missing --- --- Extensions table: --- +smart (typographic quotes) --- +includes (file inclusion) --- +diagrams (render diagrams) --- +validate (structural validation) --- --- Spec: /standards/k9-svc/SPEC.adoc - --- ============================================================================ --- Configuration --- ============================================================================ - ---- Security level colour map for badge rendering. -local SECURITY_COLOURS = { - kennel = { bg = "#2d6a2e", fg = "#ffffff", border = "#1a4d1b", label = "Kennel" }, - yard = { bg = "#b8860b", fg = "#ffffff", border = "#8b6508", label = "Yard" }, - hunt = { bg = "#c0392b", fg = "#ffffff", border = "#962d22", label = "Hunt" }, -} - ---- Known tools that K9 recipes commonly reference. Used for recipe validation. -local KNOWN_TOOLS = { - -- System tools - "bash", "sh", "zsh", "env", - -- Package managers - "deno", "cargo", "gleam", "mix", "opam", "cabal", "stack", "julia", - "pip", "npm", "bun", "pnpm", "yarn", "apt", "dnf", "rpm-ostree", - "nix", "guix", "brew", - -- Container tools - "podman", "docker", "buildah", "skopeo", - -- Build tools - "make", "just", "cmake", "meson", "ninja", "zig", - -- Version control - "git", "gh", "glab", - -- Utilities - "curl", "wget", "jq", "yq", "sed", "awk", "grep", "find", - "tar", "gzip", "unzip", "cp", "mv", "rm", "mkdir", "chmod", - "cat", "echo", "printf", "test", "true", "false", - -- Security - "cosign", "rekor-cli", "syft", "grype", "trivy", "trufflehog", - -- K9-specific - "k9-scan", "k9-sign", "panic-attack", "nickel", - -- Language runtimes - "node", "python", "python3", "ruby", "elixir", "erl", "idris2", -} - ---- Convert KNOWN_TOOLS to a set for O(1) lookup. -local known_tools_set = {} -for _, tool in ipairs(KNOWN_TOOLS) do - known_tools_set[tool] = true -end - ---- Extension flags. Users can override via metadata (k9-validate: false, etc.) -local ext = { - smart = true, - includes = true, - diagrams = true, - validate = true, -} - ---- Track detected security level for badge rendering. -local security_level = nil - ---- Track pedigree fields found. -local pedigree_fields = { - name = false, - version = false, - description = false, -} - --- ============================================================================ --- Utility helpers --- ============================================================================ - ---- Issue a warning message via pandoc's logging facility. -local function warn(msg) - if pandoc.log and pandoc.log.warn then - pandoc.log.warn(msg) - else - io.stderr:write("WARNING [k9-filter]: " .. msg .. "\n") - end -end - ---- Read extension flags from document metadata. -local function read_extension_flags(meta) - for key, _ in pairs(ext) do - local meta_key = "k9-" .. key - if meta[meta_key] ~= nil then - local val = meta[meta_key] - if type(val) == "boolean" then - ext[key] = val - elseif pandoc.utils.type(val) == "MetaBool" then - ext[key] = val - end - end - end -end - --- ============================================================================ --- Filter 1: Security badge colouring --- ============================================================================ - ---- Detect the security level from document metadata and apply colour-coded ---- badge styling to Span elements with class "k9-security-badge". ---- Renders as inline HTML with background colour matching the trust level: ---- Kennel = green (safe, pure data) ---- Yard = amber (contracts, types, moderate trust) ---- Hunt = red (subprocess, network, full trust required) -local function colour_security_badges(span) - if span.t ~= "Span" then return nil end - - local is_badge = false - local level_class = nil - for _, cls in ipairs(span.attr.classes) do - if cls == "k9-security-badge" then - is_badge = true - end - if cls == "k9-kennel" then level_class = "kennel" end - if cls == "k9-yard" then level_class = "yard" end - if cls == "k9-hunt" then level_class = "hunt" end - end - - if not is_badge then return nil end - - -- Use detected level if not specified by class - local level = level_class or (security_level and security_level:lower()) or "kennel" - local colours = SECURITY_COLOURS[level] or SECURITY_COLOURS.kennel - - -- Build inline-styled HTML badge - local badge_html = string.format( - '%s', - level, - colours.bg, colours.fg, colours.border, - pandoc.utils.stringify(span.content) - ) - - return pandoc.RawInline("html", badge_html) -end - --- ============================================================================ --- Filter 2: Contract highlighting --- ============================================================================ - ---- Apply distinct styling to Nickel contract annotations. These appear as ---- Span elements with class "k9-contract" (produced by the K9 reader). ---- Renders contracts in monospace with a type-colour scheme. -local function highlight_contracts(span) - if span.t ~= "Span" then return nil end - - local is_contract = false - for _, cls in ipairs(span.attr.classes) do - if cls == "k9-contract" then - is_contract = true - break - end - end - if not is_contract then return nil end - - local contract_text = pandoc.utils.stringify(span.content) - - -- Determine colour based on contract type - local colour = "#6c3483" -- default: purple for type contracts - if contract_text:find("String") or contract_text:find("Str") then - colour = "#27ae60" -- green for strings - elseif contract_text:find("Number") or contract_text:find("Num") or - contract_text:find("Integer") then - colour = "#2980b9" -- blue for numbers - elseif contract_text:find("Bool") then - colour = "#e67e22" -- orange for booleans - elseif contract_text:find("Array") or contract_text:find("List") then - colour = "#8e44ad" -- deep purple for collections - elseif contract_text:find("Record") or contract_text:find("{") then - colour = "#2c3e50" -- dark blue for records - end - - local html = string.format( - '%s', - colour, - contract_text - ) - - return pandoc.RawInline("html", html) -end - --- ============================================================================ --- Filter 3: Recipe validation --- ============================================================================ - ---- Validate that recipe command blocks reference known tools. Recipes are ---- typically code blocks inside sections headed "recipes", "install", ---- "validate", "deploy", "migrate", etc. ---- ---- Checks the first word of each line in recipe code blocks against the ---- known tools list. Warns on unrecognised commands. -local function validate_recipes(codeblock) - if codeblock.t ~= "CodeBlock" then return nil end - if not ext.validate then return nil end - - -- Check if this looks like a recipe block (class or surrounding context) - local is_recipe = false - for _, cls in ipairs(codeblock.attr.classes) do - if cls == "bash" or cls == "sh" or cls == "shell" or - cls == "k9-recipe" or cls == "nickel" then - is_recipe = true - break - end - end - - -- Also check for recipe-like content (lines starting with commands) - if not is_recipe then - local text = codeblock.text - if text:find("^%s*#!/") or text:find("^%s*set %-") then - is_recipe = true - end - end - - if not is_recipe then return nil end - - -- Extract and validate commands - local unknown_commands = {} - for line in codeblock.text:gmatch("[^\n]+") do - -- Skip comments, blank lines, variable assignments, control flow - local trimmed = line:match("^%s*(.-)%s*$") - if trimmed ~= "" and - not trimmed:match("^#") and - not trimmed:match("^%w+=") and - not trimmed:match("^if%s") and - not trimmed:match("^then") and - not trimmed:match("^else") and - not trimmed:match("^fi") and - not trimmed:match("^for%s") and - not trimmed:match("^do") and - not trimmed:match("^done") and - not trimmed:match("^while") and - not trimmed:match("^case") and - not trimmed:match("^esac") and - not trimmed:match("^%%") and - not trimmed:match("^{") and - not trimmed:match("^}") then - - -- Extract the command name (first word, strip env/sudo prefixes) - local cmd = trimmed:match("^(%S+)") - if cmd then - -- Strip common prefixes - if cmd == "sudo" or cmd == "env" then - cmd = trimmed:match("^%S+%s+(%S+)") - end - -- Strip path prefixes - if cmd then - cmd = cmd:match("([^/]+)$") or cmd - end - - if cmd and not known_tools_set[cmd] then - unknown_commands[cmd] = true - end - end - end - end - - -- Warn about unrecognised commands - for cmd, _ in pairs(unknown_commands) do - warn("Recipe references unknown tool: '" .. cmd .. - "' — verify this is available in the target environment") - end - - return nil -- do not modify the block -end - --- ============================================================================ --- Filter 4: Pedigree completeness --- ============================================================================ - ---- Check that the K9 pedigree contains the required fields: name, version, ---- and description. Issues warnings for any missing fields. -local function check_pedigree_completeness(meta) - if not ext.validate then return meta end - - -- Check metadata fields set by the K9 reader - if meta["title"] then - pedigree_fields.name = true - end - if meta["version"] then - pedigree_fields.version = true - end - -- Description is not always in metadata; check blocks later - - return meta -end - ---- Scan blocks for pedigree description content. -local function scan_pedigree_blocks(doc) - if not ext.validate then return doc end - - -- Scan pedigree Div for description - for _, block in ipairs(doc.blocks) do - if block.t == "Div" then - for _, cls in ipairs(block.attr.classes) do - if cls == "k9-pedigree" then - local text = pandoc.utils.stringify(block.content) - if text:find("Description") then - pedigree_fields.description = true - end - end - end - end - end - - -- Issue warnings for missing fields - local missing = {} - for field, found in pairs(pedigree_fields) do - if not found then - table.insert(missing, field) - end - end - - if #missing > 0 then - warn("K9 pedigree is incomplete. Missing fields: " .. - table.concat(missing, ", ")) - end - - return doc -end - --- ============================================================================ --- Filter pipeline --- ============================================================================ - ---- Pandoc runs filter traversals in the order listed in the returned table. -return { - -- Pass 1: Read config, detect security level, check pedigree metadata - { - Pandoc = function(doc) - read_extension_flags(doc.meta) - - -- Detect security level from metadata - local level = doc.meta["k9-security-level"] - if level then - security_level = pandoc.utils.stringify(level) - end - - doc.meta = check_pedigree_completeness(doc.meta) - return doc - end, - }, - - -- Pass 2: Apply badge colours, contract highlighting, recipe validation - { - Span = function(span) - -- Try badge colouring first, then contract highlighting - local result = colour_security_badges(span) - if result then return result end - return highlight_contracts(span) - end, - CodeBlock = validate_recipes, - }, - - -- Pass 3: Scan for pedigree completeness - { - Pandoc = scan_pedigree_blocks, - }, -} - --- ============================================================================ --- Extensions table --- ============================================================================ - ---- Extensions advertised by this filter. Informational for tooling. -Extensions = { - smart = true, -- Typographic quotes (SmartyPants) - includes = true, -- File inclusion support - diagrams = true, -- Diagram rendering (mermaid, graphviz) - validate = true, -- Structural validation (pedigree, recipes, SPDX) -} diff --git a/k9-svc/pandoc/k9-reader.lua b/k9-svc/pandoc/k9-reader.lua deleted file mode 100644 index 3938409b..00000000 --- a/k9-svc/pandoc/k9-reader.lua +++ /dev/null @@ -1,92 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) --- --- k9-reader.lua — Pandoc custom reader for K9 (Self-Validating Components) --- --- Parses .k9.ncl files into Pandoc's internal AST for documentation --- generation. K9 files are Nickel configuration with a specific schema — --- this reader extracts the structured metadata and presents it as --- human-readable documentation. --- --- Usage: --- pandoc -f k9-reader.lua component.k9.ncl -o docs.html --- pandoc -f k9-reader.lua component.k9.ncl -t markdown --- --- Media type: application/vnd.k9+nickel (IANA registration pending) - -function Reader(input, reader_options) - local source = tostring(input) - local blocks = {} - - -- Extract key-value pairs from Nickel-style config - local name = source:match('name%s*=%s*"(.-)"') or "Unknown Component" - local version = source:match('version%s*=%s*"(.-)"') or "0.0.0" - local description = source:match('description%s*=%s*"(.-)"') or "" - local author = source:match('author%s*=%s*"(.-)"') or "" - local trust_level = source:match("trust_level%s*=%s*'(%w+)") or "Kennel" - - -- Security settings - local allow_network = source:match("allow_network%s*=%s*(%w+)") or "false" - local allow_fs_write = source:match("allow_filesystem_write%s*=%s*(%w+)") or "false" - local allow_subprocess = source:match("allow_subprocess%s*=%s*(%w+)") or "false" - - -- Title - table.insert(blocks, pandoc.Header(1, pandoc.Inlines("K9 Component: " .. name))) - - -- Metadata table - table.insert(blocks, pandoc.Header(2, pandoc.Inlines("Metadata"))) - local meta_items = { - { pandoc.Plain(pandoc.Inlines("**Version:** " .. version)) }, - { pandoc.Plain(pandoc.Inlines("**Author:** " .. author)) }, - { pandoc.Plain(pandoc.Inlines("**Security Level:** " .. trust_level:upper())) }, - } - if description ~= "" then - table.insert(meta_items, 1, - { pandoc.Plain(pandoc.Inlines("**Description:** " .. description)) }) - end - table.insert(blocks, pandoc.BulletList(meta_items)) - - -- Security profile - table.insert(blocks, pandoc.Header(2, pandoc.Inlines("Security Profile"))) - local security_items = { - { pandoc.Plain(pandoc.Inlines("Network access: " .. allow_network)) }, - { pandoc.Plain(pandoc.Inlines("Filesystem write: " .. allow_fs_write)) }, - { pandoc.Plain(pandoc.Inlines("Subprocess execution: " .. allow_subprocess)) }, - } - table.insert(blocks, pandoc.BulletList(security_items)) - - -- Security level explanation - local level_desc = "" - if trust_level == "Kennel" then - level_desc = "Data-only. No execution capabilities. Strict sandbox." - elseif trust_level == "Yard" then - level_desc = "Nickel evaluation with limited I/O. Capability-based sandbox." - elseif trust_level == "Hunt" then - level_desc = "Full execution with shell commands. Signature REQUIRED. Minimal sandbox." - end - if level_desc ~= "" then - table.insert(blocks, pandoc.Para(pandoc.Inlines( - pandoc.Emph(pandoc.Inlines(level_desc))))) - end - - -- Recipes (if present) - local recipes_found = false - for recipe_name, recipe_cmd in source:gmatch('(%w+)%s*=%s*"(.-)"') do - if recipe_name == "install" or recipe_name == "validate" or - recipe_name == "deploy" or recipe_name == "migrate" or - recipe_name == "rollback" then - if not recipes_found then - table.insert(blocks, pandoc.Header(2, pandoc.Inlines("Recipes"))) - recipes_found = true - end - table.insert(blocks, pandoc.Header(3, pandoc.Inlines(recipe_name))) - table.insert(blocks, pandoc.CodeBlock(recipe_cmd, pandoc.Attr("", { "bash" }))) - end - end - - -- Raw source (for reference) - table.insert(blocks, pandoc.Header(2, pandoc.Inlines("Source"))) - table.insert(blocks, pandoc.CodeBlock(source, pandoc.Attr("", { "nickel" }))) - - return pandoc.Pandoc(blocks) -end diff --git a/k9-svc/pandoc/k9-writer.lua b/k9-svc/pandoc/k9-writer.lua deleted file mode 100644 index a191a4e2..00000000 --- a/k9-svc/pandoc/k9-writer.lua +++ /dev/null @@ -1,255 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) --- --- k9-writer.lua — Pandoc custom writer for K9 (Self-Validating Components) --- --- Converts Pandoc's internal AST to K9 Nickel format (.k9.ncl). --- Produces valid Nickel configuration with the K9 schema structure: --- - Pedigree metadata (name, version, description, author) --- - Security level (Kennel/Yard/Hunt) with permission flags --- - Target platform configuration --- - Recipes (install, validate, deploy, migrate) --- - Configuration records --- --- Usage: --- pandoc input.md -t k9-writer.lua -o component.k9.ncl --- pandoc input.html -t k9-writer.lua --- pandoc input.json -t k9-writer.lua -o config.k9.ncl --- --- Round-trip: pandoc -f k9.lua input.k9.ncl -t k9-writer.lua -o roundtrip.k9.ncl --- --- Media type: application/vnd.k9+nickel (IANA registration pending) --- Spec: /standards/k9-svc/SPEC.adoc - ---- Writer entry point. Pandoc calls this with the full document AST. ---- Returns a string containing the K9 Nickel output. -function Writer(doc, opts) - local buffer = {} - local function add(s) table.insert(buffer, s) end - - -- SPDX header - add("# SPDX-License-Identifier: AGPL-3.0-or-later") - - -- Extract metadata from the document - local meta = doc.meta or {} - local title = meta_string(meta, "title") or "untitled" - local version = meta_string(meta, "version") or "0.1.0" - local security = meta_string(meta, "k9-security-level") or "Kennel" - local spdx = meta_string(meta, "spdx-license") or "PMPL-1.0-or-later" - - add("") - - -- Track which sections we've seen to build the K9 structure - local current_section = nil - local sections = {} - local pedigree = {} - local recipes = {} - local config_entries = {} - - -- Walk the document blocks and extract structured data - for _, block in ipairs(doc.blocks) do - if block.t == "Header" then - current_section = render_inlines(block.content):lower():gsub("%s+", "_") - - elseif block.t == "BulletList" and current_section then - -- Extract key-value pairs from bullet lists - for _, item in ipairs(block.content) do - local text = "" - for _, b in ipairs(item) do - text = text .. render_block_inline(b) - end - local key, value = text:match("^%*%*(.-)%*%*:%s*(.+)$") - if key and value then - if current_section:match("pedigree") or current_section:match("metadata") then - pedigree[key:lower()] = value - elseif current_section:match("security") then - config_entries[key:lower():gsub("%s+", "_")] = value - end - end - end - - elseif block.t == "CodeBlock" and current_section then - -- Recipe code blocks - if current_section:match("recipe") or current_section:match("install") or - current_section:match("validate") or current_section:match("deploy") then - local recipe_name = current_section:gsub("recipes?_?", ""):gsub("^_", "") - if recipe_name == "" then recipe_name = "validate" end - recipes[recipe_name] = block.text - end - - elseif block.t == "DefinitionList" then - -- K9 definition lists become record fields - for _, item in ipairs(block.content) do - local term = item[1] - local defs = item[2] - local key = render_inlines(term):match("`(.-)`") or render_inlines(term) - local value = "" - if defs and #defs > 0 and #defs[1] > 0 then - value = render_block_inline(defs[1][1]) - end - if key and key ~= "" then - config_entries[key] = value - end - end - end - end - - -- Generate K9 Nickel output - add("") - add("# K9 Self-Validating Component") - add("# Generated by k9-writer.lua (Pandoc custom writer)") - add("") - - -- Pedigree block - add("let pedigree = {") - add(' name = "' .. escape_nickel(pedigree["name"] or title) .. '",') - add(' version = "' .. escape_nickel(pedigree["version"] or version) .. '",') - if pedigree["description"] then - add(' description = "' .. escape_nickel(pedigree["description"]) .. '",') - end - if pedigree["author"] then - add(' author = "' .. escape_nickel(pedigree["author"]) .. '",') - end - add(' spdx_license = "' .. escape_nickel(spdx) .. '",') - add("} in") - add("") - - -- Security block - add("let security = {") - add(" trust_level = '" .. security .. ",") - - -- Permission flags based on security level - if security == "Hunt" then - add(" allow_network = true,") - add(" allow_filesystem_write = true,") - add(" allow_subprocess = true,") - elseif security == "Yard" then - add(" allow_network = false,") - add(" allow_filesystem_write = false,") - add(" allow_subprocess = false,") - else -- Kennel - add(" allow_network = false,") - add(" allow_filesystem_write = false,") - add(" allow_subprocess = false,") - end - add("} in") - add("") - - -- Recipes block (if any) - if next(recipes) then - add("let recipes = {") - for recipe_name, recipe_cmd in pairs(recipes) do - -- Use multiline string for shell scripts - if recipe_cmd:find("\n") then - add(" " .. recipe_name .. ' = m%"') - for line in recipe_cmd:gmatch("([^\n]*)\n?") do - if line ~= "" then - add(" " .. line) - end - end - add(' "%,') - else - add(" " .. recipe_name .. ' = "' .. escape_nickel(recipe_cmd) .. '",') - end - end - add("} in") - add("") - end - - -- Configuration entries (if any beyond pedigree/security) - if next(config_entries) then - add("let config = {") - for key, value in pairs(config_entries) do - -- Skip entries already in pedigree or security - if not pedigree[key] and key ~= "trust_level" and - not key:match("allow_") then - if value == "true" or value == "false" then - add(" " .. key .. " = " .. value .. ",") - elseif tonumber(value) then - add(" " .. key .. " = " .. value .. ",") - else - add(' ' .. key .. ' = "' .. escape_nickel(value) .. '",') - end - end - end - add("} in") - add("") - end - - -- Export block - add("{") - add(" pedigree,") - add(" security,") - if next(recipes) then add(" recipes,") end - if next(config_entries) then add(" config,") end - add("}") - add("") - - return table.concat(buffer, "\n") -end - ---- Extract a string value from Pandoc metadata. -function meta_string(meta, key) - local val = meta[key] - if not val then return nil end - if type(val) == "string" then return val end - if val.t == "MetaString" then return val[1] or tostring(val) end - if val.t == "MetaInlines" then return render_inlines(val) end - return tostring(val) -end - ---- Escape a string for Nickel double-quoted strings. -function escape_nickel(s) - if not s then return "" end - return s:gsub('\\', '\\\\'):gsub('"', '\\"'):gsub('\n', '\\n') -end - ---- Render inline elements to plain text. -function render_inlines(inlines) - local result = {} - for _, inline in ipairs(inlines) do - table.insert(result, render_inline(inline)) - end - return table.concat(result) -end - ---- Render a single inline element to plain text. -function render_inline(inline) - if inline.t == "Str" then - return inline.text - elseif inline.t == "Space" then - return " " - elseif inline.t == "SoftBreak" or inline.t == "LineBreak" then - return "\n" - elseif inline.t == "Strong" then - return "**" .. render_inlines(inline.content) .. "**" - elseif inline.t == "Emph" then - return "*" .. render_inlines(inline.content) .. "*" - elseif inline.t == "Code" then - return "`" .. inline.text .. "`" - elseif inline.t == "Span" then - return render_inlines(inline.content) - elseif inline.t == "Link" then - return render_inlines(inline.content) - elseif inline.t == "RawInline" then - return inline.text - else - return "" - end -end - ---- Render a block as inline text (for list items). -function render_block_inline(block) - if block.t == "Plain" or block.t == "Para" then - return render_inlines(block.content) - elseif block.t == "CodeBlock" then - return block.text - else - return "" - end -end - ---- Template (optional — for standalone output). -function Template() - return "$body$" -end diff --git a/k9-svc/pandoc/k9.html b/k9-svc/pandoc/k9.html deleted file mode 100644 index f59119f0..00000000 --- a/k9-svc/pandoc/k9.html +++ /dev/null @@ -1,590 +0,0 @@ - - - - - - - -$if(title)$ - $title$ — K9 Component -$else$ - K9 Component -$endif$ -$if(version)$ - -$endif$ -$if(k9-security-level)$ - -$endif$ -$for(css)$ - -$endfor$ -$for(header-includes)$ - $header-includes$ -$endfor$ - - - - -
-$if(title)$ -

- $title$ -$if(k9-security-level)$ - $k9-security-level$ -$endif$ -

-$else$ -

K9 Component

-$endif$ -
-$if(version)$ - Version: $version$ -$endif$ -$if(k9-format)$ - Format: $k9-format$ -$endif$ -$if(spdx-license)$ - License: $spdx-license$ -$endif$ -
-
- - -
-

Pedigree

- -$if(title)$ - - - - -$endif$ -$if(version)$ - - - - -$endif$ -$if(k9-security-level)$ - - - - -$endif$ -$if(k9-format)$ - - - - -$endif$ -$if(spdx-license)$ - - - - -$endif$ -$if(k9-magic)$ - - - - -$endif$ -
Name$title$
Version$version$
Security - $k9-security-level$ -
Syntax$k9-format$
License$spdx-license$
MagicK9!
-
- -
-$body$ -
- - - - - - -$for(include-after)$ - $include-after$ -$endfor$ - - diff --git a/k9-svc/pandoc/k9.lua b/k9-svc/pandoc/k9.lua deleted file mode 100644 index 28c47df2..00000000 --- a/k9-svc/pandoc/k9.lua +++ /dev/null @@ -1,596 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- --- k9.lua — Pandoc custom reader for K9 Self-Validating Components. --- --- Converts K9 files (.k9 and .k9.ncl) into the Pandoc AST, extracting: --- - Magic number (K9!) and SPDX header --- - Pedigree metadata (name, version, description, author) --- - Security level (Kennel/Yard/Hunt) with permission flags --- - Target platform (OS, edge mode, memory, podman) --- - Validation block (checksum, pedigree version) --- - Recipes (install, validate, deploy, migrate) --- - Configuration records with Nickel contracts --- - Multiline strings and shell scripts --- - Comments as annotations --- --- Handles two K9 syntaxes: --- .k9 — YAML-style pure data (Kennel level) --- .k9.ncl — Nickel with contracts and types (Yard/Hunt level) --- --- Usage: --- pandoc -f k9.lua input.k9 -o output.html --- pandoc -f k9.lua input.k9.ncl -t markdown --- pandoc -f k9.lua config.k9.ncl -t json --- --- Spec: /standards/k9-svc/SPEC.adoc --- Pedigree: /standards/k9-svc/pedigree.ncl - ---- Detect whether this is YAML-style K9 (.k9) or Nickel (.k9.ncl). ---- Returns "yaml" or "nickel". -local function detect_syntax(raw) - -- Check for Nickel indicators - if raw:find("^%s*let%s") or raw:find("\nlet%s") or - raw:find("import%s") or raw:find("std%.") then - return "nickel" - end - -- Check for YAML separator - if raw:find("\n%-%-%-\n") or raw:find("^%-%-%-\n") then - return "yaml" - end - -- Default to nickel if .ncl extension patterns found - if raw:find("'Kennel") or raw:find("'Yard") or raw:find("'Hunt") then - return "nickel" - end - return "yaml" -end - ---- Detect the security level from file content. ---- Returns "Kennel", "Yard", or "Hunt". -local function detect_security_level(raw) - -- Explicit trust_level declaration - local level = raw:match("trust_level%s*=%s*'(%w+)") - if level then return level end - - -- Comment annotation - level = raw:match("Security%s+[Ll]evel:%s*'(%w+)") - if level then return level end - - -- Infer from content - if raw:find("allow_subprocess%s*=%s*true") or - raw:find("allow_network%s*=%s*true") or - raw:find("signature%s*=") then - return "Hunt" - end - if raw:find("let%s") or raw:find("std%.contract") then - return "Yard" - end - return "Kennel" -end - ---- Extract the SPDX license identifier from comments. -local function extract_spdx(raw) - return raw:match("SPDX%-License%-Identifier:%s*(%S+)") -end - ---- Extract K9! magic number presence. -local function has_magic(raw) - return raw:sub(1, 3) == "K9!" -end - ---- Parse a Nickel record block into key-value pairs. ---- Handles simple assignments: key = value, key = "string", key = 'Variant. ---- Returns a table of {key, value, contract, comment} entries. -local function parse_nickel_record(lines, start_idx, end_idx) - local entries = {} - local i = start_idx - - while i <= end_idx do - local line = lines[i] - - -- Skip blank lines and pure comments - if line:match("^%s*$") or line:match("^%s*#") then - -- Extract comment for annotation - local comment = line:match("^%s*#%s*(.+)") - if comment and #entries > 0 then - entries[#entries].comment = comment - end - i = i + 1 - - -- Simple assignment: key = value - elseif line:match("^%s*(%w[%w_%-]*)%s*=") then - local key = line:match("^%s*(%w[%w_%-]*)") - local value = line:match("=%s*(.+)%s*,?%s*$") - if value then - value = value:gsub(",%s*$", "") -- strip trailing comma - value = value:match('^"(.*)"$') or value -- strip quotes - end - table.insert(entries, {key = key, value = value or ""}) - i = i + 1 - - -- Contract-annotated field: key | Contract = value - elseif line:match("^%s*(%w[%w_%-]*)%s*|") then - local key = line:match("^%s*(%w[%w_%-]*)") - local contract = line:match("|%s*(.-)%s*[=|]") - local value = line:match("=%s*(.+)%s*,?%s*$") - if value then - value = value:gsub(",%s*$", "") - value = value:match('^"(.*)"$') or value - end - table.insert(entries, { - key = key, - value = value or "", - contract = contract or "", - }) - i = i + 1 - - -- Nested record opening: key = { or key | Contract = { - elseif line:match("{%s*$") then - local key = line:match("^%s*(%w[%w_%-]*)") - -- Find matching close brace - local depth = 1 - local nested_start = i + 1 - local j = i + 1 - while j <= end_idx and depth > 0 do - local l = lines[j] - depth = depth + select(2, l:gsub("{", "")) - select(2, l:gsub("}", "")) - j = j + 1 - end - local nested_end = j - 1 - if key then - local sub_entries = parse_nickel_record(lines, nested_start, nested_end - 1) - table.insert(entries, {key = key, children = sub_entries}) - end - i = j - - else - i = i + 1 - end - end - - return entries -end - ---- Render a record's entries as a Pandoc DefinitionList. ---- Each entry becomes a term (key) with definition (value + contract). -local function entries_to_deflist(entries, depth) - depth = depth or 0 - local items = {} - - for _, entry in ipairs(entries) do - local term_inlines = pandoc.Inlines{} - term_inlines:insert(pandoc.Code(entry.key or "?")) - - if entry.contract and entry.contract ~= "" then - term_inlines:insert(pandoc.Space()) - term_inlines:insert(pandoc.Span( - pandoc.Inlines{pandoc.Str("|"), pandoc.Space(), pandoc.Str(entry.contract)}, - pandoc.Attr("", {"k9-contract"}, {}) - )) - end - - local def_blocks = pandoc.Blocks{} - - if entry.children then - -- Nested record: recurse - def_blocks:insert(entries_to_deflist(entry.children, depth + 1)) - elseif entry.value and entry.value ~= "" then - def_blocks:insert(pandoc.Plain(pandoc.Inlines{pandoc.Str(entry.value)})) - end - - if entry.comment then - def_blocks:insert(pandoc.Plain(pandoc.Inlines{ - pandoc.Emph(pandoc.Inlines{pandoc.Str(entry.comment)}) - })) - end - - table.insert(items, {term_inlines, {def_blocks}}) - end - - if #items > 0 then - return pandoc.DefinitionList(items) - else - return pandoc.Null() - end -end - ---- Parse YAML-style K9 (.k9) content after the --- separator. ---- Returns blocks representing the structured data. -local function parse_yaml_k9(lines, start_idx) - local blocks = pandoc.Blocks{} - local current_section = nil - local current_items = {} - local i = start_idx - - while i <= #lines do - local line = lines[i] - - -- Top-level key (no indentation, ends with colon) - if line:match("^(%w[%w_%-]*):%s*$") then - -- Flush previous section - if current_section then - blocks:insert(pandoc.Header(3, pandoc.Inlines{pandoc.Code(current_section)}, - pandoc.Attr("k9-" .. current_section, {"k9-section"}, {}))) - if #current_items > 0 then - blocks:insert(entries_to_deflist(current_items)) - end - end - current_section = line:match("^(%w[%w_%-]*):") - current_items = {} - i = i + 1 - - -- Top-level key with inline value: key: value - elseif line:match("^(%w[%w_%-]*):%s+(.+)$") then - if current_section then - -- Flush section first - blocks:insert(pandoc.Header(3, pandoc.Inlines{pandoc.Code(current_section)}, - pandoc.Attr("k9-" .. current_section, {"k9-section"}, {}))) - if #current_items > 0 then - blocks:insert(entries_to_deflist(current_items)) - end - current_section = nil - current_items = {} - end - local key, value = line:match("^(%w[%w_%-]*):%s+(.+)$") - value = value:match('^"(.*)"$') or value - blocks:insert(pandoc.Para(pandoc.Inlines{ - pandoc.Code(key), pandoc.Str(": "), pandoc.Str(value) - })) - i = i + 1 - - -- Indented key-value: " key: value" - elseif line:match("^%s+(%w[%w_%-]*):%s+(.+)$") then - local key, value = line:match("^%s+(%w[%w_%-]*):%s+(.+)$") - value = value:match('^"(.*)"$') or value - table.insert(current_items, {key = key, value = value}) - i = i + 1 - - -- Indented key with block scalar: " key: |" - elseif line:match("^%s+(%w[%w_%-]*):%s*|%s*$") then - local key = line:match("^%s+(%w[%w_%-]*):") - i = i + 1 - local scalar_lines = {} - local indent = nil - while i <= #lines do - local sl = lines[i] - if sl:match("^%s*$") then - table.insert(scalar_lines, "") - i = i + 1 - else - local si = #(sl:match("^(%s*)")) - if indent == nil then indent = si end - if si >= indent then - table.insert(scalar_lines, sl:sub(indent + 1)) - i = i + 1 - else - break - end - end - end - local scalar_text = table.concat(scalar_lines, "\n"):match("^(.-)%s*$") - table.insert(current_items, {key = key, value = scalar_text}) - - -- List item: " - item" - elseif line:match("^%s+%-+%s+(.+)$") then - local item = line:match("^%s+%-+%s+(.+)$") - item = item:match('^"(.*)"$') or item - table.insert(current_items, {key = "-", value = item}) - i = i + 1 - - -- Comment - elseif line:match("^%s*#") then - i = i + 1 - - -- Blank - elseif line:match("^%s*$") then - i = i + 1 - - else - i = i + 1 - end - end - - -- Flush final section - if current_section then - blocks:insert(pandoc.Header(3, pandoc.Inlines{pandoc.Code(current_section)}, - pandoc.Attr("k9-" .. current_section, {"k9-section"}, {}))) - if #current_items > 0 then - blocks:insert(entries_to_deflist(current_items)) - end - end - - return blocks -end - ---- Parse Nickel-style K9 (.k9.ncl) content. ---- Extracts pedigree blocks, let bindings, record structure, multiline strings. ---- Returns blocks representing the structured data. -local function parse_nickel_k9(lines) - local blocks = pandoc.Blocks{} - local i = 1 - local total = #lines - - -- Track let-binding names for section headers - local in_record = false - local record_name = nil - local record_lines = {} - local record_start = nil - local brace_depth = 0 - - while i <= total do - local line = lines[i] - - -- Comment block (collect consecutive comments as a note) - if line:match("^#") and not line:match("^#!") then - local comment_lines = {} - while i <= total and lines[i]:match("^#") do - local text = lines[i]:match("^#%s?(.*)$") or "" - -- Skip SPDX header (handled in metadata) - if not text:match("^SPDX%-") then - table.insert(comment_lines, text) - end - i = i + 1 - end - if #comment_lines > 0 then - local comment_text = table.concat(comment_lines, "\n"):match("^%s*(.-)%s*$") - if comment_text ~= "" then - blocks:insert(pandoc.Div( - pandoc.Blocks{pandoc.Para(pandoc.Inlines{pandoc.Str(comment_text)})}, - pandoc.Attr("", {"k9-comment"}, {}) - )) - end - end - - -- Import statement - elseif line:match("^%s*let%s+.-%s*=%s*import%s") then - local binding = line:match("^%s*let%s+(.-)%s*=") - local path = line:match('import%s+"(.-)"') or line:match("import%s+(%S+)") - if binding and path then - blocks:insert(pandoc.Para(pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("import")}), - pandoc.Space(), - pandoc.Code(binding), - pandoc.Str(" = "), - pandoc.Code(path), - })) - end - i = i + 1 - - -- Let binding with record: let name = { ... } in - elseif line:match("^%s*let%s+(%w[%w_%-]*)%s*[|=]") and not in_record then - record_name = line:match("^%s*let%s+(%w[%w_%-]*)") - local contract = line:match("|%s*(.-)%s*=") - - -- Check if record opens on this line - if line:match("{%s*$") then - in_record = true - brace_depth = 1 - record_lines = {} - record_start = i + 1 - - -- Emit section header - local header_inlines = pandoc.Inlines{pandoc.Code(record_name)} - if contract then - header_inlines:insert(pandoc.Space()) - header_inlines:insert(pandoc.Span( - pandoc.Inlines{pandoc.Str("| " .. contract)}, - pandoc.Attr("", {"k9-contract"}, {}) - )) - end - blocks:insert(pandoc.Header(2, header_inlines, - pandoc.Attr("k9-" .. record_name, {"k9-binding"}, {}))) - else - -- Single-line let binding - local value = line:match("=%s*(.+)%s+in%s*$") or line:match("=%s*(.+)$") - if value then - blocks:insert(pandoc.Para(pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("let")}), - pandoc.Space(), - pandoc.Code(record_name), - pandoc.Str(" = "), - pandoc.Code(value:gsub("%s+in%s*$", "")), - })) - end - end - i = i + 1 - - -- Inside a record: track brace depth - elseif in_record then - table.insert(record_lines, line) - brace_depth = brace_depth - + select(2, line:gsub("{", "")) - - select(2, line:gsub("}", "")) - - if brace_depth <= 0 then - -- Record closed — parse contents - -- Remove closing brace line - if #record_lines > 0 then - local last = record_lines[#record_lines] - record_lines[#record_lines] = last:gsub("}.-$", "") - if record_lines[#record_lines]:match("^%s*$") then - table.remove(record_lines) - end - end - - local entries = parse_nickel_record(record_lines, 1, #record_lines) - if #entries > 0 then - blocks:insert(entries_to_deflist(entries)) - end - - in_record = false - record_name = nil - record_lines = {} - end - i = i + 1 - - -- Top-level export record: { pedigree = ..., layout, } - elseif line:match("^{%s*$") or line:match("^%s*{%s*$") then - in_record = true - brace_depth = 1 - record_lines = {} - record_name = "export" - - blocks:insert(pandoc.Header(2, - pandoc.Inlines{pandoc.Str("Export")}, - pandoc.Attr("k9-export", {"k9-export"}, {}))) - i = i + 1 - - -- Multiline string: m%"..."% — capture as code block - elseif line:match('m%%"') then - local ml_lines = {line} - if not line:match('"%%') then - i = i + 1 - while i <= total do - table.insert(ml_lines, lines[i]) - if lines[i]:match('"%%') then break end - i = i + 1 - end - end - local ml_text = table.concat(ml_lines, "\n") - blocks:insert(pandoc.CodeBlock(ml_text, pandoc.Attr("", {"k9-multiline"}, {}))) - i = i + 1 - - -- Blank line - elseif line:match("^%s*$") then - i = i + 1 - - -- Catch-all: skip lines we can't parse (e.g. "in", closing parens) - else - i = i + 1 - end - end - - return blocks -end - ---- Main reader function. Pandoc calls this with the raw input. ---- Returns a pandoc.Pandoc document. -function Reader(input, opts) - local raw = tostring(input) - local lines = {} - for line in raw:gmatch("([^\n]*)\n?") do - table.insert(lines, line) - end - if #lines > 0 and lines[#lines] == "" then - table.remove(lines) - end - - -- Detect format variant - local syntax = detect_syntax(raw) - local magic = has_magic(raw) - local security = detect_security_level(raw) - local spdx = extract_spdx(raw) or "unknown" - - -- Build document metadata - local meta = {} - meta["k9-format"] = pandoc.MetaString(syntax) - meta["k9-security-level"] = pandoc.MetaString(security) - meta["k9-magic"] = pandoc.MetaBool(magic) - meta["spdx-license"] = pandoc.MetaString(spdx) - - -- Extract metadata fields for the title block - local name = raw:match('name%s*[=:]%s*"([^"]+)"') or raw:match("name%s*[=:]%s*(%S+)") - local version = raw:match('version%s*[=:]%s*"([^"]+)"') or raw:match("version%s*[=:]%s*(%S+)") - local description = raw:match('description%s*[=:]%s*"([^"]+)"') - or raw:match("description%s*[=:]%s*([^\n]+)") - - if name then meta["title"] = pandoc.MetaString(name) end - if version then meta["version"] = pandoc.MetaString(version) end - - -- Start building the document - local blocks = pandoc.Blocks{} - - -- Title header with component name and security badge - local title_text = name or "K9 Component" - local security_badge = " [" .. security .. "]" - - blocks:insert(pandoc.Header(1, - pandoc.Inlines{ - pandoc.Str(title_text), - pandoc.Space(), - pandoc.Span( - pandoc.Inlines{pandoc.Str(security_badge)}, - pandoc.Attr("", {"k9-security-badge", "k9-" .. security:lower()}, {}) - ), - }, - pandoc.Attr("k9-title"))) - - -- Pedigree summary block - local pedigree_items = {} - if magic then - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("Magic")}), - pandoc.Str(": K9!"), - }) - end - if version then - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("Version")}), - pandoc.Str(": " .. version), - }) - end - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("Security")}), - pandoc.Str(": " .. security), - }) - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("Syntax")}), - pandoc.Str(": " .. syntax), - }) - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("License")}), - pandoc.Str(": " .. spdx), - }) - if description then - table.insert(pedigree_items, pandoc.Inlines{ - pandoc.Strong(pandoc.Inlines{pandoc.Str("Description")}), - pandoc.Str(": " .. description), - }) - end - - -- Render pedigree as a simple list - local pedigree_list_items = {} - for _, item in ipairs(pedigree_items) do - table.insert(pedigree_list_items, pandoc.Blocks{pandoc.Plain(item)}) - end - blocks:insert(pandoc.Div( - pandoc.Blocks{pandoc.BulletList(pedigree_list_items)}, - pandoc.Attr("k9-pedigree-summary", {"k9-pedigree"}, {}) - )) - - -- Parse body content based on syntax - if syntax == "yaml" then - -- Find the --- separator and parse YAML content after it - local yaml_start = nil - for idx, line in ipairs(lines) do - if line:match("^%-%-%-") then - yaml_start = idx + 1 - break - end - end - if yaml_start then - local yaml_blocks = parse_yaml_k9(lines, yaml_start) - for _, block in ipairs(yaml_blocks) do - blocks:insert(block) - end - end - else - -- Parse Nickel content - local nickel_blocks = parse_nickel_k9(lines) - for _, block in ipairs(nickel_blocks) do - blocks:insert(block) - end - end - - -- Append raw source as a collapsible code block for reference - blocks:insert(pandoc.Header(2, - pandoc.Inlines{pandoc.Str("Source")}, - pandoc.Attr("k9-source", {"k9-source"}, {}))) - blocks:insert(pandoc.CodeBlock(raw, pandoc.Attr("", {"nickel"}, {}))) - - return pandoc.Pandoc(blocks, pandoc.Meta(meta)) -end - ---- Extensions table (required by Pandoc custom reader protocol). -Extensions = { - smart = true, -} diff --git a/k9-svc/pandoc/pandoc-k9-scm-1.rockspec b/k9-svc/pandoc/pandoc-k9-scm-1.rockspec deleted file mode 100644 index c19aa788..00000000 --- a/k9-svc/pandoc/pandoc-k9-scm-1.rockspec +++ /dev/null @@ -1,54 +0,0 @@ --- SPDX-License-Identifier: MPL-2.0 --- (MIT required for LuaRocks OSI-approved policy) --- --- pandoc-k9-scm-1.rockspec — LuaRocks package spec for pandoc-k9. --- --- Provides Pandoc reader, writer, and filter for K9 (Self-Validating Components). - -rockspec_format = "3.0" -package = "pandoc-k9" -version = "scm-1" - -source = { - url = "git://github.com/hyperpolymath/pandoc-k9.git", - branch = "main", -} - -description = { - summary = "Pandoc reader, writer, and filter for K9 (Self-Validating Components)", - detailed = [[ - pandoc-k9 provides a custom Pandoc reader, writer, and filter for the - K9 format. K9 is a self-validating component specification that embeds - security levels, pedigree metadata, build recipes, and validation - checksums directly in the document. - - Features: - - Custom reader: parse .k9 and .k9.ncl files into the Pandoc AST - - Custom writer: render Pandoc AST back to K9 format - - Filter: transform K9 component blocks within Pandoc pipelines - - Supports both YAML-like (.k9) and Nickel (.k9.ncl) variants - - Extracts pedigree, security level, target platform, and validation data - ]], - homepage = "https://github.com/hyperpolymath/pandoc-k9", - license = "MIT", - maintainer = "Jonathan D.A. Jewell ", - labels = { "pandoc", "k9", "filter", "reader", "writer", "validation", "security" }, -} - -dependencies = { - "lua >= 5.1", -} - -build = { - type = "builtin", - modules = { - ["pandoc-k9"] = "k9.lua", - ["pandoc-k9.reader"] = "k9-reader.lua", - ["pandoc-k9.writer"] = "k9-writer.lua", - ["pandoc-k9.filter"] = "k9-filter.lua", - }, - copy_directories = { - "docs", - "examples", - }, -} diff --git a/k9-svc/pandoc/sample.k9 b/k9-svc/pandoc/sample.k9 deleted file mode 100644 index 78bad1ab..00000000 --- a/k9-svc/pandoc/sample.k9 +++ /dev/null @@ -1,40 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# hello.k9 - Example Kennel-level component (pure data) -# -# Security Level: 'Kennel (no execution, safe anywhere) -# -# This is the simplest K9 component: just data. -# It can be parsed and displayed without any risk. - ---- -metadata: - name: hello-k9 - version: 1.0.0 - description: A friendly greeting from the K9 pack - author: hyperpolymath - license: PMPL-1.0-or-later - -content: - greeting: "Hello from K9!" - message: | - Welcome to the K9 Self-Validating Component system. - - This file demonstrates the 'Kennel security level: - - Pure data only - - No code execution - - Safe to open anywhere - - Think of it as a smarter YAML that knows what it is. - - facts: - - K9 files start with the magic number "K9!" - - The must-just-nickel triad enables self-validation - - Three security levels: 'Kennel, 'Yard, 'Hunt - - Podman-first deployment prevents host pollution - -tags: - - example - - kennel - - hello-world - - safe diff --git a/k9-svc/pandoc/sample.k9.ncl b/k9-svc/pandoc/sample.k9.ncl deleted file mode 100644 index c1cd9646..00000000 --- a/k9-svc/pandoc/sample.k9.ncl +++ /dev/null @@ -1,41 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# hello.k9.ncl - Example K9 Self-Validating Component -# -# This is a minimal .k9 component demonstrating the pedigree structure. -# It validates itself against the pedigree schema. - -let pedigree = import "../pedigree.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "hello-k9", - version = "1.0.0-alpha", - description = "A minimal K9 component that says hello", - }, - - target = { - os = 'Linux, - is_edge = false, - requires_podman = false, - }, - - security = { - trust_level = 'Yard, - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - - validation = { - checksum = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, - - recipes = { - install = "echo 'Hello from K9!'", - validate = "nickel typecheck examples/hello.k9.ncl", - deploy = "echo 'K9 deployed successfully'", - migrate = "echo 'No migration needed'", - }, -} diff --git a/k9-svc/pandoc/src/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index c92e124d..00000000 --- a/k9-svc/pandoc/src/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary source code directory. Organized by role and architectural - aspect. - -canonical_locations: - core: "core/" - interface: "interface/" - bridges: "bridges/" - contracts: "contracts/" - errors: "errors/" - definitions: "definitions/" - aspects: "aspects/" - -invariants: - - "Core logic MUST reside in core/" - - "Verified seams MUST reside in interface/" - - "Safety constraints MUST reside in contracts/" - - "Failure dictionaries MUST reside in errors/" diff --git a/k9-svc/pandoc/src/README.adoc b/k9-svc/pandoc/src/README.adoc deleted file mode 100644 index 5529f66f..00000000 --- a/k9-svc/pandoc/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= src Pillar diff --git a/k9-svc/pandoc/src/aspects/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/aspects/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d5b209e..00000000 --- a/k9-svc/pandoc/src/aspects/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-aspects" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Cross-cutting concerns and domain-specific aspects (Security, - Observability, Integrity). - -canonical_locations: - security: "security/" - observability: "observability/" - integrity: "integrity/" diff --git a/k9-svc/pandoc/src/aspects/README.adoc b/k9-svc/pandoc/src/aspects/README.adoc deleted file mode 100644 index 6456f962..00000000 --- a/k9-svc/pandoc/src/aspects/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Aspects Pillar diff --git a/k9-svc/pandoc/src/aspects/integrity/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/aspects/integrity/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index f114cbd2..00000000 --- a/k9-svc/pandoc/src/aspects/integrity/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-integrity" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the integrity aspect. diff --git a/k9-svc/pandoc/src/aspects/integrity/README.adoc b/k9-svc/pandoc/src/aspects/integrity/README.adoc deleted file mode 100644 index f15d829d..00000000 --- a/k9-svc/pandoc/src/aspects/integrity/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Integrity Aspect diff --git a/k9-svc/pandoc/src/aspects/observability/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/aspects/observability/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index e16cbdf9..00000000 --- a/k9-svc/pandoc/src/aspects/observability/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-observability" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the observability aspect. diff --git a/k9-svc/pandoc/src/aspects/observability/README.adoc b/k9-svc/pandoc/src/aspects/observability/README.adoc deleted file mode 100644 index 7852ee64..00000000 --- a/k9-svc/pandoc/src/aspects/observability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Observability Aspect diff --git a/k9-svc/pandoc/src/aspects/security/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/aspects/security/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 09965363..00000000 --- a/k9-svc/pandoc/src/aspects/security/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "aspect-unit-security" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Implementation logic for the security aspect. diff --git a/k9-svc/pandoc/src/aspects/security/README.adoc b/k9-svc/pandoc/src/aspects/security/README.adoc deleted file mode 100644 index 3c3536ec..00000000 --- a/k9-svc/pandoc/src/aspects/security/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Security Aspect diff --git a/k9-svc/pandoc/src/bridges/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/bridges/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 3d3e27a0..00000000 --- a/k9-svc/pandoc/src/bridges/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-bridges" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Integration logic for external systems (API, Database, RPC, etc.). diff --git a/k9-svc/pandoc/src/contracts/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/contracts/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0bd9198f..00000000 --- a/k9-svc/pandoc/src/contracts/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-contracts" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Contracts unit for high-rigor source code. diff --git a/k9-svc/pandoc/src/contracts/README.adoc b/k9-svc/pandoc/src/contracts/README.adoc deleted file mode 100644 index 9cfa2098..00000000 --- a/k9-svc/pandoc/src/contracts/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Contracts Unit diff --git a/k9-svc/pandoc/src/core/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/core/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 22846c78..00000000 --- a/k9-svc/pandoc/src/core/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-core" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary application logic and core domain models. diff --git a/k9-svc/pandoc/src/definitions/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/definitions/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index e54f4dab..00000000 --- a/k9-svc/pandoc/src/definitions/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-definitions" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Definitions unit for high-rigor source code. diff --git a/k9-svc/pandoc/src/definitions/README.adoc b/k9-svc/pandoc/src/definitions/README.adoc deleted file mode 100644 index 95483497..00000000 --- a/k9-svc/pandoc/src/definitions/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Definitions Unit diff --git a/k9-svc/pandoc/src/errors/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/errors/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index dddcc6c4..00000000 --- a/k9-svc/pandoc/src/errors/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "source-unit-errors" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Errors unit for high-rigor source code. diff --git a/k9-svc/pandoc/src/errors/README.adoc b/k9-svc/pandoc/src/errors/README.adoc deleted file mode 100644 index 460fc1e9..00000000 --- a/k9-svc/pandoc/src/errors/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Errors Unit diff --git a/k9-svc/pandoc/src/interface/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 7f0f471b..00000000 --- a/k9-svc/pandoc/src/interface/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "interface-seams-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Consolidated "Verified Interface Seams" unit. This directory unifies the - formal specification (ABI), the bridge implementation (FFI), and the - resulting artifacts (Generated). - -canonical_locations: - abi: "abi/" - ffi: "ffi/" - generated: "generated/" - -invariants: - - "ABI MUST be Idris2 (.idr)" - - "FFI MUST be Zig (.zig)" - - "Generated artifacts MUST be C-compatible" - - "The 'Truth' lives in abi/; the 'Implementation' lives in ffi/" diff --git a/k9-svc/pandoc/src/interface/README.adoc b/k9-svc/pandoc/src/interface/README.adoc deleted file mode 100644 index 8faf0aad..00000000 --- a/k9-svc/pandoc/src/interface/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= interface Unit diff --git a/k9-svc/pandoc/src/interface/abi/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/abi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 91cafa01..00000000 --- a/k9-svc/pandoc/src/interface/abi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for abi. diff --git a/k9-svc/pandoc/src/interface/abi/README.adoc b/k9-svc/pandoc/src/interface/abi/README.adoc deleted file mode 100644 index 2330304d..00000000 --- a/k9-svc/pandoc/src/interface/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= abi Logic diff --git a/k9-svc/pandoc/src/interface/ffi/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/ffi/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index bf456ae2..00000000 --- a/k9-svc/pandoc/src/interface/ffi/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "ffi-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for ffi. diff --git a/k9-svc/pandoc/src/interface/ffi/README.adoc b/k9-svc/pandoc/src/interface/ffi/README.adoc deleted file mode 100644 index 8fe57d34..00000000 --- a/k9-svc/pandoc/src/interface/ffi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= ffi Logic diff --git a/k9-svc/pandoc/src/interface/ffi/build.zig b/k9-svc/pandoc/src/interface/ffi/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/k9-svc/pandoc/src/interface/ffi/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/k9-svc/pandoc/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 5b5f1b1e..00000000 --- a/k9-svc/pandoc/src/interface/ffi/src/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "src-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Src logic at level 4. diff --git a/k9-svc/pandoc/src/interface/ffi/src/README.adoc b/k9-svc/pandoc/src/interface/ffi/src/README.adoc deleted file mode 100644 index a5c0c6d5..00000000 --- a/k9-svc/pandoc/src/interface/ffi/src/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Src Logic diff --git a/k9-svc/pandoc/src/interface/ffi/src/main.zig b/k9-svc/pandoc/src/interface/ffi/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/k9-svc/pandoc/src/interface/ffi/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/k9-svc/pandoc/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index e02427f8..00000000 --- a/k9-svc/pandoc/src/interface/ffi/test/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "test-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Test logic at level 4. diff --git a/k9-svc/pandoc/src/interface/ffi/test/README.adoc b/k9-svc/pandoc/src/interface/ffi/test/README.adoc deleted file mode 100644 index f6f38bf6..00000000 --- a/k9-svc/pandoc/src/interface/ffi/test/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Test Logic diff --git a/k9-svc/pandoc/src/interface/ffi/test/integration_test.zig b/k9-svc/pandoc/src/interface/ffi/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/k9-svc/pandoc/src/interface/ffi/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/k9-svc/pandoc/src/interface/generated/0.3-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/generated/0.3-AI-MANIFEST.a2ml deleted file mode 100644 index 0088b80c..00000000 --- a/k9-svc/pandoc/src/interface/generated/0.3-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "generated-logic" -level: 3 -parent: "../0.2-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Specialised Level 3 logic for generated. diff --git a/k9-svc/pandoc/src/interface/generated/README.adoc b/k9-svc/pandoc/src/interface/generated/README.adoc deleted file mode 100644 index 3691b062..00000000 --- a/k9-svc/pandoc/src/interface/generated/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= generated Logic diff --git a/k9-svc/pandoc/src/interface/generated/abi/.gitkeep b/k9-svc/pandoc/src/interface/generated/abi/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/k9-svc/pandoc/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml b/k9-svc/pandoc/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml deleted file mode 100644 index 4eeb5808..00000000 --- a/k9-svc/pandoc/src/interface/generated/abi/0.4-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "abi-unit" -level: 4 -parent: "../0.3-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Abi logic at level 4. diff --git a/k9-svc/pandoc/src/interface/generated/abi/README.adoc b/k9-svc/pandoc/src/interface/generated/abi/README.adoc deleted file mode 100644 index aff61a99..00000000 --- a/k9-svc/pandoc/src/interface/generated/abi/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Abi Logic diff --git a/k9-svc/pandoc/verification/0.1-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/0.1-AI-MANIFEST.a2ml deleted file mode 100644 index 3435bdb4..00000000 --- a/k9-svc/pandoc/verification/0.1-AI-MANIFEST.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-pillar" -level: 1 -parent: "../0-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Primary verification pillar. Contains evidence for correctness, - performance, formal proofs, randomized testing, and aerospace-grade - high-assurance metrics (MC/DC coverage, traceability, safety cases). - -canonical_locations: - tests: "tests/" - benchmarks: "benchmarks/" - proofs: "proofs/" - fuzzing: "fuzzing/" - simulations: "simulations/" - coverage: "coverage/" - traceability: "traceability/" - safety_case: "safety_case/" - -invariants: - - "Evidence MUST be reproducible and documented" - - "High-assurance deployments MUST satisfy traceability and safety_case requirements" diff --git a/k9-svc/pandoc/verification/README.adoc b/k9-svc/pandoc/verification/README.adoc deleted file mode 100644 index f07e7f34..00000000 --- a/k9-svc/pandoc/verification/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Verification Pillar diff --git a/k9-svc/pandoc/verification/benchmarks/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/benchmarks/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d922a4c7..00000000 --- a/k9-svc/pandoc/verification/benchmarks/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "benches-pillar" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Benches pillar. diff --git a/k9-svc/pandoc/verification/benchmarks/README.adoc b/k9-svc/pandoc/verification/benchmarks/README.adoc deleted file mode 100644 index 5db76486..00000000 --- a/k9-svc/pandoc/verification/benchmarks/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Benchmarks Unit diff --git a/k9-svc/pandoc/verification/coverage/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/coverage/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 32b819e4..00000000 --- a/k9-svc/pandoc/verification/coverage/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-coverage" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for coverage. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/pandoc/verification/coverage/README.adoc b/k9-svc/pandoc/verification/coverage/README.adoc deleted file mode 100644 index 25669569..00000000 --- a/k9-svc/pandoc/verification/coverage/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Coverage Unit diff --git a/k9-svc/pandoc/verification/fuzzing/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/fuzzing/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 5178d400..00000000 --- a/k9-svc/pandoc/verification/fuzzing/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "fuzzing-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Fuzzing unit for high-rigor verification. diff --git a/k9-svc/pandoc/verification/fuzzing/README.adoc b/k9-svc/pandoc/verification/fuzzing/README.adoc deleted file mode 100644 index edeb1792..00000000 --- a/k9-svc/pandoc/verification/fuzzing/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Fuzzing Unit diff --git a/k9-svc/pandoc/verification/proofs/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/proofs/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 135e181b..00000000 --- a/k9-svc/pandoc/verification/proofs/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-proofs" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Sub-unit focusing on proofs. diff --git a/k9-svc/pandoc/verification/proofs/README.adoc b/k9-svc/pandoc/verification/proofs/README.adoc deleted file mode 100644 index 1ae324d0..00000000 --- a/k9-svc/pandoc/verification/proofs/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Proofs Unit diff --git a/k9-svc/pandoc/verification/safety_case/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/safety_case/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index d461915b..00000000 --- a/k9-svc/pandoc/verification/safety_case/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-safety_case" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for safety case. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/pandoc/verification/safety_case/README.adoc b/k9-svc/pandoc/verification/safety_case/README.adoc deleted file mode 100644 index 47c8e368..00000000 --- a/k9-svc/pandoc/verification/safety_case/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Safety case Unit diff --git a/k9-svc/pandoc/verification/simulations/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/simulations/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index f890ecac..00000000 --- a/k9-svc/pandoc/verification/simulations/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,11 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "simulations-unit" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - Simulations unit for high-rigor verification. diff --git a/k9-svc/pandoc/verification/simulations/README.adoc b/k9-svc/pandoc/verification/simulations/README.adoc deleted file mode 100644 index 8e1b13aa..00000000 --- a/k9-svc/pandoc/verification/simulations/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Simulations Unit diff --git a/k9-svc/pandoc/verification/tests/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/tests/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 0008fcfa..00000000 --- a/k9-svc/pandoc/verification/tests/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1 +0,0 @@ -# AI Manifest - Level 1: tests diff --git a/k9-svc/pandoc/verification/tests/README.adoc b/k9-svc/pandoc/verification/tests/README.adoc deleted file mode 100644 index 344bf862..00000000 --- a/k9-svc/pandoc/verification/tests/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Tests Unit diff --git a/k9-svc/pandoc/verification/traceability/0.2-AI-MANIFEST.a2ml b/k9-svc/pandoc/verification/traceability/0.2-AI-MANIFEST.a2ml deleted file mode 100644 index 96677665..00000000 --- a/k9-svc/pandoc/verification/traceability/0.2-AI-MANIFEST.a2ml +++ /dev/null @@ -1,12 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 ---- -### [META] -id: "verification-unit-traceability" -level: 2 -parent: "../0.1-AI-MANIFEST.a2ml" - ---- -### [AI_MANIFEST] -description: | - High-assurance verification unit for traceability. - Critical for safety-of-life and aerospace-grade deployment standards. diff --git a/k9-svc/pandoc/verification/traceability/README.adoc b/k9-svc/pandoc/verification/traceability/README.adoc deleted file mode 100644 index ff23dd75..00000000 --- a/k9-svc/pandoc/verification/traceability/README.adoc +++ /dev/null @@ -1 +0,0 @@ -= Traceability Unit diff --git a/k9-svc/receipt/PROFILE.a2ml b/k9-svc/receipt/PROFILE.a2ml deleted file mode 100644 index 83606999..00000000 --- a/k9-svc/receipt/PROFILE.a2ml +++ /dev/null @@ -1,57 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -# A2ML Profile: a2ml/k9-receipt - -@abstract: -The canonical evidence/receipt schema for a K9 SVC run, expressed as an A2ML -profile. A receipt is the attested record of what a .k9 component did and was -allowed to do: component identity, validation-contract result, enforced leash -level, capabilities granted, signatures checked, dry-run plan, deploy result, -rollback result, policy decision, and (only on failure) the failure reason. - -This profile is authored by the K9 component as a CONSUMER of A2ML's neutral -primitives (the profile mechanism and base record vocabulary). A2ML core ships -only those primitives and names no consumer; the dependency direction is -K9 -> A2ML, never the reverse. The receipt has a lossless JSON projection -(receipt.schema.json) for transport and tooling — the A2ML form is canonical. -@end - -@profile-def(id=a2ml/k9-receipt, version="1.0.0"): -required_sections: - - component - - contract-result - - leash - - capabilities - - signatures - - dry-run - - deploy-result - - rollback-result - - policy-decision -allowed_directives: base + [ record ] -required_directives: - - { directive: record, min: 1, max: 1 } -reference_classes: [] -min_attestation: checked -@end - -# Notes - -@rationale: -The single required @record carries the component's base identity (id, -source_span, hash, provenance, timestamp, artefact_ref) using the A2ML base -record vocabulary (A2ML SPEC Section 7) — so a K9 receipt is hash-pinned and -attributable in exactly the same neutral way as every other estate record, and -cannot desync from the artefact it describes. - -The `failure` section is intentionally NOT in required_sections: a receipt for -a successful run carries no failure reason, while a receipt for a refused or -failed run adds a `failure` section. `min_attestation: checked` means a -receipt is only meaningful once its ids/refs resolve and its directives are -permitted. - -The enforced leash level recorded under `leash` reflects authorize_hunt -(leash.ncl): a Hunt receipt is only `enforced_level = Hunt` when all five -preconditions held; otherwise the receipt records the downgrade and the unmet -preconditions. Capabilities under `capabilities` are the explicit grant -(default-deny; capabilities.ncl) plus any that were requested-but-denied. -@end diff --git a/k9-svc/receipt/README.adoc b/k9-svc/receipt/README.adoc deleted file mode 100644 index 281f6648..00000000 --- a/k9-svc/receipt/README.adoc +++ /dev/null @@ -1,79 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= K9 Receipt Schema (a2ml/k9-receipt) -:toc: -:icons: font - -The evidence/receipt schema for a K9 SVC run. A *receipt* is the attested record -of what a `.k9` component did and was permitted to do. It is *canonical in A2ML* -(the `a2ml/k9-receipt` profile) with a *lossless JSON projection* for transport. - -== Files - -[cols="2,3",options="header"] -|=== -| File | Role -| `PROFILE.a2ml` | The canonical schema — an `a2ml/k9-receipt` A2ML profile. -| `receipt.schema.json` | Lossless JSON projection (JSON Schema 2020-12). -| `example-receipt.a2ml` | A worked receipt in canonical A2ML form. -| `example-receipt.json` | The same receipt projected to JSON. -|=== - -== Why A2ML is canonical, JSON is a projection - -The receipt is defined in A2ML so it inherits the *base record vocabulary* -(A2ML SPEC §7): the `component` record is hash-pinned and carries `provenance` -in exactly the same neutral shape as every other estate record, so a receipt -*cannot desync* from the artefact it describes. The JSON projection exists for -tooling that speaks JSON; it round-trips without loss — every field in one form -has a one-to-one counterpart in the other. - -K9 is a *consumer* of A2ML here (dependency direction K9 → A2ML). A2ML core -ships only the neutral mechanism and base vocabulary and names no consumer. - -== What a receipt records - -[cols="2,4",options="header"] -|=== -| Section (A2ML) / key (JSON) | Meaning -| `component` / `component` | Base record: identity, hash, provenance, timestamp, artefact_ref. -| `contract-result` / `contract_result` | Did the validation contracts pass, and which files. -| `leash` / `leash` | Requested vs enforced leash level, downgrade flag, and any unmet Hunt preconditions. -| `capabilities` / `capabilities` | Granted / requested / denied capability names (default-deny). -| `signatures` / `signatures` | Which signatures were checked and whether all were valid. -| `dry-run` / `dry_run` | Whether a dry-run plan was produced and reviewed, and the plan. -| `deploy-result` / `deploy_result` | Whether deploy was attempted and succeeded. -| `rollback-result` / `rollback_result` | Whether rollback was attempted and succeeded. -| `policy-decision` / `policy_decision` | The allow/deny policy decision and its reason. -| `failure` / `failure` (optional) | Present only for a refused or failed run: reason + stage. -|=== - -== Leash + capability semantics in a receipt - -The `leash` block reflects `authorize_hunt` (`../leash.ncl`): a receipt shows -`enforced_level = "Hunt"` only when *all five* Hunt preconditions held -(signature, policy, sandbox, dry_run, capability_grant — owner directive, -all five always). Otherwise the receipt records `downgraded: true`, the -`enforced_level` it fell back to, and the exact `unmet_preconditions`. - -The `capabilities` block reflects the default-deny model (`../capabilities.ncl`): -`granted` is the explicit pedigree grant, `requested` is what the run asked for, -and `denied` is `requested \ granted` (empty on success). - -== Validating - -[source,sh] ----- -# JSON projection: -jq empty receipt.schema.json example-receipt.json -# (and validate example-receipt.json against receipt.schema.json with any -# JSON-Schema 2020-12 validator) - -# A2ML canonical form: validate under its declared profile -a2ml validate --profile a2ml/k9-receipt example-receipt.a2ml ----- - -== Naming hazard - -K9's execution triad is *must / just / nickel*. Do not confuse it with the -contractiles family *must / trust / dust / intend* — a different estate concept. -`must` appears in both and means different things. diff --git a/k9-svc/receipt/example-receipt.a2ml b/k9-svc/receipt/example-receipt.a2ml deleted file mode 100644 index 2512a8b9..00000000 --- a/k9-svc/receipt/example-receipt.a2ml +++ /dev/null @@ -1,54 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 -@profile(id=a2ml/k9-receipt) - -# K9 Receipt: burble-metadata deploy (Hunt, authorized) - -# component - -@record: -id: receipt-burble-2026-06-03 -source_span: { file: ".machine_readable/svc/k9/burble-metadata.k9.ncl", start: { line: 1, col: 1 }, end: { line: 1, col: 1 } } -hash: "sha256:3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b" -provenance: { author: "hyperpolymath", tool: "k9-runner@1.0.0", kind: mechanical } -timestamp: "2026-06-03T12:30:00Z" -artefact_ref: "repo:standards/.machine_readable/svc/k9/burble-metadata.k9.ncl" -profile_decl: a2ml/k9-receipt -@end - -# contract-result -passed: true -contract_files: [ "pedigree.ncl", "leash.ncl" ] -details: "all contracts evaluated clean" - -# leash -requested_level: Hunt -enforced_level: Hunt -downgraded: false -unmet_preconditions: [ ] - -# capabilities -granted: [ "deploy.apply", "rollback.apply", "fs.read" ] -requested: [ "deploy.apply", "fs.read" ] -denied: [ ] - -# signatures -all_valid: true -checked: [ { key_id: "primary", algorithm: "Ed25519", valid: true } ] - -# dry-run -produced: true -reviewed: true -plan: "apply burble-metadata to .machine_readable/svc/k9/" - -# deploy-result -attempted: true -success: true -summary: "deployed burble-metadata component" - -# rollback-result -attempted: false -success: false - -# policy-decision -decision: allow -reason: "all five Hunt preconditions satisfied" diff --git a/k9-svc/receipt/example-receipt.json b/k9-svc/receipt/example-receipt.json deleted file mode 100644 index b39efe1b..00000000 --- a/k9-svc/receipt/example-receipt.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "$comment": "SPDX-License-Identifier: MPL-2.0 Lossless JSON projection of example-receipt.a2ml; validates against receipt.schema.json.", - "receipt_version": "1.0.0", - "component": { - "id": "receipt-burble-2026-06-03", - "source_span": { - "file": ".machine_readable/svc/k9/burble-metadata.k9.ncl", - "start": { "line": 1, "col": 1 }, - "end": { "line": 1, "col": 1 } - }, - "hash": "sha256:3a7bd3e2360a3d29eea436fcfb7e44c735d117c42d1c1835420b6b9942dd4f1b", - "provenance": { "author": "hyperpolymath", "tool": "k9-runner@1.0.0", "kind": "mechanical" }, - "timestamp": "2026-06-03T12:30:00Z", - "artefact_ref": "repo:standards/.machine_readable/svc/k9/burble-metadata.k9.ncl", - "profile_decl": "a2ml/k9-receipt" - }, - "contract_result": { - "passed": true, - "contract_files": ["pedigree.ncl", "leash.ncl"], - "details": "all contracts evaluated clean" - }, - "leash": { - "requested_level": "Hunt", - "enforced_level": "Hunt", - "downgraded": false, - "unmet_preconditions": [] - }, - "capabilities": { - "granted": ["deploy.apply", "rollback.apply", "fs.read"], - "requested": ["deploy.apply", "fs.read"], - "denied": [] - }, - "signatures": { - "all_valid": true, - "checked": [{ "key_id": "primary", "algorithm": "Ed25519", "valid": true }] - }, - "dry_run": { - "produced": true, - "reviewed": true, - "plan": "apply burble-metadata to .machine_readable/svc/k9/" - }, - "deploy_result": { - "attempted": true, - "success": true, - "summary": "deployed burble-metadata component" - }, - "rollback_result": { - "attempted": false, - "success": false - }, - "policy_decision": { - "decision": "allow", - "reason": "all five Hunt preconditions satisfied" - } -} diff --git a/k9-svc/receipt/receipt.schema.json b/k9-svc/receipt/receipt.schema.json deleted file mode 100644 index c1b72954..00000000 --- a/k9-svc/receipt/receipt.schema.json +++ /dev/null @@ -1,207 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://k9-svc.org/schema/receipt-1.0.0.json", - "$comment": "SPDX-License-Identifier: MPL-2.0 Lossless JSON projection of the canonical A2ML a2ml/k9-receipt profile (PROFILE.a2ml). The A2ML form is canonical; this projection round-trips without loss.", - "title": "K9 SVC Receipt", - "type": "object", - "additionalProperties": false, - "required": [ - "receipt_version", - "component", - "contract_result", - "leash", - "capabilities", - "signatures", - "dry_run", - "deploy_result", - "rollback_result", - "policy_decision" - ], - "properties": { - "receipt_version": { "type": "string", "const": "1.0.0" }, - - "component": { - "$comment": "A2ML base record vocabulary (A2ML SPEC Section 7).", - "type": "object", - "additionalProperties": false, - "required": ["id", "source_span", "hash", "provenance", "timestamp", "artefact_ref"], - "properties": { - "id": { "type": "string" }, - "source_span": { "$ref": "#/$defs/source_span" }, - "canonical_node": { "type": "string" }, - "hash": { "$ref": "#/$defs/sha256" }, - "provenance": { "$ref": "#/$defs/provenance" }, - "timestamp": { "type": "string", "format": "date-time" }, - "artefact_ref": { "type": "string" }, - "profile_decl": { "type": "string" } - } - }, - - "contract_result": { - "type": "object", - "additionalProperties": false, - "required": ["passed", "contract_files"], - "properties": { - "passed": { "type": "boolean" }, - "contract_files": { "type": "array", "items": { "type": "string" } }, - "details": { "type": "string" } - } - }, - - "leash": { - "type": "object", - "additionalProperties": false, - "required": ["requested_level", "enforced_level", "downgraded", "unmet_preconditions"], - "properties": { - "requested_level": { "$ref": "#/$defs/leash_level" }, - "enforced_level": { "$ref": "#/$defs/leash_level" }, - "downgraded": { "type": "boolean" }, - "unmet_preconditions": { - "$comment": "Subset of the five Hunt preconditions that were not met.", - "type": "array", - "items": { "enum": ["signature", "policy", "sandbox", "dry_run", "capability_grant"] }, - "uniqueItems": true - } - } - }, - - "capabilities": { - "$comment": "Default-deny capability model (capabilities.ncl).", - "type": "object", - "additionalProperties": false, - "required": ["granted", "requested", "denied"], - "properties": { - "granted": { "type": "array", "items": { "type": "string" } }, - "requested": { "type": "array", "items": { "type": "string" } }, - "denied": { "type": "array", "items": { "type": "string" } } - } - }, - - "signatures": { - "type": "object", - "additionalProperties": false, - "required": ["checked", "all_valid"], - "properties": { - "all_valid": { "type": "boolean" }, - "checked": { - "type": "array", - "items": { - "type": "object", - "additionalProperties": false, - "required": ["key_id", "algorithm", "valid"], - "properties": { - "key_id": { "type": "string" }, - "algorithm": { "type": "string", "default": "Ed25519" }, - "valid": { "type": "boolean" } - } - } - } - } - }, - - "dry_run": { - "type": "object", - "additionalProperties": false, - "required": ["produced", "reviewed"], - "properties": { - "produced": { "type": "boolean" }, - "reviewed": { "type": "boolean" }, - "plan": { - "$comment": "The planned actions; string or ordered list of steps.", - "oneOf": [ - { "type": "string" }, - { "type": "array", "items": { "type": "string" } } - ] - } - } - }, - - "deploy_result": { "$ref": "#/$defs/action_result" }, - "rollback_result": { "$ref": "#/$defs/action_result" }, - - "policy_decision": { - "type": "object", - "additionalProperties": false, - "required": ["decision"], - "properties": { - "decision": { "enum": ["allow", "deny"] }, - "reason": { "type": "string" } - } - }, - - "failure": { - "$comment": "Present only for a refused or failed run.", - "type": "object", - "additionalProperties": false, - "required": ["reason"], - "properties": { - "reason": { "type": "string" }, - "stage": { - "enum": ["contract", "signature", "policy", "sandbox", "dry_run", "capability", "deploy", "rollback"] - } - } - } - }, - - "$defs": { - "sha256": { - "type": "string", - "pattern": "^sha256:[0-9a-f]{64}$" - }, - "leash_level": { - "enum": ["Kennel", "Yard", "Hunt"] - }, - "position": { - "type": "object", - "additionalProperties": false, - "required": ["line", "col"], - "properties": { - "line": { "type": "integer", "minimum": 1 }, - "col": { "type": "integer", "minimum": 1 } - } - }, - "source_span": { - "type": "object", - "additionalProperties": false, - "required": ["file", "start", "end"], - "properties": { - "file": { "type": "string" }, - "start": { "$ref": "#/$defs/position" }, - "end": { "$ref": "#/$defs/position" }, - "bytes": { - "type": "object", - "additionalProperties": false, - "required": ["start", "end"], - "properties": { - "start": { "type": "integer", "minimum": 0 }, - "end": { "type": "integer", "minimum": 0 } - } - } - } - }, - "provenance": { - "type": "object", - "additionalProperties": false, - "required": ["author", "tool", "kind"], - "properties": { - "author": { "type": "string" }, - "tool": { "type": "string" }, - "kind": { - "$comment": "Closed enum (A2ML SPEC Section 7.5).", - "enum": ["human", "ai", "mechanical"] - }, - "agent": { "type": "string" } - } - }, - "action_result": { - "type": "object", - "additionalProperties": false, - "required": ["attempted", "success"], - "properties": { - "attempted": { "type": "boolean" }, - "success": { "type": "boolean" }, - "summary": { "type": "string" } - } - } - } -} diff --git a/k9-svc/release-k9.k9.ncl b/k9-svc/release-k9.k9.ncl deleted file mode 100644 index 810a9f5c..00000000 --- a/k9-svc/release-k9.k9.ncl +++ /dev/null @@ -1,356 +0,0 @@ -K9! -# SPDX-License-Identifier: MPL-2.0 -# K9-SVC Release Automation -# -# This K9 component automates the release process for K9-SVC itself - ultimate -# dogfooding! It handles version bumping, testing, signing, documentation, and -# release artifact creation. - -leash = 'Hunt - -pedigree = { - schema_version = "1.0.0", - component_type = "release-automation", - author = "Jonathan D.A. Jewell ", - description = "Automated K9-SVC release process (K9 eating its own dog food!)", - created = "2026-01-30", - k9_spec_version = "1.0.0", -} - -config = { - # Version information - current_version | String = "1.0.0", - release_type | [| 'Major, 'Minor, 'Patch |] = 'Patch, - - # Release components - components = { - build_k9_sign | Bool = true, - build_k9_scan | Bool = true, - update_must_script | Bool = true, - regenerate_docs | Bool = true, - run_full_tests | Bool = true, - }, - - # Signing - signing = { - sign_release_artifacts | Bool = true, - signing_key_name | String = "k9-svc-release", - verify_signatures | Bool = true, - }, - - # Documentation - documentation = { - update_changelog | Bool = true, - update_readme | Bool = true, - generate_api_docs | Bool = false, # No API docs yet - update_security_docs | Bool = true, - }, - - # GitHub release - github_release = { - create_release | Bool = true, - draft | Bool = true, # Create as draft for review - prerelease | Bool = false, - generate_notes | Bool = true, - }, - - # Artifact distribution - distribution = { - create_tarball | Bool = true, - create_checksums | Bool = true, - upload_to_github | Bool = true, - }, -} - -# Calculate new version based on release type -new_version = { - major = - let parts = std.string.split "." config.current_version in - let major = std.string.to_number (std.array.at 0 parts) + 1 in - "%{std.string.from major}.0.0", - - minor = - let parts = std.string.split "." config.current_version in - let major = std.string.to_number (std.array.at 0 parts) in - let minor = std.string.to_number (std.array.at 1 parts) + 1 in - "%{std.string.from major}.%{std.string.from minor}.0", - - patch = - let parts = std.string.split "." config.current_version in - let major = std.string.to_number (std.array.at 0 parts) in - let minor = std.string.to_number (std.array.at 1 parts) in - let patch = std.string.to_number (std.array.at 2 parts) + 1 in - "%{std.string.from major}.%{std.string.from minor}.%{std.string.from patch}", - - version = - if config.release_type == 'Major then new_version.major - else if config.release_type == 'Minor then new_version.minor - else new_version.patch, -} - -recipes = { - default = { - recipe = "release", - description = "Complete release process", - }, - - "check-prerequisites" = { - description = "Verify prerequisites for release", - commands = [ - "echo 'Checking prerequisites for K9-SVC release...'", - - # Check clean git state - "if [ -n \"$(git status --porcelain)\" ]; then echo 'Error: Working directory is not clean'; git status --short; exit 1; fi", - "echo '✓ Git working directory clean'", - - # Check on main branch - "if [ \"$(git branch --show-current)\" != 'main' ]; then echo 'Error: Not on main branch'; exit 1; fi", - "echo '✓ On main branch'", - - # Check GitHub CLI - "command -v gh >/dev/null 2>&1 || { echo 'Error: gh CLI not found'; exit 1; }", - "echo '✓ GitHub CLI available'", - - # Check k9-sign installed - "command -v k9-sign >/dev/null 2>&1 || { echo 'Error: k9-sign not installed'; exit 1; }", - "k9-sign --version", - "echo '✓ k9-sign available'", - - # Check signing key exists - "if [ ! -f ~/.config/k9/keys/%{config.signing.signing_key_name}.key ]; then echo 'Error: Release signing key not found'; exit 1; fi", - "echo '✓ Release signing key found'", - - "echo 'Prerequisites check complete!'", - ], - }, - - "bump-version" = { - description = "Bump version numbers in all files", - dependencies = ["check-prerequisites"], - commands = [ - "echo 'Bumping version: %{config.current_version} → %{new_version.version}'", - - # Update must script version - "sed -i 's/K9_VERSION=\"%{config.current_version}\"/K9_VERSION=\"%{new_version.version}\"/' must", - - # Update k9-sign Cargo.toml - "sed -i 's/^version = \"%{config.current_version}\"/version = \"%{new_version.version}\"/' k9-sign/Cargo.toml", - - # Update k9-sign/install.sh - "sed -i 's/VERSION=\"%{config.current_version}\"/VERSION=\"%{new_version.version}\"/' k9-sign/install.sh", - - # Update pedigree.ncl - "sed -i 's/version = \"%{config.current_version}\"/version = \"%{new_version.version}\"/' pedigree.ncl", - - "echo 'Version bumped to %{new_version.version}'", - ], - }, - - "build-k9-sign" = { - description = "Build k9-sign release binary", - skip = !config.components.build_k9_sign, - commands = [ - "echo 'Building k9-sign release binary...'", - "cd k9-sign", - "cargo build --release", - "ls -lh target/release/k9-sign", - "echo 'Binary size:' $(du -h target/release/k9-sign | cut -f1)", - "cd ..", - ], - }, - - "run-tests" = { - description = "Run full test suite", - skip = !config.components.run_full_tests, - commands = [ - "echo 'Running K9-SVC test suite...'", - - # Test k9-sign - "cd k9-sign && cargo test --release -- --test-threads=1", - "echo '✓ k9-sign tests passed'", - - # Test k9-scan - "./k9-scan examples/hello.k9.ncl", - "echo '✓ k9-scan works'", - - # Test must script - "./must status", - "echo '✓ must script works'", - - # Test dogfooding (validate K9 files in repo) - "./must run dogfood", - "echo '✓ Dogfooding validation passed'", - - "cd ..", - "echo 'All tests passed!'", - ], - }, - - "update-changelog" = { - description = "Update CHANGELOG.md with release notes", - skip = !config.documentation.update_changelog, - commands = [ - "echo 'Updating CHANGELOG.md...'", - - # Get commits since last tag - "last_tag=$(git describe --tags --abbrev=0 2>/dev/null || echo 'v0.0.0')", - "echo 'Changes since $last_tag:'", - "git log $last_tag..HEAD --oneline --pretty=format:'- %s' > .k9-release-notes.txt", - - # Prepend to CHANGELOG.md - "echo '## [%{new_version.version}] - $(date +%Y-%m-%d)' > .k9-changelog-new.txt", - "echo '' >> .k9-changelog-new.txt", - "cat .k9-release-notes.txt >> .k9-changelog-new.txt", - "echo '' >> .k9-changelog-new.txt", - "if [ -f CHANGELOG.md ]; then cat CHANGELOG.md >> .k9-changelog-new.txt; fi", - "mv .k9-changelog-new.txt CHANGELOG.md", - - "echo 'CHANGELOG.md updated'", - ], - }, - - "create-release-tarball" = { - description = "Create release tarball", - skip = !config.distribution.create_tarball, - dependencies = ["build-k9-sign", "run-tests"], - commands = [ - "echo 'Creating release tarball...'", - - "mkdir -p release/k9-svc-%{new_version.version}", - - # Copy essential files - "cp -r README.adoc SPEC.adoc GUIDE.adoc LICENSE SECURITY.md must justfile pedigree.ncl register.ncl examples/ release/k9-svc-%{new_version.version}/", - - # Copy k9-sign binary and docs - "cp k9-sign/target/release/k9-sign release/k9-svc-%{new_version.version}/", - "cp k9-sign/README.md k9-sign/MIGRATION.md release/k9-svc-%{new_version.version}/", - - # Copy k9-scan - "cp k9-scan release/k9-svc-%{new_version.version}/", - - # Copy security docs - "cp -r docs/ release/k9-svc-%{new_version.version}/", - - # Create tarball - "cd release && tar czf k9-svc-%{new_version.version}.tar.gz k9-svc-%{new_version.version}/", - - # Create checksums - "cd release && sha256sum k9-svc-%{new_version.version}.tar.gz > k9-svc-%{new_version.version}.tar.gz.sha256", - - "ls -lh release/k9-svc-%{new_version.version}.tar.gz", - "echo 'Release tarball created!'", - ], - }, - - "sign-release" = { - description = "Sign release artifacts with k9-sign", - skip = !config.signing.sign_release_artifacts, - dependencies = ["create-release-tarball"], - commands = [ - "echo 'Signing release artifacts...'", - - # Sign tarball - "k9-sign sign release/k9-svc-%{new_version.version}.tar.gz %{config.signing.signing_key_name}", - - # Verify signature - "if [ %{std.string.from config.signing.verify_signatures} = 'true' ]; then k9-sign verify release/k9-svc-%{new_version.version}.tar.gz; fi", - - "echo 'Release artifacts signed!'", - ], - }, - - "create-github-release" = { - description = "Create GitHub release", - skip = !config.github_release.create_release, - dependencies = ["sign-release"], - commands = [ - "echo 'Creating GitHub release v%{new_version.version}...'", - - # Create git tag - "git tag -a v%{new_version.version} -m 'Release v%{new_version.version}'", - "git push origin v%{new_version.version}", - - # Create GitHub release - "gh release create v%{new_version.version} " ++ - (if config.github_release.draft then "--draft " else "") ++ - (if config.github_release.prerelease then "--prerelease " else "") ++ - (if config.github_release.generate_notes then "--generate-notes " else "") ++ - "--title 'K9-SVC v%{new_version.version}' " ++ - "release/k9-svc-%{new_version.version}.tar.gz " ++ - "release/k9-svc-%{new_version.version}.tar.gz.sha256 " ++ - "release/k9-svc-%{new_version.version}.tar.gz.sig", - - "echo 'GitHub release created!'", - "echo 'Release URL: https://github.com/hyperpolymath/standards/tree/main/k9-svc/releases/tag/v%{new_version.version}'", - ], - }, - - "release" = { - description = "Complete release process (default)", - dependencies = [ - "check-prerequisites", - "bump-version", - "build-k9-sign", - "run-tests", - "update-changelog", - "create-release-tarball", - "sign-release", - "create-github-release", - ], - commands = [ - "echo ''", - "echo '╔══════════════════════════════════════════════════════════╗'", - "echo '║ ✅ K9-SVC v%{new_version.version} Release Complete! ║'", - "echo '╚══════════════════════════════════════════════════════════╝'", - "echo ''", - "echo 'Version: %{new_version.version}'", - "echo 'Release type: %{std.string.from config.release_type}'", - "echo 'Tarball: release/k9-svc-%{new_version.version}.tar.gz'", - "echo 'GitHub: https://github.com/hyperpolymath/standards/tree/main/k9-svc/releases/tag/v%{new_version.version}'", - "echo ''", - "echo 'Next steps:'", - "echo ' 1. Review GitHub release draft'", - "echo ' 2. Publish release when ready'", - "echo ' 3. Announce on social media / mailing lists'", - "echo ''", - "echo '🐕 K9 ate its own dog food - released using a K9 component!'", - "echo ''", - ], - }, -} - -validation = { - # Ensure release type is valid - valid_release_type = - config.release_type == 'Major - || config.release_type == 'Minor - || config.release_type == 'Patch - | doc "Release type must be Major, Minor, or Patch", - - # Ensure current version is valid semver - valid_semver = - std.string.is_match "^[0-9]+\\.[0-9]+\\.[0-9]+$" config.current_version - | doc "Current version must be valid semver (X.Y.Z)", - - # Ensure signing key name is non-empty if signing enabled - valid_signing_key = - !config.signing.sign_release_artifacts - || std.string.length config.signing.signing_key_name > 0 - | doc "Signing key name must be specified if signing is enabled", -} - -# Metadata for ultimate dogfooding -metadata = { - dogfooding_note = "This K9 component releases K9-SVC itself! It demonstrates how a K9 component can automate complex workflows with validation, signing, and multi-step processes.", - - security_note = "This release process uses k9-sign (built by K9-SVC) to sign release artifacts, creating a trust chain: K9 component → k9-sign → release artifacts.", - - demonstration = [ - "Hunt-level execution (full automation)", - "Multi-step dependencies (recipe ordering)", - "Conditional execution (skip recipes)", - "Version calculation (Nickel functions)", - "Validation contracts (semver, signing keys)", - "External tool integration (gh, git, cargo)", - ], -} diff --git a/k9-svc/scripts/deploy-site.sh b/k9-svc/scripts/deploy-site.sh deleted file mode 100755 index 2c05f0c3..00000000 --- a/k9-svc/scripts/deploy-site.sh +++ /dev/null @@ -1,33 +0,0 @@ -#!/usr/bin/env bash -# SPDX-License-Identifier: MPL-2.0 -# Build the k9-svc.net site with ddraig-ssg and deploy it to the Cloudflare -# Pages project "k9-svc". Requires CLOUDFLARE_API_TOKEN (Pages:Edit) and -# CLOUDFLARE_ACCOUNT_ID in the environment (e.g. `source ~/.secrets/cloudflare.env`). -# wrangler is run via Deno's npm-compat layer (no npm/node_modules/package.json -# on disk) per estate policy — "JS deps: Deno". -set -euo pipefail - -SITE_DIR="$(cd "$(dirname "$0")/.." && pwd)/site" -DDRAIG_REPO="${DDRAIG_REPO:-$(cd "$(dirname "$0")/../../.." && pwd)/ddraig-ssg}" -DDRAIG_BIN="$DDRAIG_REPO/build/exec/ddraig" -OUT_DIR="${OUT_DIR:-$(mktemp -d)}" -BASE_URL="https://k9-svc.net" -PROJECT_NAME="k9-svc" - -if [ ! -x "$DDRAIG_BIN" ]; then - echo "Building ddraig-ssg..." - ( cd "$DDRAIG_REPO" && idris2 Ddraig.idr -o ddraig ) -fi - -echo "Building $SITE_DIR -> $OUT_DIR (base $BASE_URL)" -"$DDRAIG_BIN" build "$SITE_DIR" "$OUT_DIR" "$BASE_URL" - -: "${CLOUDFLARE_API_TOKEN:?Set CLOUDFLARE_API_TOKEN (Pages:Edit) before deploying}" -: "${CLOUDFLARE_ACCOUNT_ID:?Set CLOUDFLARE_ACCOUNT_ID before deploying}" - -echo "Deploying $OUT_DIR to Cloudflare Pages project '$PROJECT_NAME'" -deno run -A npm:wrangler@4 pages deploy "$OUT_DIR" \ - --project-name="$PROJECT_NAME" \ - --branch=main - -echo "Done. Verify: curl -I $BASE_URL/ and $BASE_URL/.well-known/security.txt" diff --git a/k9-svc/showcase/content/examples.adoc b/k9-svc/showcase/content/examples.adoc deleted file mode 100644 index 070e52d4..00000000 --- a/k9-svc/showcase/content/examples.adoc +++ /dev/null @@ -1,282 +0,0 @@ -== Examples - -Concrete K9 files at each security level, with explanations of what is -happening and why. - -''''' - -=== 1. Kennel: Project Metadata - -[.badge .badge-kennel]#Kennel# Pure data — safe from any source. - -.... -K9! -# project.k9 — Project metadata for a Rust CLI tool -# Security Level: Kennel (pure data, no execution) - ---- -metadata: - name: panic-attacker - version: 3.2.1 - description: Pre-commit validation tool for RSR repositories - author: Jonathan D.A. Jewell - license: PMPL-1.0-or-later - -repository: - forge: github - owner: hyperpolymath - name: panic-attacker - default_branch: main - -dependencies: - runtime: - - name: nickel - version: ">=1.5.0" - purpose: Contract evaluation - - name: pandoc - version: ">=3.1" - purpose: K9 document processing - build: - - name: rust - version: ">=1.82.0" - -tags: - - cli - - validation - - pre-commit - - rsr -.... - -This is the simplest K9 form. It starts with the `+K9!+` magic bytes, -contains only structured data, and declares its pedigree in the -`+metadata+` section. Any tool can parse this safely — there is nothing -to evaluate, nothing to execute. The file is self-describing: you know -what it is, who wrote it, and what license governs it without consulting -any external source. - -''''' - -=== 2. Kennel: Container Deployment Manifest - -[.badge .badge-kennel]#Kennel# Deployment data for a container -orchestrator. - -.... -K9! -# deploy-manifest.k9 — Stapeln deployment for the K9 service -# Security Level: Kennel (data only) - ---- -metadata: - name: k9-svc-deploy - version: 1.0.0 - description: Deployment manifest for k9-svc container - license: PMPL-1.0-or-later - -deployment: - image: cgr.dev/hyperpolymath/k9-svc:1.0.0 - replicas: 3 - port: 8443 - protocol: https - - resources: - cpu_limit: "500m" - memory_limit: "256Mi" - cpu_request: "100m" - memory_request: "128Mi" - - health_check: - path: /healthz - interval_seconds: 30 - timeout_seconds: 5 - - environment: - K9_LOG_LEVEL: info - K9_TRUST_STORE: /etc/k9/trust - K9_SIGNATURE_VERIFY: "true" - - volumes: - - name: trust-store - mount_path: /etc/k9/trust - read_only: true -.... - -Even deployment manifests can be Kennel-level. The container -orchestrator reads this data and acts on it, but the manifest itself -does not execute anything. The `+K9!+` magic and pedigree let tooling -identify this as a K9 component rather than generic YAML. - -''''' - -=== 3. Yard: CI/CD Configuration with Contracts - -[.badge .badge-yard]#Yard# Nickel evaluation with contract validation. - -.... -# ci-config.k9.ncl — CI/CD pipeline configuration -# Security Level: Yard (contracts and types, no execution) - -let pedigree = import "pedigree.ncl" in -let ci_contracts = import "ci-contracts.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "ci-pipeline", - version = "2.1.0", - description = "CI/CD pipeline for pandoc-k9", - }, - - security = { - trust_level = 'Yard, - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - - # Nickel contracts enforce structural rules at type-check time - pipeline | ci_contracts.Pipeline = { - stages = [ - { - name = "lint", - image = "cgr.dev/hyperpolymath/ci-base:latest", - commands = ["just lint", "just check-format"], - timeout_minutes | ci_contracts.Timeout = 10, - }, - { - name = "test", - image = "cgr.dev/hyperpolymath/ci-base:latest", - commands = ["just test"], - timeout_minutes | ci_contracts.Timeout = 30, - needs = ["lint"], - }, - { - name = "build", - image = "cgr.dev/hyperpolymath/ci-base:latest", - commands = ["just build"], - timeout_minutes | ci_contracts.Timeout = 20, - needs = ["test"], - }, - ], - - # Contract: at least one stage must exist - # Contract: timeout_minutes must be between 1 and 120 - # Contract: 'needs' references must name existing stages - # These are enforced by ci_contracts.Pipeline — not by comments - }, - - validation = { - checksum = "a1b2c3d4e5f6...", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, -} -.... - -This is where K9 diverges from static data formats. The -`+ci_contracts.Pipeline+` contract is not a schema validated externally -— it is applied during Nickel evaluation and rejects invalid -configurations at type-check time. If you set `+timeout_minutes = 200+`, -the contract fails before the file is ever used by a CI runner. The -`+allow_subprocess = false+` declaration is enforced by the K9 runtime: -even though this is Nickel code, it cannot spawn processes. - -''''' - -=== 4. Hunt: Setup Script with Signed Recipes - -[.badge .badge-hunt]#Hunt# Executable recipes — cryptographic signature -required. - -.... -# setup.k9.ncl — Project setup with executable recipes -# Security Level: Hunt (execution, signature REQUIRED) -# -# K9-Signature: ed25519:JDAJewell:2026-03-16:a8f9c2... - -let pedigree = import "pedigree.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "project-setup", - version = "1.0.0", - description = "Initial setup for pandoc-k9 development environment", - }, - - target = { - os = 'Linux, - is_edge = false, - requires_podman = true, - }, - - security = { - trust_level = 'Hunt, - allow_network = true, - allow_filesystem_write = true, - allow_subprocess = true, - }, - - validation = { - checksum = "b7e4f8a1c3d9...", - pedigree_version = "1.0.0", - hunt_authorized = true, - }, - - # Recipe blocks — these actually execute - recipes = { - install = m%" - #!/bin/sh - set -euo pipefail - echo "Installing pandoc-k9 dependencies..." - cargo install nickel-lang-cli - cargo install pandoc-k9-tools - echo "Done." - "%, - - validate = m%" - #!/bin/sh - set -euo pipefail - nickel typecheck src/contracts/*.ncl - just test - "%, - - deploy = m%" - #!/bin/sh - set -euo pipefail - podman build -t k9-svc:latest -f Containerfile . - podman push k9-svc:latest cgr.dev/hyperpolymath/k9-svc:latest - "%, - - migrate = m%" - #!/bin/sh - echo "No migration needed for v1.0.0" - "%, - }, -} -.... - -This is Hunt level. The `+recipes+` block contains shell scripts that -will actually run on the host. Notice the `+K9-Signature+` header — -without a valid Ed25519 signature, every conforming K9 tool will refuse -to execute these recipes. The pedigree tells you who authored it, the -contracts prove it is structurally valid, and the signature proves it -has not been tampered with. - -The `+target.requires_podman = true+` declaration means this component -expects a Podman runtime. The `+security+` block explicitly declares -what I/O capabilities the recipes require. A K9 runtime can enforce -these declarations as a sandbox policy. - -''''' - -=== Key Observations - -[arabic] -. *Kennel files are always safe.* You can accept them from untrusted -sources, pipe them through CI, and display them to users without risk. -. *Yard files are safe but powerful.* They compute values and enforce -contracts, but they cannot reach outside the Nickel evaluator’s sandbox. -. *Hunt files are powerful but accountable.* Every execution is -traceable to a signed author, a specific version, and a validated -contract. -. *The pedigree is always present.* At every level, you know the -component’s name, version, and capabilities before you process it. diff --git a/k9-svc/showcase/content/getting-started.adoc b/k9-svc/showcase/content/getting-started.adoc deleted file mode 100644 index fb178451..00000000 --- a/k9-svc/showcase/content/getting-started.adoc +++ /dev/null @@ -1,280 +0,0 @@ -== Get Started - -From zero to a validated K9 component in six steps. - -''''' - -=== Prerequisites - -You will need: - -* *Pandoc* 3.1 or later — -https://pandoc.org/installing.html[pandoc.org/installing.html] -* *Nickel* 1.5 or later — https://nickel-lang.org/[nickel-lang.org] (for -Yard/Hunt levels) -* A text editor (VS Code recommended for syntax highlighting) - -''''' - -==== Install pandoc-k9 - -Clone the pandoc-k9 repository and make the Lua files available to -Pandoc: - -.... -git clone https://github.com/hyperpolymath/pandoc-k9.git -cd pandoc-k9 - -# Copy the Lua reader, writer, and filter to your Pandoc data directory -cp k9-reader.lua k9-writer.lua k9-filter.lua k9.lua \ - ~/.local/share/pandoc/ -cp k9.html ~/.local/share/pandoc/templates/ -.... - -Verify the installation: - -.... -pandoc --list-input-formats | grep k9 -.... - -==== Install the VS Code extension (optional) - -For syntax highlighting in VS Code: - -.... -# From the VS Code marketplace -code --install-extension hyperpolymath.vscode-k9 -.... - -This gives you security-level-aware highlighting: Kennel keywords in -green, Yard in amber, Hunt in red. It also provides bracket matching and -folding for K9 structures. - -==== Create your first Kennel-level file - -Create a file called `+hello.k9+`: - -.... -K9! -# hello.k9 — My first K9 component -# Security Level: Kennel (pure data, no execution) - ---- -metadata: - name: hello-k9 - version: 1.0.0 - description: My first self-validating component - author: Your Name - license: PMPL-1.0-or-later - -content: - greeting: "Hello from K9!" - message: | - This is a Kennel-level component. - It contains only data — no code, no execution. - Safe to parse from any source. - -tags: - - example - - kennel - - hello-world -.... - -This is the simplest possible K9 file. It starts with `+K9!+`, carries a -pedigree in the `+metadata+` section, and contains structured data. -Nothing more. - -==== Convert it with Pandoc - -Use the K9 reader to convert your file to HTML: - -.... -pandoc -f k9.lua hello.k9 \ - --lua-filter=k9-filter.lua \ - --template=k9.html \ - -o hello.html -.... - -Open `+hello.html+` in a browser. You will see a formatted K9 document -with a security-level header bar (green for Kennel), a pedigree summary -card, and styled content sections. - -Convert to other formats just as easily: - -.... -# To Markdown -pandoc -f k9.lua hello.k9 -t markdown -o hello.md - -# To JSON (Pandoc AST) -pandoc -f k9.lua hello.k9 -t json -o hello.json -.... - -==== Graduate to Yard level with Nickel contracts - -Create a file called `+config.k9.ncl+`: - -.... -# config.k9.ncl — Yard-level configuration with contracts -# Security Level: Yard (contracts and types, no execution) - -let pedigree = import "pedigree.ncl" in - -pedigree.K9Pedigree & { - metadata = { - name = "my-service-config", - version = "1.0.0", - description = "Service configuration with validated contracts", - }, - - security = { - trust_level = 'Yard, - allow_network = false, - allow_filesystem_write = false, - allow_subprocess = false, - }, - - # The | operator applies a Nickel contract - config = { - port | std.number.Nat - | std.contract.from_predicate (fun x => x >= 1024 && x <= 65535) - = 8443, - - log_level | [| 'debug, 'info, 'warn, 'error |] - = 'info, - - max_connections | std.number.Nat = 100, - }, - - validation = { - checksum = "...", - pedigree_version = "1.0.0", - hunt_authorized = false, - }, -} -.... - -Type-check it with Nickel: - -.... -nickel typecheck config.k9.ncl -.... - -If you change `+port+` to `+80+` (below 1024) or `+log_level+` to -`+'verbose+` (not in the enum), Nickel will reject the configuration at -type-check time — before it ever reaches a running service. - -==== Validate with the Contractile CLI - -If you have the Contractile CLI installed: - -.... -# Install contractile -cargo install contractile - -# Create the k9 symlink -ln -sf $(which contractile) ~/.local/bin/k9 - -# Evaluate a K9 component -k9 eval hello.k9 # Kennel: validates pedigree -k9 eval config.k9.ncl # Yard: validates pedigree + contracts -.... - -The `+k9 eval+` command checks pedigree structure, runs Nickel type -checking (for Yard/Hunt), and verifies signatures (for Hunt). It reports -the security level, any contract violations, and whether the component -is valid. - -''''' - -=== What Next? - -* *Read the link:security-levels.html[Security Levels] page* to -understand the trust model in depth. -* *Browse the link:examples.html[Examples]* for real-world K9 files at -each level. -* *Check the link:integrations.html[Integrations]* to see how K9 fits -into your existing toolchain. -* *Explore the https://github.com/hyperpolymath/pandoc-k9[pandoc-k9 -repository]* for the full source, tests, and documentation. - -''''' - -=== Common Patterns - -==== Using K9 in CI/CD - -Add K9 validation as a CI step: - -[source,yaml] ----- -# .github/workflows/k9-validate.yml -name: K9 Validation -on: [push, pull_request] -jobs: - validate: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v5 - - name: Install Nickel - run: cargo install nickel-lang-cli - - name: Validate K9 components - run: | - for f in $(find . -name '*.k9' -o -name '*.k9.ncl'); do - echo "Validating $f..." - k9 eval "$f" - done ----- - -==== Using K9 for Container Manifests - -Pair K9 with the Stapeln container ecosystem: - -.... -K9! -# my-service.k9 — Container deployment manifest - ---- -metadata: - name: my-service - version: 2.0.0 - description: Production deployment for my-service - license: PMPL-1.0-or-later - -container: - image: cgr.dev/my-org/my-service:2.0.0 - replicas: 3 - health_check: - path: /healthz - interval_seconds: 15 -.... - -==== Using K9 for Project Configuration - -Replace your `+config.yaml+` or `+settings.json+` with a self-describing -K9 file: - -.... -K9! -# app-config.k9 — Application configuration - ---- -metadata: - name: app-config - version: 1.0.0 - description: Runtime configuration for the application - license: PMPL-1.0-or-later - -database: - host: localhost - port: 5432 - name: app_production - pool_size: 10 - -cache: - backend: redis - ttl_seconds: 300 -.... - -The advantage over plain YAML: every tool that encounters this file -knows exactly what it is, who authored it, and what version it -represents — without parsing comments or guessing from file paths. diff --git a/k9-svc/showcase/content/index.adoc b/k9-svc/showcase/content/index.adoc deleted file mode 100644 index 38226e25..00000000 --- a/k9-svc/showcase/content/index.adoc +++ /dev/null @@ -1,96 +0,0 @@ -== K9: Self-Validating Components - -Configuration that knows what it is and proves what it does. - -.... -Kennel -Pure data, safe anywhere -.... - -.... -Yard -Contracts and types -.... - -.... -Hunt -Execution, signed -.... - -== What is K9? - -K9 is a configuration format where every component carries a *pedigree* -— a machine-readable declaration of its name, version, and security -level. Unlike YAML, TOML, or JSON, K9 files are not passive blobs of -data waiting for some external tool to interpret them. They declare what -they are and what they are allowed to do. - -At the simplest level, a `+.k9+` file is structured data (like YAML). At -the highest level, a `+.k9.ncl+` file is a Nickel program with formal -contracts, type checking, and even executable recipes — but only when -cryptographically signed. The security level is not an annotation bolted -on after the fact; it is intrinsic to the file format. - -== Three Security Levels - -K9 organises trust into three graduated levels: - -* [.badge .badge-kennel]#Kennel# *Pure data.* No evaluation, no -execution. `+.k9+` files are safe to process from any source, any -pipeline, any CI runner. Think `+package.json+` or `+Cargo.toml+` — just -data with a pedigree. -* [.badge .badge-yard]#Yard# *Nickel evaluation.* `+.k9.ncl+` files at -this level use Nickel contracts and types to compute values and validate -structure. They can express constraints like "`this port must be between -1024 and 65535`" or "`if `+target.os+` is Linux then `+requires_podman+` -must be true.`" No shell access, no filesystem writes — just typed -computation. -* [.badge .badge-hunt]#Hunt# *Full execution.* `+.k9.ncl+` files at this -level can contain recipe blocks that run shell commands. A cryptographic -signature is *required*. Unsigned Hunt-level files are rejected. This is -the level for setup scripts, deployment automation, and migration tasks -— all with an auditable trust chain. - -== Every Component Has a Pedigree - -Every K9 file starts with the magic bytes `+K9!+` and carries a pedigree -containing at minimum: - -* *name* — the component’s identity -* *version* — semantic version -* *security_level* — Kennel, Yard, or Hunt -* *description* — what the component does -* *license* — SPDX identifier - -This pedigree is not metadata hidden in a comment. It is part of the -format, validated by tooling, and queryable by machines. - -== Where K9 is Used - -K9 is designed for anywhere configuration meets trust: - -* *CI/CD pipelines* — declare build steps with contract-validated -parameters -* *Container deployment* — manifests that prove their own correctness -* *Project metadata* — richer than TOML, safer than arbitrary scripting -* *Deployment automation* — Hunt-level recipes with cryptographic -signing -* *Package manifests* — self-validating dependency declarations - -== Tooling Ecosystem - -K9 is not a specification without implementation. The tooling exists -today: - -* *Pandoc* — full reader, writer, filter, and template support via -https://github.com/hyperpolymath/pandoc-k9[pandoc-k9] -* *VS Code* — syntax highlighting for `+.k9+` and `+.k9.ncl+` -* *Tree-sitter* — grammar for editor integration -* *GitHub Linguist* — language detection (PR pending) -* *Nickel* — native contract system for Yard and Hunt levels -* *Contractile CLI* — K9 validation via the `+k9 eval+` command - -____ -K9 closes the gap between "`configuration as data`" and "`configuration -as code`" by making the boundary explicit, graduated, and auditable. -____ diff --git a/k9-svc/showcase/content/integrations.adoc b/k9-svc/showcase/content/integrations.adoc deleted file mode 100644 index 1d2fe1e8..00000000 --- a/k9-svc/showcase/content/integrations.adoc +++ /dev/null @@ -1,142 +0,0 @@ -== Integrations - -K9 is supported across editors, build tools, language ecosystems, and -CI/CD systems. These are not aspirational — they are implemented and -available. - -''''' - -=== Pandoc - -Full reader, writer, Lua filter, and HTML template for K9 documents. -Convert `+.k9+` and `+.k9.ncl+` files to HTML, Markdown, JSON, or any -Pandoc output format. The reader parses pedigree, contracts, and recipes -into Pandoc’s AST. The writer emits valid K9 from any Pandoc source. - -https://github.com/hyperpolymath/pandoc-k9[pandoc-k9 on GitHub] - -=== VS Code - -Syntax highlighting for `+.k9+` (Kennel) and `+.k9.ncl+` (Yard/Hunt) -files. Security-level-aware colouring: Kennel keywords in green, Yard in -amber, Hunt in red. Bracket matching, comment toggling, and folding for -K9 structures. - -https://github.com/hyperpolymath/vscode-k9[vscode-k9 on GitHub] - -=== Tree-sitter - -Tree-sitter grammar for K9 syntax, enabling editor support in Neovim, -Helix, Emacs, and any tree-sitter-compatible editor. Provides structural -parsing for syntax highlighting, code folding, and incremental parsing. - -https://github.com/hyperpolymath/tree-sitter-k9[tree-sitter-k9 on -GitHub] - -=== GitHub Linguist - -Language detection for K9 files in GitHub repositories. When merged, -GitHub will recognise `+.k9+` and `+.k9.ncl+` files, display them with -K9 syntax highlighting, and include them in repository language -statistics. - -https://github.com/github-linguist/linguist/pulls[Linguist PR (pending)] - -=== Nickel - -K9’s contract system is built on https://nickel-lang.org/[Nickel], the -configuration language with formal contracts. Yard and Hunt-level K9 -files are valid Nickel programs that import a shared pedigree contract. -Nickel’s type system, merge semantics, and contract checking are K9’s -foundation. - -https://nickel-lang.org/[nickel-lang.org] - -=== Contractile CLI - -The Contractile CLI includes a `+k9+` subcommand for evaluating K9 -components. Run `+k9 eval+` to type-check contracts, verify signatures, -and validate pedigrees. Integrates with the broader Contractile -toolchain (`+must+`, `+trust+`, `+dust+`, `+intend+`). - -https://github.com/hyperpolymath/contractiles[contractiles on GitHub] - -=== LuaRocks - -Lua library for parsing and emitting K9 files. Used internally by the -Pandoc reader and writer but also available as a standalone library for -Lua projects. Handles all three security levels and validates pedigree -structure. - -https://luarocks.org/modules/hyperpolymath/lua-k9[lua-k9 on LuaRocks] - -=== Hackage (coming soon) - -Haskell library for K9 parsing, validation, and emission. Will provide -`+Data.K9.Pedigree+`, `+Data.K9.Parse+`, and `+Data.K9.Contract+` -modules. Planned for release alongside the Pandoc native reader. - -''''' - -=== Integration Architecture - -K9 tooling follows a layered model: - -==== Layer 1: Parsing - -Every tool that reads K9 must handle the `+K9!+` magic number and parse -the pedigree. For Kennel-level files, this is all that is needed — the -rest is standard YAML-like structured data. - -==== Layer 2: Evaluation - -Tools that support Yard-level files must integrate the Nickel evaluator. -This means importing contracts, running type checks, and resolving merge -operations. The Nickel evaluator runs in a sandbox with no I/O access. - -==== Layer 3: Execution - -Tools that support Hunt-level files must verify cryptographic signatures -before executing recipe blocks. The signature verification happens -before any code runs — an invalid or missing signature means the recipes -are never executed. - -==== Layer 4: Transformation - -Pandoc sits at this layer. It can read K9 at any level, transform it -through its AST, and emit it in any output format. The K9 Lua filter -annotates the AST with security-level metadata, contract types, and -pedigree information for rich HTML output. - -''''' - -=== Repository Links - -[width="100%",cols="34%,33%,33%",options="header",] -|=== -|Integration |Repository |Status -|Pandoc reader/writer/filter/template -|https://github.com/hyperpolymath/pandoc-k9[pandoc-k9] |Released - -|VS Code extension -|https://github.com/hyperpolymath/vscode-k9[vscode-k9] |Released - -|Tree-sitter grammar -|https://github.com/hyperpolymath/tree-sitter-k9[tree-sitter-k9] -|Released - -|GitHub Linguist |https://github.com/github-linguist/linguist[linguist -PR] |Pending - -|Nickel contracts -|https://github.com/hyperpolymath/pandoc-k9/tree/main/src/contracts[pandoc-k9/src/contracts] -|Released - -|Contractile CLI -|https://github.com/hyperpolymath/contractiles[contractiles] |Released - -|Lua library |https://luarocks.org/modules/hyperpolymath/lua-k9[lua-k9] -|Released - -|Haskell library |— |Planned -|=== diff --git a/k9-svc/showcase/content/security-levels.adoc b/k9-svc/showcase/content/security-levels.adoc deleted file mode 100644 index b7ab1abd..00000000 --- a/k9-svc/showcase/content/security-levels.adoc +++ /dev/null @@ -1,172 +0,0 @@ -== Security Levels - -K9 organises trust into three graduated levels. Each level defines -precisely what a component is allowed to do. The security level is not -an annotation — it is a structural property of the file, enforced by the -format and validated by every tool in the chain. - -''''' - -=== Kennel — Pure Data - -*File extension:* `+.k9+` *Indicator:* [.badge .badge-kennel]#Kennel# - -Kennel-level components are inert. They contain structured data and -nothing else. No expressions are evaluated, no functions are called, no -external resources are accessed. A Kennel-level file can be safely -processed by any tool, in any environment, from any source. - -*What Kennel can do:* - -* Declare key-value pairs, nested records, and arrays -* Carry a pedigree (name, version, description, license) -* Be parsed, displayed, queried, and transformed -* Be included in pipelines without sandboxing - -*What Kennel cannot do:* - -* Evaluate expressions or call functions -* Access the filesystem, network, or environment variables -* Import other files or modules -* Execute any code whatsoever - -*Analogues:* `+package.json+`, `+Cargo.toml+`, YAML data files, JSON -configs. - -A Kennel file is what you reach for when you need structured data with -identity. It is the safest possible configuration: machine-readable, -human- writable, and provably inert. - -=== Yard — Contracts and Types - -*File extension:* `+.k9.ncl+` *Indicator:* [.badge .badge-yard]#Yard# - -Yard-level components are Nickel programs. They can use the full Nickel -contract system: types, merge operations, conditional logic, and -computed values. This is where K9 becomes more than data — it becomes -configuration that validates itself. - -*What Yard can do:* - -* Everything Kennel can do -* Evaluate Nickel expressions and merge records -* Apply type contracts (`+Std.number.Nat+`, `+Std.string.NonEmpty+`, -custom) -* Use conditional logic (`+if target.os == 'Linux then ...+`) -* Import other `+.ncl+` files and apply contract composition -* Compute derived values from inputs - -*What Yard cannot do:* - -* Execute shell commands or spawn processes -* Write to the filesystem -* Access the network -* Run recipe blocks -* Anything requiring a cryptographic signature - -*Analogues:* Dhall, Jsonnet, CUE — but with Nickel’s formal contract -system rather than informal schema checking. - -Yard is the level for CI/CD configurations, deployment manifests, and -any scenario where you need computed values with provable constraints. A -Yard-level component can guarantee that "`every port in this list is -unique and within the valid range`" or "`if high-availability is enabled -then replica count must be at least 3.`" - -=== Hunt — Execution with Trust - -*File extension:* `+.k9.ncl+` *Indicator:* [.badge .badge-hunt]#Hunt# - -Hunt-level components can do everything Yard can do, plus execute shell -commands via recipe blocks. This is the most powerful level and the most -restricted: a Hunt-level file *must* carry a valid cryptographic -signature. Unsigned Hunt files are rejected by all conforming tools. - -*What Hunt can do:* - -* Everything Yard can do -* Define recipe blocks (`+install+`, `+validate+`, `+deploy+`, -`+migrate+`) -* Execute shell commands within those recipes -* Access the filesystem and network (within recipe scope) -* Chain recipes in defined order - -*What Hunt requires:* - -* A valid cryptographic signature over the file contents -* An `+hunt_authorized = true+` flag in the validation section -* A checksum matching the file’s content hash - -*Analogues:* Makefiles, Justfiles, CI/CD scripts — but with a pedigree, -contracts, and a mandatory trust chain. - -Hunt is the level for setup scripts, migration tasks, deployment -automation, and anything that needs to run commands. The signature -requirement ensures that Hunt-level files cannot be injected or tampered -with. You know who authored it, you know it has not changed, and the -contracts prove it is structurally valid. - -''''' - -=== Comparison - -[width="100%",cols="25%,25%,25%,25%",options="header",] -|=== -|Capability |[.badge .badge-kennel]#Kennel# |[.badge .badge-yard]#Yard# -|[.badge .badge-hunt]#Hunt# -|Structured data |Yes |Yes |Yes - -|Pedigree |Yes |Yes |Yes - -|Nickel expressions |No |Yes |Yes - -|Type contracts |No |Yes |Yes - -|Conditional logic |No |Yes |Yes - -|File imports |No |Yes |Yes - -|Shell execution |No |No |Yes - -|Filesystem access |No |No |Yes - -|Network access |No |No |Yes - -|Signature required |No |No |*Yes* -|=== - -=== Trust Escalation - -Moving between levels is a deliberate act with clear semantics: - -*Kennel to Yard:* You are adding computation. The file moves from -`+.k9+` to `+.k9.ncl+` and gains access to the Nickel evaluator. This is -appropriate when static data is insufficient — when you need derived -values, conditional logic, or contract validation. No signature is -required, but the evaluator runs in a sandbox with no I/O access. - -*Yard to Hunt:* You are adding execution. The file remains `+.k9.ncl+` -but the `+security.trust_level+` changes from `+'Yard+` to `+'Hunt+`, -and the `+validation.hunt_authorized+` flag must be set to `+true+`. A -cryptographic signature over the full file content is now mandatory. -This is the most significant escalation: you are granting the -configuration the ability to run commands on the host system. - -*There is no path from Kennel directly to Hunt.* A component must pass -through Yard to reach Hunt. This ensures that every executable -configuration has been through the contract validation stage first. - -==== Why Not Just One Level? - -Because most configuration does not need execution, and treating all -configuration as equally dangerous leads to either: - -[arabic] -. *Over-permissive systems* where every config file can run arbitrary -code (the Makefile problem), or -. *Over-restrictive systems* where configuration is limited to static -data and all logic lives elsewhere (the JSON problem). - -K9’s three levels let you match the trust model to the actual -requirements. Data stays as data. Computation stays sandboxed. Execution -stays signed. diff --git a/k9-svc/showcase/output/examples.html b/k9-svc/showcase/output/examples.html deleted file mode 100644 index 2aa7005e..00000000 --- a/k9-svc/showcase/output/examples.html +++ /dev/null @@ -1,1119 +0,0 @@ - - -

-

Examples

-

Concrete K9 files at each security level, with explanations of what is happening and why.

-

---

-

1. Kennel: Project Metadata

-

Kennel Pure data — safe from any source.

-
K9!
-# project.k9 — Project metadata for a Rust CLI tool
-# Security Level: Kennel (pure data, no execution)
-
----
-metadata:
-  name: panic-attacker
-  version: 3.2.1
-  description: Pre-commit validation tool for RSR repositories
-  author: Jonathan D.A. Jewell
-  license: PMPL-1.0-or-later
-
-repository:
-  forge: github
-  owner: hyperpolymath
-  name: panic-attacker
-  default_branch: main
-
-dependencies:
-  runtime:
-    - name: nickel
-      version: ">=1.5.0"
-      purpose: Contract evaluation
-    - name: pandoc
-      version: ">=3.1"
-      purpose: K9 document processing
-  build:
-    - name: rust
-      version: ">=1.82.0"
-
-tags:
-  - cli
-  - validation
-  - pre-commit
-  - rsr
-
-

This is the simplest K9 form. It starts with the K9! magic bytes, contains only structured data, and declares its pedigree in the metadata section. Any tool can parse this safely — there is nothing to evaluate, nothing to execute. The file is self-describing: you know what it is, who wrote it, and what license governs it without consulting any external source.

-

---

-

2. Kennel: Container Deployment Manifest

-

Kennel Deployment data for a container orchestrator.

-
K9!
-# deploy-manifest.k9 — Stapeln deployment for the K9 service
-# Security Level: Kennel (data only)
-
----
-metadata:
-  name: k9-svc-deploy
-  version: 1.0.0
-  description: Deployment manifest for k9-svc container
-  license: PMPL-1.0-or-later
-
-deployment:
-  image: cgr.dev/hyperpolymath/k9-svc:1.0.0
-  replicas: 3
-  port: 8443
-  protocol: https
-
-  resources:
-    cpu_limit: "500m"
-    memory_limit: "256Mi"
-    cpu_request: "100m"
-    memory_request: "128Mi"
-
-  health_check:
-    path: /healthz
-    interval_seconds: 30
-    timeout_seconds: 5
-
-  environment:
-    K9_LOG_LEVEL: info
-    K9_TRUST_STORE: /etc/k9/trust
-    K9_SIGNATURE_VERIFY: "true"
-
-  volumes:
-    - name: trust-store
-      mount_path: /etc/k9/trust
-      read_only: true
-
-

Even deployment manifests can be Kennel-level. The container orchestrator reads this data and acts on it, but the manifest itself does not execute anything. The K9! magic and pedigree let tooling identify this as a K9 component rather than generic YAML.

-

---

-

3. Yard: CI/CD Configuration with Contracts

-

Yard Nickel evaluation with contract validation.

-
# ci-config.k9.ncl — CI/CD pipeline configuration
-# Security Level: Yard (contracts and types, no execution)
-
-let pedigree = import "pedigree.ncl" in
-let ci_contracts = import "ci-contracts.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "ci-pipeline",
-    version = "2.1.0",
-    description = "CI/CD pipeline for pandoc-k9",
-  },
-
-  security = {
-    trust_level = 'Yard,
-    allow_network = false,
-    allow_filesystem_write = false,
-    allow_subprocess = false,
-  },
-
-  # Nickel contracts enforce structural rules at type-check time
-  pipeline | ci_contracts.Pipeline = {
-    stages = [
-      {
-        name = "lint",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just lint", "just check-format"],
-        timeout_minutes | ci_contracts.Timeout = 10,
-      },
-      {
-        name = "test",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just test"],
-        timeout_minutes | ci_contracts.Timeout = 30,
-        needs = ["lint"],
-      },
-      {
-        name = "build",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just build"],
-        timeout_minutes | ci_contracts.Timeout = 20,
-        needs = ["test"],
-      },
-    ],
-
-    # Contract: at least one stage must exist
-    # Contract: timeout_minutes must be between 1 and 120
-    # Contract: 'needs' references must name existing stages
-    # These are enforced by ci_contracts.Pipeline — not by comments
-  },
-
-  validation = {
-    checksum = "a1b2c3d4e5f6...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = false,
-  },
-}
-
-

This is where K9 diverges from static data formats. The ci_contracts.Pipeline contract is not a schema validated externally — it is applied during Nickel evaluation and rejects invalid configurations at type-check time. If you set timeout_minutes = 200, the contract fails before the file is ever used by a CI runner. The allow_subprocess = false declaration is enforced by the K9 runtime: even though this is Nickel code, it cannot spawn processes.

-

---

-

4. Hunt: Setup Script with Signed Recipes

-

Hunt Executable recipes — cryptographic signature required.

-
# setup.k9.ncl — Project setup with executable recipes
-# Security Level: Hunt (execution, signature REQUIRED)
-#
-# K9-Signature: ed25519:JDAJewell:2026-03-16:a8f9c2...
-
-let pedigree = import "pedigree.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "project-setup",
-    version = "1.0.0",
-    description = "Initial setup for pandoc-k9 development environment",
-  },
-
-  target = {
-    os = 'Linux,
-    is_edge = false,
-    requires_podman = true,
-  },
-
-  security = {
-    trust_level = 'Hunt,
-    allow_network = true,
-    allow_filesystem_write = true,
-    allow_subprocess = true,
-  },
-
-  validation = {
-    checksum = "b7e4f8a1c3d9...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = true,
-  },
-
-  # Recipe blocks — these actually execute
-  recipes = {
-    install = m%"
-      #!/bin/sh
-      set -euo pipefail
-      echo "Installing pandoc-k9 dependencies..."
-      cargo install nickel-lang-cli
-      cargo install pandoc-k9-tools
-      echo "Done."
-    "%,
-
-    validate = m%"
-      #!/bin/sh
-      set -euo pipefail
-      nickel typecheck src/contracts/*.ncl
-      just test
-    "%,
-
-    deploy = m%"
-      #!/bin/sh
-      set -euo pipefail
-      podman build -t k9-svc:latest -f Containerfile .
-      podman push k9-svc:latest cgr.dev/hyperpolymath/k9-svc:latest
-    "%,
-
-    migrate = m%"
-      #!/bin/sh
-      echo "No migration needed for v1.0.0"
-    "%,
-  },
-}
-
-

This is Hunt level. The recipes block contains shell scripts that will actually run on the host. Notice the K9-Signature header — without a valid Ed25519 signature, every conforming K9 tool will refuse to execute these recipes. The pedigree tells you who authored it, the contracts prove it is structurally valid, and the signature proves it has not been tampered with.

-

The target.requires_podman = true declaration means this component expects a Podman runtime. The security block explicitly declares what I/O capabilities the recipes require. A K9 runtime can enforce these declarations as a sandbox policy.

-

---

-

Key Observations

-

1. Kennel files are always safe. You can accept them from untrusted sources, pipe them through CI, and display them to users without risk.

-

2. Yard files are safe but powerful. They compute values and enforce contracts, but they cannot reach outside the Nickel evaluator's sandbox.

-

3. Hunt files are powerful but accountable. Every execution is traceable to a signed author, a specific version, and a validated contract.

-

4. The pedigree is always present. At every level, you know the component's name, version, and capabilities before you process it.

- — Rendered Markdown body -
  • K9
    • -
  • Security Levels
    • -
  • Examples
    • -
  • Integrations
    • -
  • Get Started
    • - — Auto-generated navigation tabs - page-examples — CSS class derived from page - examples — URL slug for the page ---> - - - - - - - Examples — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    -

    -

    Examples

    -

    Concrete K9 files at each security level, with explanations of what is happening and why.

    -

    ---

    -

    1. Kennel: Project Metadata

    -

    Kennel Pure data — safe from any source.

    -
    K9!
-# project.k9 — Project metadata for a Rust CLI tool
-# Security Level: Kennel (pure data, no execution)
-
----
-metadata:
-  name: panic-attacker
-  version: 3.2.1
-  description: Pre-commit validation tool for RSR repositories
-  author: Jonathan D.A. Jewell
-  license: PMPL-1.0-or-later
-
-repository:
-  forge: github
-  owner: hyperpolymath
-  name: panic-attacker
-  default_branch: main
-
-dependencies:
-  runtime:
-    - name: nickel
-      version: ">=1.5.0"
-      purpose: Contract evaluation
-    - name: pandoc
-      version: ">=3.1"
-      purpose: K9 document processing
-  build:
-    - name: rust
-      version: ">=1.82.0"
-
-tags:
-  - cli
-  - validation
-  - pre-commit
-  - rsr
-
    -

    This is the simplest K9 form. It starts with the K9! magic bytes, contains only structured data, and declares its pedigree in the metadata section. Any tool can parse this safely — there is nothing to evaluate, nothing to execute. The file is self-describing: you know what it is, who wrote it, and what license governs it without consulting any external source.

    -

    ---

    -

    2. Kennel: Container Deployment Manifest

    -

    Kennel Deployment data for a container orchestrator.

    -
    K9!
-# deploy-manifest.k9 — Stapeln deployment for the K9 service
-# Security Level: Kennel (data only)
-
----
-metadata:
-  name: k9-svc-deploy
-  version: 1.0.0
-  description: Deployment manifest for k9-svc container
-  license: PMPL-1.0-or-later
-
-deployment:
-  image: cgr.dev/hyperpolymath/k9-svc:1.0.0
-  replicas: 3
-  port: 8443
-  protocol: https
-
-  resources:
-    cpu_limit: "500m"
-    memory_limit: "256Mi"
-    cpu_request: "100m"
-    memory_request: "128Mi"
-
-  health_check:
-    path: /healthz
-    interval_seconds: 30
-    timeout_seconds: 5
-
-  environment:
-    K9_LOG_LEVEL: info
-    K9_TRUST_STORE: /etc/k9/trust
-    K9_SIGNATURE_VERIFY: "true"
-
-  volumes:
-    - name: trust-store
-      mount_path: /etc/k9/trust
-      read_only: true
-
    -

    Even deployment manifests can be Kennel-level. The container orchestrator reads this data and acts on it, but the manifest itself does not execute anything. The K9! magic and pedigree let tooling identify this as a K9 component rather than generic YAML.

    -

    ---

    -

    3. Yard: CI/CD Configuration with Contracts

    -

    Yard Nickel evaluation with contract validation.

    -
    # ci-config.k9.ncl — CI/CD pipeline configuration
-# Security Level: Yard (contracts and types, no execution)
-
-let pedigree = import "pedigree.ncl" in
-let ci_contracts = import "ci-contracts.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "ci-pipeline",
-    version = "2.1.0",
-    description = "CI/CD pipeline for pandoc-k9",
-  },
-
-  security = {
-    trust_level = 'Yard,
-    allow_network = false,
-    allow_filesystem_write = false,
-    allow_subprocess = false,
-  },
-
-  # Nickel contracts enforce structural rules at type-check time
-  pipeline | ci_contracts.Pipeline = {
-    stages = [
-      {
-        name = "lint",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just lint", "just check-format"],
-        timeout_minutes | ci_contracts.Timeout = 10,
-      },
-      {
-        name = "test",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just test"],
-        timeout_minutes | ci_contracts.Timeout = 30,
-        needs = ["lint"],
-      },
-      {
-        name = "build",
-        image = "cgr.dev/hyperpolymath/ci-base:latest",
-        commands = ["just build"],
-        timeout_minutes | ci_contracts.Timeout = 20,
-        needs = ["test"],
-      },
-    ],
-
-    # Contract: at least one stage must exist
-    # Contract: timeout_minutes must be between 1 and 120
-    # Contract: 'needs' references must name existing stages
-    # These are enforced by ci_contracts.Pipeline — not by comments
-  },
-
-  validation = {
-    checksum = "a1b2c3d4e5f6...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = false,
-  },
-}
-
    -

    This is where K9 diverges from static data formats. The ci_contracts.Pipeline contract is not a schema validated externally — it is applied during Nickel evaluation and rejects invalid configurations at type-check time. If you set timeout_minutes = 200, the contract fails before the file is ever used by a CI runner. The allow_subprocess = false declaration is enforced by the K9 runtime: even though this is Nickel code, it cannot spawn processes.

    -

    ---

    -

    4. Hunt: Setup Script with Signed Recipes

    -

    Hunt Executable recipes — cryptographic signature required.

    -
    # setup.k9.ncl — Project setup with executable recipes
-# Security Level: Hunt (execution, signature REQUIRED)
-#
-# K9-Signature: ed25519:JDAJewell:2026-03-16:a8f9c2...
-
-let pedigree = import "pedigree.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "project-setup",
-    version = "1.0.0",
-    description = "Initial setup for pandoc-k9 development environment",
-  },
-
-  target = {
-    os = 'Linux,
-    is_edge = false,
-    requires_podman = true,
-  },
-
-  security = {
-    trust_level = 'Hunt,
-    allow_network = true,
-    allow_filesystem_write = true,
-    allow_subprocess = true,
-  },
-
-  validation = {
-    checksum = "b7e4f8a1c3d9...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = true,
-  },
-
-  # Recipe blocks — these actually execute
-  recipes = {
-    install = m%"
-      #!/bin/sh
-      set -euo pipefail
-      echo "Installing pandoc-k9 dependencies..."
-      cargo install nickel-lang-cli
-      cargo install pandoc-k9-tools
-      echo "Done."
-    "%,
-
-    validate = m%"
-      #!/bin/sh
-      set -euo pipefail
-      nickel typecheck src/contracts/*.ncl
-      just test
-    "%,
-
-    deploy = m%"
-      #!/bin/sh
-      set -euo pipefail
-      podman build -t k9-svc:latest -f Containerfile .
-      podman push k9-svc:latest cgr.dev/hyperpolymath/k9-svc:latest
-    "%,
-
-    migrate = m%"
-      #!/bin/sh
-      echo "No migration needed for v1.0.0"
-    "%,
-  },
-}
-
    -

    This is Hunt level. The recipes block contains shell scripts that will actually run on the host. Notice the K9-Signature header — without a valid Ed25519 signature, every conforming K9 tool will refuse to execute these recipes. The pedigree tells you who authored it, the contracts prove it is structurally valid, and the signature proves it has not been tampered with.

    -

    The target.requires_podman = true declaration means this component expects a Podman runtime. The security block explicitly declares what I/O capabilities the recipes require. A K9 runtime can enforce these declarations as a sandbox policy.

    -

    ---

    -

    Key Observations

    -

    1. Kennel files are always safe. You can accept them from untrusted sources, pipe them through CI, and display them to users without risk.

    -

    2. Yard files are safe but powerful. They compute values and enforce contracts, but they cannot reach outside the Nickel evaluator's sandbox.

    -

    3. Hunt files are powerful but accountable. Every execution is traceable to a signed author, a specific version, and a validated contract.

    -

    4. The pedigree is always present. At every level, you know the component's name, version, and capabilities before you process it.

    - -
    -
    - - - - diff --git a/k9-svc/showcase/output/getting-started.html b/k9-svc/showcase/output/getting-started.html deleted file mode 100644 index 1e2badf2..00000000 --- a/k9-svc/showcase/output/getting-started.html +++ /dev/null @@ -1,1109 +0,0 @@ - - -

    -

    Get Started

    -

    From zero to a validated K9 component in six steps.

    -

    ---

    -

    Prerequisites

    -

    You will need:

    -
      -
    • Pandoc 3.1 or later — [pandoc.org/installing.html](https://pandoc.org/installing.html)
      • -
    • Nickel 1.5 or later — [nickel-lang.org](https://nickel-lang.org/) (for Yard/Hunt levels)
      • -
    • A text editor (VS Code recommended for syntax highlighting)
      • -
    -

    ---

    -

      -

    1. -

      Install pandoc-k9

      -

      Clone the pandoc-k9 repository and make the Lua files available to Pandoc:

      -
      git clone https://github.com/hyperpolymath/pandoc-k9.git
-cd pandoc-k9
-
-# Copy the Lua reader, writer, and filter to your Pandoc data directory
-cp k9-reader.lua k9-writer.lua k9-filter.lua k9.lua \
-   ~/.local/share/pandoc/
-cp k9.html ~/.local/share/pandoc/templates/
-
      -

      Verify the installation:

      -
      pandoc --list-input-formats | grep k9
-
      -

      2. -

    2. -

      Install the VS Code extension (optional)

      -

      For syntax highlighting in VS Code:

      -
      # From the VS Code marketplace
-code --install-extension hyperpolymath.vscode-k9
-
      -

      This gives you security-level-aware highlighting: Kennel keywords in green, Yard in amber, Hunt in red. It also provides bracket matching and folding for K9 structures.

      -

      3. -

    3. -

      Create your first Kennel-level file

      -

      Create a file called hello.k9:

      -
      K9!
-# hello.k9 — My first K9 component
-# Security Level: Kennel (pure data, no execution)
-
----
-metadata:
-  name: hello-k9
-  version: 1.0.0
-  description: My first self-validating component
-  author: Your Name
-  license: PMPL-1.0-or-later
-
-content:
-  greeting: "Hello from K9!"
-  message: |
-    This is a Kennel-level component.
-    It contains only data — no code, no execution.
-    Safe to parse from any source.
-
-tags:
-  - example
-  - kennel
-  - hello-world
-
      -

      This is the simplest possible K9 file. It starts with K9!, carries a pedigree in the metadata section, and contains structured data. Nothing more.

      -

      4. -

    4. -

      Convert it with Pandoc

      -

      Use the K9 reader to convert your file to HTML:

      -
      pandoc -f k9.lua hello.k9 \
-       --lua-filter=k9-filter.lua \
-       --template=k9.html \
-       -o hello.html
-
      -

      Open hello.html in a browser. You will see a formatted K9 document with a security-level header bar (green for Kennel), a pedigree summary card, and styled content sections.

      -

      Convert to other formats just as easily:

      -
      # To Markdown
-pandoc -f k9.lua hello.k9 -t markdown -o hello.md
-
-# To JSON (Pandoc AST)
-pandoc -f k9.lua hello.k9 -t json -o hello.json
-
      -

      5. -

    5. -

      Graduate to Yard level with Nickel contracts

      -

      Create a file called config.k9.ncl:

      -
      # config.k9.ncl — Yard-level configuration with contracts
-# Security Level: Yard (contracts and types, no execution)
-
-let pedigree = import "pedigree.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "my-service-config",
-    version = "1.0.0",
-    description = "Service configuration with validated contracts",
-  },
-
-  security = {
-    trust_level = 'Yard,
-    allow_network = false,
-    allow_filesystem_write = false,
-    allow_subprocess = false,
-  },
-
-  # The | operator applies a Nickel contract
-  config = {
-    port | std.number.Nat
-         | std.contract.from_predicate (fun x => x >= 1024 && x <= 65535)
-         = 8443,
-
-    log_level | [| 'debug, 'info, 'warn, 'error |]
-              = 'info,
-
-    max_connections | std.number.Nat = 100,
-  },
-
-  validation = {
-    checksum = "...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = false,
-  },
-}
-
      -

      Type-check it with Nickel:

      -
      nickel typecheck config.k9.ncl
-
      -

      If you change port to 80 (below 1024) or log_level to 'verbose (not in the enum), Nickel will reject the configuration at type-check time — before it ever reaches a running service.

      -

      6. -

    6. -

      Validate with the Contractile CLI

      -

      If you have the Contractile CLI installed:

      -
      # Install contractile
-cargo install contractile
-
-# Create the k9 symlink
-ln -sf $(which contractile) ~/.local/bin/k9
-
-# Evaluate a K9 component
-k9 eval hello.k9           # Kennel: validates pedigree
-k9 eval config.k9.ncl      # Yard: validates pedigree + contracts
-
      -

      The k9 eval command checks pedigree structure, runs Nickel type checking (for Yard/Hunt), and verifies signatures (for Hunt). It reports the security level, any contract violations, and whether the component is valid.

      -

      7. -

    -

    ---

    -

    What Next?

    -
      -
    • Read the [Security Levels](security-levels.html) page to understand the
      • -

      trust model in depth.

      -
    • Browse the [Examples](examples.html) for real-world K9 files at each level.
      • -
    • Check the [Integrations](integrations.html) to see how K9 fits into your
      • -

      existing toolchain.

      -
    • Explore the [pandoc-k9 repository](https://github.com/hyperpolymath/pandoc-k9)
      • -

      for the full source, tests, and documentation.

      -
    -

    ---

    -

    Common Patterns

    -

    Using K9 in CI/CD

    -

    Add K9 validation as a CI step:

    -
    # .github/workflows/k9-validate.yml
-name: K9 Validation
-on: [push, pull_request]
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Install Nickel
-        run: cargo install nickel-lang-cli
-      - name: Validate K9 components
-        run: |
-          for f in $(find . -name '*.k9' -o -name '*.k9.ncl'); do
-            echo "Validating $f..."
-            k9 eval "$f"
-          done
-
    -

    Using K9 for Container Manifests

    -

    Pair K9 with the Stapeln container ecosystem:

    -
    K9!
-# my-service.k9 — Container deployment manifest
-
----
-metadata:
-  name: my-service
-  version: 2.0.0
-  description: Production deployment for my-service
-  license: PMPL-1.0-or-later
-
-container:
-  image: cgr.dev/my-org/my-service:2.0.0
-  replicas: 3
-  health_check:
-    path: /healthz
-    interval_seconds: 15
-
    -

    Using K9 for Project Configuration

    -

    Replace your config.yaml or settings.json with a self-describing K9 file:

    -
    K9!
-# app-config.k9 — Application configuration
-
----
-metadata:
-  name: app-config
-  version: 1.0.0
-  description: Runtime configuration for the application
-  license: PMPL-1.0-or-later
-
-database:
-  host: localhost
-  port: 5432
-  name: app_production
-  pool_size: 10
-
-cache:
-  backend: redis
-  ttl_seconds: 300
-
    -

    The advantage over plain YAML: every tool that encounters this file knows exactly what it is, who authored it, and what version it represents — without parsing comments or guessing from file paths.

    - — Rendered Markdown body -
  • K9
    • -
  • Security Levels
    • -
  • Examples
    • -
  • Integrations
    • -
  • Get Started
    • - — Auto-generated navigation tabs - page-getting-started — CSS class derived from page - getting-started — URL slug for the page ---> - - - - - - - Get Started — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    -

    -

    Get Started

    -

    From zero to a validated K9 component in six steps.

    -

    ---

    -

    Prerequisites

    -

    You will need:

    -
      -
    • Pandoc 3.1 or later — [pandoc.org/installing.html](https://pandoc.org/installing.html)
      • -
    • Nickel 1.5 or later — [nickel-lang.org](https://nickel-lang.org/) (for Yard/Hunt levels)
      • -
    • A text editor (VS Code recommended for syntax highlighting)
      • -
    -

    ---

    -

      -

    1. -

      Install pandoc-k9

      -

      Clone the pandoc-k9 repository and make the Lua files available to Pandoc:

      -
      git clone https://github.com/hyperpolymath/pandoc-k9.git
-cd pandoc-k9
-
-# Copy the Lua reader, writer, and filter to your Pandoc data directory
-cp k9-reader.lua k9-writer.lua k9-filter.lua k9.lua \
-   ~/.local/share/pandoc/
-cp k9.html ~/.local/share/pandoc/templates/
-
      -

      Verify the installation:

      -
      pandoc --list-input-formats | grep k9
-
      -

      2. -

    2. -

      Install the VS Code extension (optional)

      -

      For syntax highlighting in VS Code:

      -
      # From the VS Code marketplace
-code --install-extension hyperpolymath.vscode-k9
-
      -

      This gives you security-level-aware highlighting: Kennel keywords in green, Yard in amber, Hunt in red. It also provides bracket matching and folding for K9 structures.

      -

      3. -

    3. -

      Create your first Kennel-level file

      -

      Create a file called hello.k9:

      -
      K9!
-# hello.k9 — My first K9 component
-# Security Level: Kennel (pure data, no execution)
-
----
-metadata:
-  name: hello-k9
-  version: 1.0.0
-  description: My first self-validating component
-  author: Your Name
-  license: PMPL-1.0-or-later
-
-content:
-  greeting: "Hello from K9!"
-  message: |
-    This is a Kennel-level component.
-    It contains only data — no code, no execution.
-    Safe to parse from any source.
-
-tags:
-  - example
-  - kennel
-  - hello-world
-
      -

      This is the simplest possible K9 file. It starts with K9!, carries a pedigree in the metadata section, and contains structured data. Nothing more.

      -

      4. -

    4. -

      Convert it with Pandoc

      -

      Use the K9 reader to convert your file to HTML:

      -
      pandoc -f k9.lua hello.k9 \
-       --lua-filter=k9-filter.lua \
-       --template=k9.html \
-       -o hello.html
-
      -

      Open hello.html in a browser. You will see a formatted K9 document with a security-level header bar (green for Kennel), a pedigree summary card, and styled content sections.

      -

      Convert to other formats just as easily:

      -
      # To Markdown
-pandoc -f k9.lua hello.k9 -t markdown -o hello.md
-
-# To JSON (Pandoc AST)
-pandoc -f k9.lua hello.k9 -t json -o hello.json
-
      -

      5. -

    5. -

      Graduate to Yard level with Nickel contracts

      -

      Create a file called config.k9.ncl:

      -
      # config.k9.ncl — Yard-level configuration with contracts
-# Security Level: Yard (contracts and types, no execution)
-
-let pedigree = import "pedigree.ncl" in
-
-pedigree.K9Pedigree & {
-  metadata = {
-    name = "my-service-config",
-    version = "1.0.0",
-    description = "Service configuration with validated contracts",
-  },
-
-  security = {
-    trust_level = 'Yard,
-    allow_network = false,
-    allow_filesystem_write = false,
-    allow_subprocess = false,
-  },
-
-  # The | operator applies a Nickel contract
-  config = {
-    port | std.number.Nat
-         | std.contract.from_predicate (fun x => x >= 1024 && x <= 65535)
-         = 8443,
-
-    log_level | [| 'debug, 'info, 'warn, 'error |]
-              = 'info,
-
-    max_connections | std.number.Nat = 100,
-  },
-
-  validation = {
-    checksum = "...",
-    pedigree_version = "1.0.0",
-    hunt_authorized = false,
-  },
-}
-
      -

      Type-check it with Nickel:

      -
      nickel typecheck config.k9.ncl
-
      -

      If you change port to 80 (below 1024) or log_level to 'verbose (not in the enum), Nickel will reject the configuration at type-check time — before it ever reaches a running service.

      -

      6. -

    6. -

      Validate with the Contractile CLI

      -

      If you have the Contractile CLI installed:

      -
      # Install contractile
-cargo install contractile
-
-# Create the k9 symlink
-ln -sf $(which contractile) ~/.local/bin/k9
-
-# Evaluate a K9 component
-k9 eval hello.k9           # Kennel: validates pedigree
-k9 eval config.k9.ncl      # Yard: validates pedigree + contracts
-
      -

      The k9 eval command checks pedigree structure, runs Nickel type checking (for Yard/Hunt), and verifies signatures (for Hunt). It reports the security level, any contract violations, and whether the component is valid.

      -

      7. -

    -

    ---

    -

    What Next?

    -
      -
    • Read the [Security Levels](security-levels.html) page to understand the
      • -

      trust model in depth.

      -
    • Browse the [Examples](examples.html) for real-world K9 files at each level.
      • -
    • Check the [Integrations](integrations.html) to see how K9 fits into your
      • -

      existing toolchain.

      -
    • Explore the [pandoc-k9 repository](https://github.com/hyperpolymath/pandoc-k9)
      • -

      for the full source, tests, and documentation.

      -
    -

    ---

    -

    Common Patterns

    -

    Using K9 in CI/CD

    -

    Add K9 validation as a CI step:

    -
    # .github/workflows/k9-validate.yml
-name: K9 Validation
-on: [push, pull_request]
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Install Nickel
-        run: cargo install nickel-lang-cli
-      - name: Validate K9 components
-        run: |
-          for f in $(find . -name '*.k9' -o -name '*.k9.ncl'); do
-            echo "Validating $f..."
-            k9 eval "$f"
-          done
-
    -

    Using K9 for Container Manifests

    -

    Pair K9 with the Stapeln container ecosystem:

    -
    K9!
-# my-service.k9 — Container deployment manifest
-
----
-metadata:
-  name: my-service
-  version: 2.0.0
-  description: Production deployment for my-service
-  license: PMPL-1.0-or-later
-
-container:
-  image: cgr.dev/my-org/my-service:2.0.0
-  replicas: 3
-  health_check:
-    path: /healthz
-    interval_seconds: 15
-
    -

    Using K9 for Project Configuration

    -

    Replace your config.yaml or settings.json with a self-describing K9 file:

    -
    K9!
-# app-config.k9 — Application configuration
-
----
-metadata:
-  name: app-config
-  version: 1.0.0
-  description: Runtime configuration for the application
-  license: PMPL-1.0-or-later
-
-database:
-  host: localhost
-  port: 5432
-  name: app_production
-  pool_size: 10
-
-cache:
-  backend: redis
-  ttl_seconds: 300
-
    -

    The advantage over plain YAML: every tool that encounters this file knows exactly what it is, who authored it, and what version it represents — without parsing comments or guessing from file paths.

    - -
    -
    - - - - diff --git a/k9-svc/showcase/output/index.html b/k9-svc/showcase/output/index.html deleted file mode 100644 index 820a1101..00000000 --- a/k9-svc/showcase/output/index.html +++ /dev/null @@ -1,781 +0,0 @@ - - -

    -

    -

    K9: Self-Validating Components

    -

    Configuration that knows what it is and proves what it does.

    -

    Kennel Pure data, safe anywhere
    Yard Contracts and types
    Hunt Execution, signed

    -

    -

    What is K9?

    -

    K9 is a configuration format where every component carries a pedigree — a machine-readable declaration of its name, version, and security level. Unlike YAML, TOML, or JSON, K9 files are not passive blobs of data waiting for some external tool to interpret them. They declare what they are and what they are allowed to do.

    -

    At the simplest level, a .k9 file is structured data (like YAML). At the highest level, a .k9.ncl file is a Nickel program with formal contracts, type checking, and even executable recipes — but only when cryptographically signed. The security level is not an annotation bolted on after the fact; it is intrinsic to the file format.

    -

    Three Security Levels

    -

    K9 organises trust into three graduated levels:

    -
      -
    • Kennel Pure data. No evaluation,
      • -

      no execution. .k9 files are safe to process from any source, any pipeline, any CI runner. Think package.json or Cargo.toml — just data with a pedigree.

      -
    -
      -
    • Yard Nickel evaluation. .k9.ncl
      • -

      files at this level use Nickel contracts and types to compute values and validate structure. They can express constraints like "this port must be between 1024 and 65535" or "if target.os is Linux then requires_podman must be true." No shell access, no filesystem writes — just typed computation.

      -
    -
      -
    • Hunt Full execution. .k9.ncl
      • -

      files at this level can contain recipe blocks that run shell commands. A cryptographic signature is required. Unsigned Hunt-level files are rejected. This is the level for setup scripts, deployment automation, and migration tasks — all with an auditable trust chain.

      -
    -

    Every Component Has a Pedigree

    -

    Every K9 file starts with the magic bytes K9! and carries a pedigree containing at minimum:

    -
      -
    • name — the component's identity
      • -
    • version — semantic version
      • -
    • security_level — Kennel, Yard, or Hunt
      • -
    • description — what the component does
      • -
    • license — SPDX identifier
      • -
    -

    This pedigree is not metadata hidden in a comment. It is part of the format, validated by tooling, and queryable by machines.

    -

    Where K9 is Used

    -

    K9 is designed for anywhere configuration meets trust:

    -
      -
    • CI/CD pipelines — declare build steps with contract-validated parameters
      • -
    • Container deployment — manifests that prove their own correctness
      • -
    • Project metadata — richer than TOML, safer than arbitrary scripting
      • -
    • Deployment automation — Hunt-level recipes with cryptographic signing
      • -
    • Package manifests — self-validating dependency declarations
      • -
    -

    Tooling Ecosystem

    -

    K9 is not a specification without implementation. The tooling exists today:

    -
      -
    • Pandoc — full reader, writer, filter, and template support via
      • -

      [pandoc-k9](https://github.com/hyperpolymath/pandoc-k9)

      -
    • VS Code — syntax highlighting for .k9 and .k9.ncl
      • -
    • Tree-sitter — grammar for editor integration
      • -
    • GitHub Linguist — language detection (PR pending)
      • -
    • Nickel — native contract system for Yard and Hunt levels
      • -
    • Contractile CLI — K9 validation via the k9 eval command
      • -
    -

    > K9 closes the gap between "configuration as data" and "configuration as code" > by making the boundary explicit, graduated, and auditable.

    - — Rendered Markdown body -
  • K9
    • -
  • Security Levels
    • -
  • Examples
    • -
  • Integrations
    • -
  • Get Started
    • - — Auto-generated navigation tabs - page-index — CSS class derived from page - index — URL slug for the page ---> - - - - - - - K9 — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    -

    -

    -

    K9: Self-Validating Components

    -

    Configuration that knows what it is and proves what it does.

    -

    Kennel Pure data, safe anywhere
    Yard Contracts and types
    Hunt Execution, signed

    -

    -

    What is K9?

    -

    K9 is a configuration format where every component carries a pedigree — a machine-readable declaration of its name, version, and security level. Unlike YAML, TOML, or JSON, K9 files are not passive blobs of data waiting for some external tool to interpret them. They declare what they are and what they are allowed to do.

    -

    At the simplest level, a .k9 file is structured data (like YAML). At the highest level, a .k9.ncl file is a Nickel program with formal contracts, type checking, and even executable recipes — but only when cryptographically signed. The security level is not an annotation bolted on after the fact; it is intrinsic to the file format.

    -

    Three Security Levels

    -

    K9 organises trust into three graduated levels:

    -
      -
    • Kennel Pure data. No evaluation,
      • -

      no execution. .k9 files are safe to process from any source, any pipeline, any CI runner. Think package.json or Cargo.toml — just data with a pedigree.

      -
    -
      -
    • Yard Nickel evaluation. .k9.ncl
      • -

      files at this level use Nickel contracts and types to compute values and validate structure. They can express constraints like "this port must be between 1024 and 65535" or "if target.os is Linux then requires_podman must be true." No shell access, no filesystem writes — just typed computation.

      -
    -
      -
    • Hunt Full execution. .k9.ncl
      • -

      files at this level can contain recipe blocks that run shell commands. A cryptographic signature is required. Unsigned Hunt-level files are rejected. This is the level for setup scripts, deployment automation, and migration tasks — all with an auditable trust chain.

      -
    -

    Every Component Has a Pedigree

    -

    Every K9 file starts with the magic bytes K9! and carries a pedigree containing at minimum:

    -
      -
    • name — the component's identity
      • -
    • version — semantic version
      • -
    • security_level — Kennel, Yard, or Hunt
      • -
    • description — what the component does
      • -
    • license — SPDX identifier
      • -
    -

    This pedigree is not metadata hidden in a comment. It is part of the format, validated by tooling, and queryable by machines.

    -

    Where K9 is Used

    -

    K9 is designed for anywhere configuration meets trust:

    -
      -
    • CI/CD pipelines — declare build steps with contract-validated parameters
      • -
    • Container deployment — manifests that prove their own correctness
      • -
    • Project metadata — richer than TOML, safer than arbitrary scripting
      • -
    • Deployment automation — Hunt-level recipes with cryptographic signing
      • -
    • Package manifests — self-validating dependency declarations
      • -
    -

    Tooling Ecosystem

    -

    K9 is not a specification without implementation. The tooling exists today:

    -
      -
    • Pandoc — full reader, writer, filter, and template support via
      • -

      [pandoc-k9](https://github.com/hyperpolymath/pandoc-k9)

      -
    • VS Code — syntax highlighting for .k9 and .k9.ncl
      • -
    • Tree-sitter — grammar for editor integration
      • -
    • GitHub Linguist — language detection (PR pending)
      • -
    • Nickel — native contract system for Yard and Hunt levels
      • -
    • Contractile CLI — K9 validation via the k9 eval command
      • -
    -

    > K9 closes the gap between "configuration as data" and "configuration as code" > by making the boundary explicit, graduated, and auditable.

    - -
    -
    - - - - diff --git a/k9-svc/showcase/output/integrations.html b/k9-svc/showcase/output/integrations.html deleted file mode 100644 index c5a8963b..00000000 --- a/k9-svc/showcase/output/integrations.html +++ /dev/null @@ -1,791 +0,0 @@ - - -

    -

    Integrations

    -

    K9 is supported across editors, build tools, language ecosystems, and CI/CD systems. These are not aspirational — they are implemented and available.

    -

    ---

    -

    -

    -

    Pandoc

    -

    Full reader, writer, Lua filter, and HTML template for K9 documents. Convert .k9 and .k9.ncl files to HTML, Markdown, JSON, or any Pandoc output format. The reader parses pedigree, contracts, and recipes into Pandoc's AST. The writer emits valid K9 from any Pandoc source.

    -

    [pandoc-k9 on GitHub](https://github.com/hyperpolymath/pandoc-k9)

    -

    -

    -

    VS Code

    -

    Syntax highlighting for .k9 (Kennel) and .k9.ncl (Yard/Hunt) files. Security-level-aware colouring: Kennel keywords in green, Yard in amber, Hunt in red. Bracket matching, comment toggling, and folding for K9 structures.

    -

    [vscode-k9 on GitHub](https://github.com/hyperpolymath/vscode-k9)

    -

    -

    -

    Tree-sitter

    -

    Tree-sitter grammar for K9 syntax, enabling editor support in Neovim, Helix, Emacs, and any tree-sitter-compatible editor. Provides structural parsing for syntax highlighting, code folding, and incremental parsing.

    -

    [tree-sitter-k9 on GitHub](https://github.com/hyperpolymath/tree-sitter-k9)

    -

    -

    -

    GitHub Linguist

    -

    Language detection for K9 files in GitHub repositories. When merged, GitHub will recognise .k9 and .k9.ncl files, display them with K9 syntax highlighting, and include them in repository language statistics.

    -

    [Linguist PR (pending)](https://github.com/github-linguist/linguist/pulls)

    -

    -

    -

    Nickel

    -

    K9's contract system is built on [Nickel](https://nickel-lang.org/), the configuration language with formal contracts. Yard and Hunt-level K9 files are valid Nickel programs that import a shared pedigree contract. Nickel's type system, merge semantics, and contract checking are K9's foundation.

    -

    [nickel-lang.org](https://nickel-lang.org/)

    -

    -

    -

    Contractile CLI

    -

    The Contractile CLI includes a k9 subcommand for evaluating K9 components. Run k9 eval to type-check contracts, verify signatures, and validate pedigrees. Integrates with the broader Contractile toolchain (must, trust, dust, intend).

    -

    [contractiles on GitHub](https://github.com/hyperpolymath/contractiles)

    -

    -

    -

    LuaRocks

    -

    Lua library for parsing and emitting K9 files. Used internally by the Pandoc reader and writer but also available as a standalone library for Lua projects. Handles all three security levels and validates pedigree structure.

    -

    [lua-k9 on LuaRocks](https://luarocks.org/modules/hyperpolymath/lua-k9)

    -

    -

    -

    Hackage (coming soon)

    -

    Haskell library for K9 parsing, validation, and emission. Will provide Data.K9.Pedigree, Data.K9.Parse, and Data.K9.Contract modules. Planned for release alongside the Pandoc native reader.

    -

    -

    -

    ---

    -

    Integration Architecture

    -

    K9 tooling follows a layered model:

    -

    Layer 1: Parsing

    -

    Every tool that reads K9 must handle the K9! magic number and parse the pedigree. For Kennel-level files, this is all that is needed — the rest is standard YAML-like structured data.

    -

    Layer 2: Evaluation

    -

    Tools that support Yard-level files must integrate the Nickel evaluator. This means importing contracts, running type checks, and resolving merge operations. The Nickel evaluator runs in a sandbox with no I/O access.

    -

    Layer 3: Execution

    -

    Tools that support Hunt-level files must verify cryptographic signatures before executing recipe blocks. The signature verification happens before any code runs — an invalid or missing signature means the recipes are never executed.

    -

    Layer 4: Transformation

    -

    Pandoc sits at this layer. It can read K9 at any level, transform it through its AST, and emit it in any output format. The K9 Lua filter annotates the AST with security-level metadata, contract types, and pedigree information for rich HTML output.

    -

    ---

    -

    Repository Links

    -

    | Integration | Repository | Status | |---|---|---| | Pandoc reader/writer/filter/template | [pandoc-k9](https://github.com/hyperpolymath/pandoc-k9) | Released | | VS Code extension | [vscode-k9](https://github.com/hyperpolymath/vscode-k9) | Released | | Tree-sitter grammar | [tree-sitter-k9](https://github.com/hyperpolymath/tree-sitter-k9) | Released | | GitHub Linguist | [linguist PR](https://github.com/github-linguist/linguist) | Pending | | Nickel contracts | [pandoc-k9/src/contracts](https://github.com/hyperpolymath/pandoc-k9/tree/main/src/contracts) | Released | | Contractile CLI | [contractiles](https://github.com/hyperpolymath/contractiles) | Released | | Lua library | [lua-k9](https://luarocks.org/modules/hyperpolymath/lua-k9) | Released | | Haskell library | — | Planned |

    - — Rendered Markdown body -
  • K9
    • -
  • Security Levels
    • -
  • Examples
    • -
  • Integrations
    • -
  • Get Started
    • - — Auto-generated navigation tabs - page-integrations — CSS class derived from page - integrations — URL slug for the page ---> - - - - - - - Integrations — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    -

    -

    Integrations

    -

    K9 is supported across editors, build tools, language ecosystems, and CI/CD systems. These are not aspirational — they are implemented and available.

    -

    ---

    -

    -

    -

    Pandoc

    -

    Full reader, writer, Lua filter, and HTML template for K9 documents. Convert .k9 and .k9.ncl files to HTML, Markdown, JSON, or any Pandoc output format. The reader parses pedigree, contracts, and recipes into Pandoc's AST. The writer emits valid K9 from any Pandoc source.

    -

    [pandoc-k9 on GitHub](https://github.com/hyperpolymath/pandoc-k9)

    -

    -

    -

    VS Code

    -

    Syntax highlighting for .k9 (Kennel) and .k9.ncl (Yard/Hunt) files. Security-level-aware colouring: Kennel keywords in green, Yard in amber, Hunt in red. Bracket matching, comment toggling, and folding for K9 structures.

    -

    [vscode-k9 on GitHub](https://github.com/hyperpolymath/vscode-k9)

    -

    -

    -

    Tree-sitter

    -

    Tree-sitter grammar for K9 syntax, enabling editor support in Neovim, Helix, Emacs, and any tree-sitter-compatible editor. Provides structural parsing for syntax highlighting, code folding, and incremental parsing.

    -

    [tree-sitter-k9 on GitHub](https://github.com/hyperpolymath/tree-sitter-k9)

    -

    -

    -

    GitHub Linguist

    -

    Language detection for K9 files in GitHub repositories. When merged, GitHub will recognise .k9 and .k9.ncl files, display them with K9 syntax highlighting, and include them in repository language statistics.

    -

    [Linguist PR (pending)](https://github.com/github-linguist/linguist/pulls)

    -

    -

    -

    Nickel

    -

    K9's contract system is built on [Nickel](https://nickel-lang.org/), the configuration language with formal contracts. Yard and Hunt-level K9 files are valid Nickel programs that import a shared pedigree contract. Nickel's type system, merge semantics, and contract checking are K9's foundation.

    -

    [nickel-lang.org](https://nickel-lang.org/)

    -

    -

    -

    Contractile CLI

    -

    The Contractile CLI includes a k9 subcommand for evaluating K9 components. Run k9 eval to type-check contracts, verify signatures, and validate pedigrees. Integrates with the broader Contractile toolchain (must, trust, dust, intend).

    -

    [contractiles on GitHub](https://github.com/hyperpolymath/contractiles)

    -

    -

    -

    LuaRocks

    -

    Lua library for parsing and emitting K9 files. Used internally by the Pandoc reader and writer but also available as a standalone library for Lua projects. Handles all three security levels and validates pedigree structure.

    -

    [lua-k9 on LuaRocks](https://luarocks.org/modules/hyperpolymath/lua-k9)

    -

    -

    -

    Hackage (coming soon)

    -

    Haskell library for K9 parsing, validation, and emission. Will provide Data.K9.Pedigree, Data.K9.Parse, and Data.K9.Contract modules. Planned for release alongside the Pandoc native reader.

    -

    -

    -

    ---

    -

    Integration Architecture

    -

    K9 tooling follows a layered model:

    -

    Layer 1: Parsing

    -

    Every tool that reads K9 must handle the K9! magic number and parse the pedigree. For Kennel-level files, this is all that is needed — the rest is standard YAML-like structured data.

    -

    Layer 2: Evaluation

    -

    Tools that support Yard-level files must integrate the Nickel evaluator. This means importing contracts, running type checks, and resolving merge operations. The Nickel evaluator runs in a sandbox with no I/O access.

    -

    Layer 3: Execution

    -

    Tools that support Hunt-level files must verify cryptographic signatures before executing recipe blocks. The signature verification happens before any code runs — an invalid or missing signature means the recipes are never executed.

    -

    Layer 4: Transformation

    -

    Pandoc sits at this layer. It can read K9 at any level, transform it through its AST, and emit it in any output format. The K9 Lua filter annotates the AST with security-level metadata, contract types, and pedigree information for rich HTML output.

    -

    ---

    -

    Repository Links

    -

    | Integration | Repository | Status | |---|---|---| | Pandoc reader/writer/filter/template | [pandoc-k9](https://github.com/hyperpolymath/pandoc-k9) | Released | | VS Code extension | [vscode-k9](https://github.com/hyperpolymath/vscode-k9) | Released | | Tree-sitter grammar | [tree-sitter-k9](https://github.com/hyperpolymath/tree-sitter-k9) | Released | | GitHub Linguist | [linguist PR](https://github.com/github-linguist/linguist) | Pending | | Nickel contracts | [pandoc-k9/src/contracts](https://github.com/hyperpolymath/pandoc-k9/tree/main/src/contracts) | Released | | Contractile CLI | [contractiles](https://github.com/hyperpolymath/contractiles) | Released | | Lua library | [lua-k9](https://luarocks.org/modules/hyperpolymath/lua-k9) | Released | | Haskell library | — | Planned |

    - -
    -
    - - - - diff --git a/k9-svc/showcase/output/security-levels.html b/k9-svc/showcase/output/security-levels.html deleted file mode 100644 index c7715df6..00000000 --- a/k9-svc/showcase/output/security-levels.html +++ /dev/null @@ -1,837 +0,0 @@ - - -

    -

    Security Levels

    -

    K9 organises trust into three graduated levels. Each level defines precisely what a component is allowed to do. The security level is not an annotation — it is a structural property of the file, enforced by the format and validated by every tool in the chain.

    -

    ---

    -

    -

    Kennel — Pure Data

    -

    File extension: .k9 Indicator: Kennel

    -

    Kennel-level components are inert. They contain structured data and nothing else. No expressions are evaluated, no functions are called, no external resources are accessed. A Kennel-level file can be safely processed by any tool, in any environment, from any source.

    -

    What Kennel can do:

    -
      -
    • Declare key-value pairs, nested records, and arrays
      • -
    • Carry a pedigree (name, version, description, license)
      • -
    • Be parsed, displayed, queried, and transformed
      • -
    • Be included in pipelines without sandboxing
      • -
    -

    What Kennel cannot do:

    -
      -
    • Evaluate expressions or call functions
      • -
    • Access the filesystem, network, or environment variables
      • -
    • Import other files or modules
      • -
    • Execute any code whatsoever
      • -
    -

    Analogues: package.json, Cargo.toml, YAML data files, JSON configs.

    -

    A Kennel file is what you reach for when you need structured data with identity. It is the safest possible configuration: machine-readable, human- writable, and provably inert.

    -

    -

    -

    Yard — Contracts and Types

    -

    File extension: .k9.ncl Indicator: Yard

    -

    Yard-level components are Nickel programs. They can use the full Nickel contract system: types, merge operations, conditional logic, and computed values. This is where K9 becomes more than data — it becomes configuration that validates itself.

    -

    What Yard can do:

    -
      -
    • Everything Kennel can do
      • -
    • Evaluate Nickel expressions and merge records
      • -
    • Apply type contracts (Std.number.Nat, Std.string.NonEmpty, custom)
      • -
    • Use conditional logic (if target.os == 'Linux then ...)
      • -
    • Import other .ncl files and apply contract composition
      • -
    • Compute derived values from inputs
      • -
    -

    What Yard cannot do:

    -
      -
    • Execute shell commands or spawn processes
      • -
    • Write to the filesystem
      • -
    • Access the network
      • -
    • Run recipe blocks
      • -
    • Anything requiring a cryptographic signature
      • -
    -

    Analogues: Dhall, Jsonnet, CUE — but with Nickel's formal contract system rather than informal schema checking.

    -

    Yard is the level for CI/CD configurations, deployment manifests, and any scenario where you need computed values with provable constraints. A Yard-level component can guarantee that "every port in this list is unique and within the valid range" or "if high-availability is enabled then replica count must be at least 3."

    -

    -

    -

    Hunt — Execution with Trust

    -

    File extension: .k9.ncl Indicator: Hunt

    -

    Hunt-level components can do everything Yard can do, plus execute shell commands via recipe blocks. This is the most powerful level and the most restricted: a Hunt-level file must carry a valid cryptographic signature. Unsigned Hunt files are rejected by all conforming tools.

    -

    What Hunt can do:

    -
      -
    • Everything Yard can do
      • -
    • Define recipe blocks (install, validate, deploy, migrate)
      • -
    • Execute shell commands within those recipes
      • -
    • Access the filesystem and network (within recipe scope)
      • -
    • Chain recipes in defined order
      • -
    -

    What Hunt requires:

    -
      -
    • A valid cryptographic signature over the file contents
      • -
    • An hunt_authorized = true flag in the validation section
      • -
    • A checksum matching the file's content hash
      • -
    -

    Analogues: Makefiles, Justfiles, CI/CD scripts — but with a pedigree, contracts, and a mandatory trust chain.

    -

    Hunt is the level for setup scripts, migration tasks, deployment automation, and anything that needs to run commands. The signature requirement ensures that Hunt-level files cannot be injected or tampered with. You know who authored it, you know it has not changed, and the contracts prove it is structurally valid.

    -

    -

    ---

    -

    Comparison

    -

    | Capability | Kennel | Yard | Hunt | |---|---|---|---| | Structured data | Yes | Yes | Yes | | Pedigree | Yes | Yes | Yes | | Nickel expressions | No | Yes | Yes | | Type contracts | No | Yes | Yes | | Conditional logic | No | Yes | Yes | | File imports | No | Yes | Yes | | Shell execution | No | No | Yes | | Filesystem access | No | No | Yes | | Network access | No | No | Yes | | Signature required | No | No | Yes |

    -

    Trust Escalation

    -

    Moving between levels is a deliberate act with clear semantics:

    -

    Kennel to Yard: You are adding computation. The file moves from .k9 to .k9.ncl and gains access to the Nickel evaluator. This is appropriate when static data is insufficient — when you need derived values, conditional logic, or contract validation. No signature is required, but the evaluator runs in a sandbox with no I/O access.

    -

    Yard to Hunt: You are adding execution. The file remains .k9.ncl but the security.trust_level changes from 'Yard to 'Hunt, and the validation.hunt_authorized flag must be set to true. A cryptographic signature over the full file content is now mandatory. This is the most significant escalation: you are granting the configuration the ability to run commands on the host system.

    -

    There is no path from Kennel directly to Hunt. A component must pass through Yard to reach Hunt. This ensures that every executable configuration has been through the contract validation stage first.

    -

    Why Not Just One Level?

    -

    Because most configuration does not need execution, and treating all configuration as equally dangerous leads to either:

    -

    1. Over-permissive systems where every config file can run arbitrary code (the Makefile problem), or 2. Over-restrictive systems where configuration is limited to static data and all logic lives elsewhere (the JSON problem).

    -

    K9's three levels let you match the trust model to the actual requirements. Data stays as data. Computation stays sandboxed. Execution stays signed.

    - — Rendered Markdown body -
  • K9
    • -
  • Security Levels
    • -
  • Examples
    • -
  • Integrations
    • -
  • Get Started
    • - — Auto-generated navigation tabs - page-security-levels — CSS class derived from page - security-levels — URL slug for the page ---> - - - - - - - Security Levels — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    -

    -

    Security Levels

    -

    K9 organises trust into three graduated levels. Each level defines precisely what a component is allowed to do. The security level is not an annotation — it is a structural property of the file, enforced by the format and validated by every tool in the chain.

    -

    ---

    -

    -

    Kennel — Pure Data

    -

    File extension: .k9 Indicator: Kennel

    -

    Kennel-level components are inert. They contain structured data and nothing else. No expressions are evaluated, no functions are called, no external resources are accessed. A Kennel-level file can be safely processed by any tool, in any environment, from any source.

    -

    What Kennel can do:

    -
      -
    • Declare key-value pairs, nested records, and arrays
      • -
    • Carry a pedigree (name, version, description, license)
      • -
    • Be parsed, displayed, queried, and transformed
      • -
    • Be included in pipelines without sandboxing
      • -
    -

    What Kennel cannot do:

    -
      -
    • Evaluate expressions or call functions
      • -
    • Access the filesystem, network, or environment variables
      • -
    • Import other files or modules
      • -
    • Execute any code whatsoever
      • -
    -

    Analogues: package.json, Cargo.toml, YAML data files, JSON configs.

    -

    A Kennel file is what you reach for when you need structured data with identity. It is the safest possible configuration: machine-readable, human- writable, and provably inert.

    -

    -

    -

    Yard — Contracts and Types

    -

    File extension: .k9.ncl Indicator: Yard

    -

    Yard-level components are Nickel programs. They can use the full Nickel contract system: types, merge operations, conditional logic, and computed values. This is where K9 becomes more than data — it becomes configuration that validates itself.

    -

    What Yard can do:

    -
      -
    • Everything Kennel can do
      • -
    • Evaluate Nickel expressions and merge records
      • -
    • Apply type contracts (Std.number.Nat, Std.string.NonEmpty, custom)
      • -
    • Use conditional logic (if target.os == 'Linux then ...)
      • -
    • Import other .ncl files and apply contract composition
      • -
    • Compute derived values from inputs
      • -
    -

    What Yard cannot do:

    -
      -
    • Execute shell commands or spawn processes
      • -
    • Write to the filesystem
      • -
    • Access the network
      • -
    • Run recipe blocks
      • -
    • Anything requiring a cryptographic signature
      • -
    -

    Analogues: Dhall, Jsonnet, CUE — but with Nickel's formal contract system rather than informal schema checking.

    -

    Yard is the level for CI/CD configurations, deployment manifests, and any scenario where you need computed values with provable constraints. A Yard-level component can guarantee that "every port in this list is unique and within the valid range" or "if high-availability is enabled then replica count must be at least 3."

    -

    -

    -

    Hunt — Execution with Trust

    -

    File extension: .k9.ncl Indicator: Hunt

    -

    Hunt-level components can do everything Yard can do, plus execute shell commands via recipe blocks. This is the most powerful level and the most restricted: a Hunt-level file must carry a valid cryptographic signature. Unsigned Hunt files are rejected by all conforming tools.

    -

    What Hunt can do:

    -
      -
    • Everything Yard can do
      • -
    • Define recipe blocks (install, validate, deploy, migrate)
      • -
    • Execute shell commands within those recipes
      • -
    • Access the filesystem and network (within recipe scope)
      • -
    • Chain recipes in defined order
      • -
    -

    What Hunt requires:

    -
      -
    • A valid cryptographic signature over the file contents
      • -
    • An hunt_authorized = true flag in the validation section
      • -
    • A checksum matching the file's content hash
      • -
    -

    Analogues: Makefiles, Justfiles, CI/CD scripts — but with a pedigree, contracts, and a mandatory trust chain.

    -

    Hunt is the level for setup scripts, migration tasks, deployment automation, and anything that needs to run commands. The signature requirement ensures that Hunt-level files cannot be injected or tampered with. You know who authored it, you know it has not changed, and the contracts prove it is structurally valid.

    -

    -

    ---

    -

    Comparison

    -

    | Capability | Kennel | Yard | Hunt | |---|---|---|---| | Structured data | Yes | Yes | Yes | | Pedigree | Yes | Yes | Yes | | Nickel expressions | No | Yes | Yes | | Type contracts | No | Yes | Yes | | Conditional logic | No | Yes | Yes | | File imports | No | Yes | Yes | | Shell execution | No | No | Yes | | Filesystem access | No | No | Yes | | Network access | No | No | Yes | | Signature required | No | No | Yes |

    -

    Trust Escalation

    -

    Moving between levels is a deliberate act with clear semantics:

    -

    Kennel to Yard: You are adding computation. The file moves from .k9 to .k9.ncl and gains access to the Nickel evaluator. This is appropriate when static data is insufficient — when you need derived values, conditional logic, or contract validation. No signature is required, but the evaluator runs in a sandbox with no I/O access.

    -

    Yard to Hunt: You are adding execution. The file remains .k9.ncl but the security.trust_level changes from 'Yard to 'Hunt, and the validation.hunt_authorized flag must be set to true. A cryptographic signature over the full file content is now mandatory. This is the most significant escalation: you are granting the configuration the ability to run commands on the host system.

    -

    There is no path from Kennel directly to Hunt. A component must pass through Yard to reach Hunt. This ensures that every executable configuration has been through the contract validation stage first.

    -

    Why Not Just One Level?

    -

    Because most configuration does not need execution, and treating all configuration as equally dangerous leads to either:

    -

    1. Over-permissive systems where every config file can run arbitrary code (the Makefile problem), or 2. Over-restrictive systems where configuration is limited to static data and all logic lives elsewhere (the JSON problem).

    -

    K9's three levels let you match the trust model to the actual requirements. Data stays as data. Computation stays sandboxed. Execution stays signed.

    - -
    -
    - - - - diff --git a/k9-svc/showcase/template.html b/k9-svc/showcase/template.html deleted file mode 100644 index eee370ce..00000000 --- a/k9-svc/showcase/template.html +++ /dev/null @@ -1,668 +0,0 @@ - - - - - - - - - - {{title}} — K9 Self-Validating Components - - - -
    -
    -
    - -
    Self-Validating Components
    -
    -
    -
    - - - -
    -
    - {{content}} -
    -
    - - - - diff --git a/k9-svc/sign.sh b/k9-svc/sign.sh deleted file mode 100755 index 6fda80cc..00000000 --- a/k9-svc/sign.sh +++ /dev/null @@ -1,367 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# sign.sh - Ed25519 signing and verification for K9 Hunt-level components -# -# Uses OpenSSL for cryptographic operations. -# Keys stored in ~/.config/k9/keys/ -# -# Usage: -# ./sign.sh keygen [name] Generate new keypair -# ./sign.sh sign Sign a component -# ./sign.sh verify Verify a component's signature -# ./sign.sh trust Add public key to trusted keys -# ./sign.sh list List trusted keys - -set -eu - -K9_CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/k9" -K9_KEYS_DIR="$K9_CONFIG_DIR/keys" -K9_TRUSTED_DIR="$K9_KEYS_DIR/trusted" - -# ───────────────────────────────────────────────────────────── -# Setup -# ───────────────────────────────────────────────────────────── - -ensure_dirs() { - mkdir -p "$K9_KEYS_DIR" - mkdir -p "$K9_TRUSTED_DIR" - chmod 700 "$K9_KEYS_DIR" -} - -check_openssl() { - if ! command -v openssl >/dev/null 2>&1; then - echo "K9: Error: OpenSSL not found. Install it first." >&2 - exit 1 - fi - # Check for Ed25519 support (OpenSSL 1.1.1+) - if ! openssl genpkey -algorithm Ed25519 -out /dev/null 2>/dev/null; then - echo "K9: Error: OpenSSL version doesn't support Ed25519." >&2 - echo "K9: Requires OpenSSL 1.1.1 or later." >&2 - exit 1 - fi -} - -# ───────────────────────────────────────────────────────────── -# Key Generation -# ───────────────────────────────────────────────────────────── - -cmd_keygen() { - ensure_dirs - check_openssl - - name="${1:-primary}" - privkey="$K9_KEYS_DIR/${name}.key" - pubkey="$K9_KEYS_DIR/${name}.pub" - - if [ -f "$privkey" ]; then - echo "K9: Key '$name' already exists at $privkey" >&2 - echo "K9: Delete it first if you want to regenerate." >&2 - exit 1 - fi - - echo "K9: Generating Ed25519 keypair '$name'..." - - # Generate private key - openssl genpkey -algorithm Ed25519 -out "$privkey" - chmod 600 "$privkey" - - # Extract public key - openssl pkey -in "$privkey" -pubout -out "$pubkey" - - echo "K9: Keypair generated:" - echo " Private: $privkey (keep secret!)" - echo " Public: $pubkey (share this)" - echo "" - echo "K9: To trust this key for verification:" - echo " ./sign.sh trust $pubkey" -} - -# ───────────────────────────────────────────────────────────── -# Signing -# ───────────────────────────────────────────────────────────── - -cmd_sign() { - ensure_dirs - check_openssl - - file="$1" - name="${2:-primary}" - privkey="$K9_KEYS_DIR/${name}.key" - sigfile="${file}.sig" - - if [ ! -f "$file" ]; then - echo "K9: Error: File not found: $file" >&2 - exit 1 - fi - - if [ ! -f "$privkey" ]; then - echo "K9: Error: Private key not found: $privkey" >&2 - echo "K9: Generate one with: ./sign.sh keygen $name" >&2 - exit 1 - fi - - echo "K9: Signing $file with key '$name'..." - - # Create signature - openssl pkeyutl -sign \ - -inkey "$privkey" \ - -rawin \ - -in "$file" \ - -out "$sigfile" - - # Also create base64 version for embedding - sig_b64=$(openssl base64 -in "$sigfile" | tr -d '\n') - - echo "K9: Signature created: $sigfile" - echo "" - echo "K9: To embed in component, add to security section:" - echo " signature = \"$sig_b64\"," - echo "" - echo "K9: To verify:" - echo " ./sign.sh verify $file" -} - -# ───────────────────────────────────────────────────────────── -# Verification -# ───────────────────────────────────────────────────────────── - -cmd_verify() { - ensure_dirs - check_openssl - - file="$1" - sigfile="${file}.sig" - - if [ ! -f "$file" ]; then - echo "K9: Error: File not found: $file" >&2 - exit 1 - fi - - if [ ! -f "$sigfile" ]; then - echo "K9: Error: Signature not found: $sigfile" >&2 - echo "K9: Sign the file first with: ./sign.sh sign $file" >&2 - exit 1 - fi - - # Try each trusted key - verified=false - for pubkey in "$K9_TRUSTED_DIR"/*.pub; do - if [ ! -f "$pubkey" ]; then - continue - fi - - keyname=$(basename "$pubkey" .pub) - - if openssl pkeyutl -verify \ - -pubin -inkey "$pubkey" \ - -rawin \ - -in "$file" \ - -sigfile "$sigfile" 2>/dev/null; then - echo "K9: ✓ Signature VALID (key: $keyname)" - verified=true - break - fi - done - - if [ "$verified" = false ]; then - echo "K9: ✗ Signature INVALID or key not trusted" >&2 - echo "" - echo "K9: Trusted keys in $K9_TRUSTED_DIR:" - ls -1 "$K9_TRUSTED_DIR"/*.pub 2>/dev/null || echo " (none)" - exit 1 - fi -} - -# ───────────────────────────────────────────────────────────── -# Trust Management -# ───────────────────────────────────────────────────────────── - -cmd_trust() { - ensure_dirs - - pubkey="$1" - - if [ ! -f "$pubkey" ]; then - echo "K9: Error: Public key not found: $pubkey" >&2 - exit 1 - fi - - keyname=$(basename "$pubkey" .pub) - dest="$K9_TRUSTED_DIR/${keyname}.pub" - - cp "$pubkey" "$dest" - echo "K9: Trusted key added: $keyname" - echo "K9: Location: $dest" -} - -cmd_untrust() { - ensure_dirs - - keyname="$1" - keyfile="$K9_TRUSTED_DIR/${keyname}.pub" - - if [ ! -f "$keyfile" ]; then - echo "K9: Error: Trusted key not found: $keyname" >&2 - exit 1 - fi - - rm "$keyfile" - echo "K9: Removed trusted key: $keyname" -} - -cmd_list() { - ensure_dirs - - echo "K9: Key Management" - echo "─────────────────────────────────────" - echo "" - echo "Your keys ($K9_KEYS_DIR):" - if ls "$K9_KEYS_DIR"/*.key 2>/dev/null | head -1 >/dev/null; then - for key in "$K9_KEYS_DIR"/*.key; do - name=$(basename "$key" .key) - echo " - $name" - done - else - echo " (none - run './sign.sh keygen' to create)" - fi - echo "" - echo "Trusted keys ($K9_TRUSTED_DIR):" - if ls "$K9_TRUSTED_DIR"/*.pub 2>/dev/null | head -1 >/dev/null; then - for key in "$K9_TRUSTED_DIR"/*.pub; do - name=$(basename "$key" .pub) - # Show key fingerprint - fp=$(openssl pkey -pubin -in "$key" -outform DER 2>/dev/null | openssl dgst -sha256 | cut -d' ' -f2 | head -c 16) - echo " - $name (sha256:$fp...)" - done - else - echo " (none - run './sign.sh trust ' to add)" - fi -} - -# ───────────────────────────────────────────────────────────── -# Hunt Authorization -# ───────────────────────────────────────────────────────────── - -cmd_authorize() { - file="$1" - - echo "K9: Hunt Authorization for $file" - echo "─────────────────────────────────────" - echo "" - - # Check if file exists - if [ ! -f "$file" ]; then - echo "K9: Error: File not found: $file" >&2 - exit 1 - fi - - # Check security level - if grep -q "trust_level.*'Hunt" "$file" 2>/dev/null; then - echo "K9: Security level: 'Hunt (full execution)" - else - echo "K9: This file is not Hunt-level. No authorization needed." - exit 0 - fi - - # Check for signature - sigfile="${file}.sig" - if [ ! -f "$sigfile" ]; then - echo "" - echo "K9: ⚠️ No signature found." - echo "K9: Sign the file first: ./sign.sh sign $file" - exit 1 - fi - - # Verify signature - echo "" - cmd_verify "$file" - - echo "" - echo "K9: ✓ Component authorized for Hunt-level execution." - echo "K9: You may now run its recipes." -} - -# ───────────────────────────────────────────────────────────── -# Main -# ───────────────────────────────────────────────────────────── - -usage() { - echo "K9 Signing Tool - Ed25519 signatures for Hunt-level components" - echo "" - echo "Usage: ./sign.sh [args]" - echo "" - echo "Commands:" - echo " keygen [name] Generate new Ed25519 keypair (default: primary)" - echo " sign Sign a component file" - echo " verify Verify a component's signature" - echo " authorize Full Hunt authorization check" - echo " trust Add public key to trusted keys" - echo " untrust Remove key from trusted keys" - echo " list List all keys" - echo "" - echo "Key storage: $K9_KEYS_DIR" - echo "" - echo "Example workflow:" - echo " ./sign.sh keygen # Generate keypair" - echo " ./sign.sh trust ~/.config/k9/keys/primary.pub" - echo " ./sign.sh sign examples/deploy.k9.ncl" - echo " ./sign.sh authorize examples/deploy.k9.ncl" -} - -case "${1:-help}" in - keygen) - shift - cmd_keygen "${1:-primary}" - ;; - sign) - shift - if [ -z "${1:-}" ]; then - echo "K9: Error: Missing file argument" >&2 - exit 1 - fi - cmd_sign "$1" "${2:-primary}" - ;; - verify) - shift - if [ -z "${1:-}" ]; then - echo "K9: Error: Missing file argument" >&2 - exit 1 - fi - cmd_verify "$1" - ;; - authorize) - shift - if [ -z "${1:-}" ]; then - echo "K9: Error: Missing file argument" >&2 - exit 1 - fi - cmd_authorize "$1" - ;; - trust) - shift - if [ -z "${1:-}" ]; then - echo "K9: Error: Missing pubkey argument" >&2 - exit 1 - fi - cmd_trust "$1" - ;; - untrust) - shift - if [ -z "${1:-}" ]; then - echo "K9: Error: Missing key name argument" >&2 - exit 1 - fi - cmd_untrust "$1" - ;; - list) - cmd_list - ;; - help|--help|-h) - usage - ;; - *) - echo "K9: Unknown command: $1" >&2 - usage - exit 1 - ;; -esac diff --git a/k9-svc/site/assets/style.css b/k9-svc/site/assets/style.css deleted file mode 120000 index a7c3bb8d..00000000 --- a/k9-svc/site/assets/style.css +++ /dev/null @@ -1 +0,0 @@ -../../../_shared/assets/style.css \ No newline at end of file diff --git a/k9-svc/site/downloads.adoc b/k9-svc/site/downloads.adoc deleted file mode 100644 index f177cd11..00000000 --- a/k9-svc/site/downloads.adoc +++ /dev/null @@ -1,45 +0,0 @@ -== - -title: Downloads site: K9-SVC description: Starter K9-SVC templates — -one per trust level — free to download and adapt. date: 2026-06-29 — - -== Downloads - -Starter templates, one per trust level. The environment grants no more -capability than the component declares. - -Level 1 — Data - -Pure data, no execution, safe anywhere. - -Download .k9.ncl - -Level 2 — Validation - -Nickel contract evaluation permitted. - -Download .k9.ncl - -Level 3 — Execution - -Full execution; requires a real signature (this template’s is a -placeholder). - -Download .k9.ncl - -All templates - -The full set plus a README, bundled. - -Download .tar.gz - -=== Licence - -Templates are `+MPL-2.0+` (code); this page is `+CC-BY-SA-4.0+`. - -=== More tooling - -Implementations and CI are coordinated in the -https://github.com/hyperpolymath/k9-ecosystem[k9-ecosystem] hub — clone -the repository directly if you want more than the starter templates -above. diff --git a/k9-svc/site/index.adoc b/k9-svc/site/index.adoc deleted file mode 100644 index ec7a8b5f..00000000 --- a/k9-svc/site/index.adoc +++ /dev/null @@ -1,78 +0,0 @@ -== - -title: K9-SVC site: K9-SVC brand: K9-SVC description: K9-SVC is a -Nickel-based format for self-validating configuration and contractiles, -with a three-level trust model from inert data to signed execution. -date: 2026-06-29 — - -== K9-SVC — Self-Validating Components - -A Nickel-based format for configuration and contractiles that carries -its own guarantees. Components validate themselves, with a trust model -that scales from inert data to cryptographically signed execution. - -[.badge]#v1.0.0-alpha# [.badge]#Nickel contractiles# [.badge]#.k9 / -.k9.ncl# [.badge]#application/vnd.k9+nickel# [.badge]#MPL-2.0 / -CC-BY-SA-4.0# - -Get started Read the spec GitHub - -=== The three-level trust model - -K9-SVC is safe by construction: a component declares how much trust it -requires, and the environment grants no more. - -[width="100%",cols="23%,19%,58%",options="header",] -|=== -|Level |Name |What’s permitted -|*1* |Data |Pure data, no execution — safe in all environments. -|*2* |Validation |Nickel contract evaluation permitted. -|*3* |Execution |Full execution — requires a cryptographic signature. -|=== - -=== What it does - -Self-validating - -A component states its own contract. Validation is intrinsic, not bolted -on. - -Contractiles in Nickel - -Contracts are written in Nickel — composable, evaluable, and precise. - -Signed execution - -Anything beyond validation requires a cryptographic signature. No silent -escalation. - -First-class media type - -application/vnd.k9+nickel — registered, addressable, toolable. - -=== A taste - -[source,nickel] ----- -# greeting.k9.ncl — a level-2 self-validating component -{ - trust_level = 2, - contract = fun value => value | { name | String, repeat | Number }, - data = { name = "world", repeat = 3 }, -} ----- - -=== Downloads & roadmap - -Grab a link:/downloads.html[starter template] for whichever trust level -fits, or see the link:/roadmap.html[roadmap] for what’s next — including -an interactive teaching area and -https://github.com/hyperpolymath/k9-ecosystem/tree/main/members/tooling/k9iser[k9iser]. - -=== Part of the standards estate - -K9-SVC is coordinated through the -https://github.com/hyperpolymath/k9-ecosystem[k9-ecosystem] hub — -implementations (`+k9-rs+`, `+k9_ex+`, `+k9_gleam+`, `+k9-deno+`, -`+k9-haskell+`), tooling and CI. The normative specification lives in -https://github.com/hyperpolymath/standards[standards]. diff --git a/k9-svc/site/public/.well-known/security.txt b/k9-svc/site/public/.well-known/security.txt deleted file mode 100644 index 08dec07d..00000000 --- a/k9-svc/site/public/.well-known/security.txt +++ /dev/null @@ -1,29 +0,0 @@ ------BEGIN PGP SIGNED MESSAGE----- -Hash: SHA512 - -# Security contact for k9-svc.net — RFC 9116 -# https://k9-svc.net/.well-known/security.txt - -Contact: mailto:j.d.a.jewell@open.ac.uk -Encryption: openpgp4fpr:4A03639C1EB1F86C7F0C97A91835A14A2867091E -Expires: 2027-06-21T00:00:00Z -Preferred-Languages: en -Canonical: https://k9-svc.net/.well-known/security.txt -Policy: https://github.com/hyperpolymath/k9-ecosystem/security/policy -Acknowledgments: https://github.com/hyperpolymath/k9-ecosystem/security/advisories ------BEGIN PGP SIGNATURE----- - -iQIzBAEBCgAdFiEEljlFF1RJblHWtTfK0RkBfr9pWrEFAmo5o0cACgkQ0RkBfr9p -WrFnhw//auzOJy7fkw/d/UO4sCX4LKdWpmSlgrM3x3Hif94Vub9jsMcNuN0NtgAd -6RQGf8Cj4eUCNPln1yDK8jnuwCnafd0RSQ7eS7LsGVZqG51okFrd2U7C/dyOgIHA -yGwLU2rvKXdsxp5VqUyuN60e0BNsB0erJxLZjytmU+OUbnjjWuHVrOmBRWz94DMo -vvA7pFNXM0GI0wkQuAKRFcum3IT0VH2DAzTmD11oW0YQr4vJOgwseiWFS1KfMWPY -bSyHbRYgBU6NRPL4UpBg0vwmWlgo7UolOR2JpCVJN1H6oFX4GZIBEw7hrk5+iD8z -CfyW/yeIKG5fRZfpzfbID4ynt9ji9+BvHedRdou7D+bl6TPoM+xXSJLmjV2I8xYS -su0BLj/6V6Aqpker3VP7NJscDLS7t/+KRXj7O2XIMSRjokRL5yIyxkcQVmhqfVKy -i+qkNS9sMSAY89Ce6E2bpn7f2wdBP42yCOGHISjNjv9LsmmSkuoNjy36qTR3kAgH -0KZWylOErsKdwTh9tU0URTHVTiNfhiw4WOc2/1wt+QN2/Ipg8XdcNnqLG66cs8j3 -hYIYw2a7JA+KlSCrUJ+Zv8FJKnZS6htw9FBHpzxyqQJlCjz55ksZU82hyar8WlX/ -LY6nWrIp/peBURvi3CgVXPuJuKDSOrJnZ8F1INDN1i7uTpE3olw= -=dLTg ------END PGP SIGNATURE----- diff --git a/k9-svc/site/public/CNAME b/k9-svc/site/public/CNAME deleted file mode 100644 index 558028c9..00000000 --- a/k9-svc/site/public/CNAME +++ /dev/null @@ -1 +0,0 @@ -k9-svc.net diff --git a/k9-svc/site/public/downloads/README.adoc b/k9-svc/site/public/downloads/README.adoc deleted file mode 100644 index ac2c9f88..00000000 --- a/k9-svc/site/public/downloads/README.adoc +++ /dev/null @@ -1,15 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell -= K9-SVC starter templates - -Three starting points, one per trust level: - -* `level1-data.k9.ncl` — pure data, no execution, safe in all environments. -* `level2-validated.k9.ncl` — Nickel contract evaluation permitted. -* `level3-signed.k9.ncl` — full execution; the `signature` field is a - placeholder — generate a real one with your toolchain before use. - -Copy whichever matches the trust you need — the environment grants no more -than the component declares. See https://k9-svc.net/start.html[Get started] -and https://k9-svc.net/spec.html[the specification]. Templates are -`MPL-2.0`; this note is `CC-BY-SA-4.0`. diff --git a/k9-svc/site/public/downloads/k9-svc-templates.tar.gz b/k9-svc/site/public/downloads/k9-svc-templates.tar.gz deleted file mode 100644 index d82ac6f7e06d3d6c5833cc0c8ef246f024adcc1b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1007 zcmV`j$wP`J&-;)TI7Jb-G1JVuI`Cv9 zDxY0GX}{St&!FA%H=m{I?RF(-)$2jC(eN7-7wos%%?kLRe=7G?)Gs zvVkzU0|ET~{sUx%LNHlW1(^cA#i-Ccl~u^u2!YA@EJ1~y^OpmQ-WQABhY(b$%Jih~ zrWGJZHKqAbc@N_;?p4cLg_+;0Il1EYm-}B++R0VUiCVJ zQ6XUphfnF_`VJ1RVW1V4<2yLGhSOqliE7D&HB0Vu zYMIZA8M+Mu%p^-C{WKba?kNgKMNZ9^bI=LWFgi^|lrS#K-!evtG!448P$U!U3B!!* z1m;OfB5r%~CFkVG>arPNNNZi8H7H{__nuyT`ew_&ynAeO}hv2?z-XkX8bTF!gr z@?89SGJJk<-aG1F3{IY%9t~fe_x3&lJBm7f+4ESOMh})_JN!>xU-`e;q=Vn50$l^F z{~tlM+Q$LV?Yckw?hcOJCQ;xf@JDiMH_hgXj}tw_x4Hv$zut1`V;^3ml#B_JaO@p< z@B(K@RQT?V7kkWmQc&pLwUyH;4aM!sR<<8+6Zo%cZ21B=q zM;jpGl6d6t4X|zHlUb8Bnbs`Zgpyfk{uIu9aKqC3+(Mc!qkp;HlPHGgPPja(LbH(EOjDO9O1PQ9q4(8a_N=U|tgNi8 dtgNi8tgNi8tgNi8tgOBo{R5!Z1W^De002`;{ha^+ diff --git a/k9-svc/site/public/downloads/level1-data.k9.ncl b/k9-svc/site/public/downloads/level1-data.k9.ncl deleted file mode 100644 index 29753aa4..00000000 --- a/k9-svc/site/public/downloads/level1-data.k9.ncl +++ /dev/null @@ -1,9 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# K9-SVC template: trust level 1 — pure data, no execution, safe anywhere. -{ - trust_level = 1, - data = { - service = "edge", - replicas = 3, - }, -} diff --git a/k9-svc/site/public/downloads/level2-validated.k9.ncl b/k9-svc/site/public/downloads/level2-validated.k9.ncl deleted file mode 100644 index a025f7a7..00000000 --- a/k9-svc/site/public/downloads/level2-validated.k9.ncl +++ /dev/null @@ -1,10 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# K9-SVC template: trust level 2 — Nickel contract evaluation permitted. -{ - trust_level = 2, - contract = fun v => v | { - service | String, - replicas | Number, - }, - data = { service = "edge", replicas = 3 }, -} diff --git a/k9-svc/site/public/downloads/level3-signed.k9.ncl b/k9-svc/site/public/downloads/level3-signed.k9.ncl deleted file mode 100644 index 4173334d..00000000 --- a/k9-svc/site/public/downloads/level3-signed.k9.ncl +++ /dev/null @@ -1,13 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# K9-SVC template: trust level 3 — full execution, requires a cryptographic -# signature. This file is illustrative: `signature` below is a PLACEHOLDER. -# Unsigned or placeholder-signed level-3 components are refused by the -# toolchain — generate a real signature with your k9-svc tooling before use. -{ - trust_level = 3, - contract = fun v => v | { - action | String, - }, - data = { action = "deploy" }, - signature = "REPLACE_WITH_REAL_SIGNATURE", -} diff --git a/k9-svc/site/public/favicon.svg b/k9-svc/site/public/favicon.svg deleted file mode 100644 index 03c67c84..00000000 --- a/k9-svc/site/public/favicon.svg +++ /dev/null @@ -1,10 +0,0 @@ - - - - - - - - - K9 - diff --git a/k9-svc/site/public/robots.txt b/k9-svc/site/public/robots.txt deleted file mode 100644 index fd6db010..00000000 --- a/k9-svc/site/public/robots.txt +++ /dev/null @@ -1,4 +0,0 @@ -User-agent: * -Allow: / - -Sitemap: https://k9-svc.net/sitemap.xml diff --git a/k9-svc/site/roadmap.adoc b/k9-svc/site/roadmap.adoc deleted file mode 100644 index 05d60f8a..00000000 --- a/k9-svc/site/roadmap.adoc +++ /dev/null @@ -1,53 +0,0 @@ -== - -title: Roadmap site: K9-SVC description: Where K9-SVC is going — -near-term site work, mid-term tooling and teaching, and the longer-term -convergence with typed routing. date: 2026-06-29 — - -== Roadmap - -What’s shipping now, what’s next, and the longer-term direction this -site is pointed at. - -=== Now - -Refreshed site - -Up-to-date content, SEO essentials (structured data, Open Graph, -sitemap, feed) and an accessible-by-default theme. - -Downloads - -Starter templates for each trust level, free to grab from the Downloads -page. - -Sharing - -Share links and an Atom feed so updates propagate — see the footer on -any page. - -=== Next - -* *https://github.com/hyperpolymath/k9-ecosystem/tree/main/members/tooling/k9iser[k9iser]* -— analyses config files (TOML, YAML, JSON, Nickel), infers their -implicit constraints, generates formal K9 contracts from those -constraints, and attests compliance with cryptographic signatures. Its -own docs will surface here. -* *Interactive & teaching area* — try K9-SVC in the browser, worked -examples across all three trust levels. -* *Estate usage examples* — real, concrete places K9-SVC is used across -the Hyperpolymath estate. - -=== Later - -K9-SVC sits alongside longer-running research into a *typed routing -protocol* — work still taking shape, aimed at _entangling -communications_ alongside two related ideas: -*glider-over-typed-surfaces* and *encapsulated-gliders-over-QUIC*. As -that work matures it is expected to converge with K9-SVC’s trust-level -model for signed, self-validating execution. This is a direction, not -yet a shipped spec — details will land here as they solidify. - -=== Follow along - -Subscribe via RSS/Atom Watch on GitHub diff --git a/k9-svc/site/spec.adoc b/k9-svc/site/spec.adoc deleted file mode 100644 index 61d9fc4a..00000000 --- a/k9-svc/site/spec.adoc +++ /dev/null @@ -1,41 +0,0 @@ -== - -title: K9-SVC specification site: K9-SVC brand: K9-SVC description: The -normative K9-SVC v1.0.0-alpha specification — the three-level trust -model, media type, and conformance fixtures. date: 2026-06-29 — - -== Specification - -K9-SVC is at *v1.0.0-alpha*. The normative contractile specification is -maintained in the https://github.com/hyperpolymath/standards[standards] -repository. - -=== Identity - -[cols=",",options="header",] -|=== -|Property |Value -|Extensions |`+.k9+`, `+.k9.ncl+` -|Media type |`+application/vnd.k9+nickel+` -|Encoding |UTF-8 -|Built on |Nickel, Just -|Licence |MPL-2.0 (code), CC-BY-SA-4.0 (docs) -|=== - -=== Trust levels - -The core of the specification is the three-level trust model. A -component must declare its level; the host environment grants capability -up to — and no further than — that level. - -[arabic] -. *Data* — pure data, no execution, safe in all environments. -. *Validation* — Nickel contract evaluation permitted. -. *Execution* — full execution, requires a cryptographic signature. - -=== Conformance - -Conformance fixtures (positive and negative) are coordinated in the -https://github.com/hyperpolymath/k9-ecosystem[k9-ecosystem] hub. -Implementations validate against these vectors to claim support at a -given trust level. diff --git a/k9-svc/site/start.adoc b/k9-svc/site/start.adoc deleted file mode 100644 index a36ceaac..00000000 --- a/k9-svc/site/start.adoc +++ /dev/null @@ -1,57 +0,0 @@ -== - -title: Get started with K9-SVC site: K9-SVC brand: K9-SVC description: -Write, contract and sign a K9-SVC component in three steps, across all -three trust levels. date: 2026-06-29 — - -== Get started - -A K9-SVC component is a Nickel value that declares its own trust level -and contract. The toolchain reads the level and grants no more -capability than the component asks for. - -=== 1. Write a component - -[source,nickel] ----- -# config.k9.ncl -{ - trust_level = 1, # pure data — safe anywhere - data = { - service = "edge", - replicas = 3, - }, -} ----- - -=== 2. Add a contract (level 2) - -[source,nickel] ----- -{ - trust_level = 2, # Nickel contract evaluation permitted - contract = fun v => v | { - service | String, - replicas | Number, - }, - data = { service = "edge", replicas = 3 }, -} ----- - -=== 3. Sign for execution (level 3) - -Level 3 permits full execution and *requires a cryptographic signature*. -Unsigned level-3 components are refused — escalation is never implicit. - -=== Files & types - -* Extensions: `+.k9+`, `+.k9.ncl+` -* Media type: `+application/vnd.k9+nickel+` -* Encoding: UTF-8 - -=== Tooling - -Implementations and CI live in the -https://github.com/hyperpolymath/k9-ecosystem[k9-ecosystem] hub; the -normative spec is in -https://github.com/hyperpolymath/standards[standards]. diff --git a/k9-svc/site/templates/default.html b/k9-svc/site/templates/default.html deleted file mode 120000 index 57f0c4f8..00000000 --- a/k9-svc/site/templates/default.html +++ /dev/null @@ -1 +0,0 @@ -../../../_shared/templates/site-default.html \ No newline at end of file diff --git a/k9-svc/test.sh b/k9-svc/test.sh deleted file mode 100755 index abf66fb3..00000000 --- a/k9-svc/test.sh +++ /dev/null @@ -1,347 +0,0 @@ -#!/bin/sh -# SPDX-License-Identifier: MPL-2.0 -# test.sh - K9 SVC Test Suite -# -# Runs all tests for the K9 Self-Validating Component system. -# Exit codes: 0 = all pass, 1 = failures - -set -eu - -PASS=0 -FAIL=0 -SKIP=0 - -# ───────────────────────────────────────────────────────────── -# Test Utilities -# ───────────────────────────────────────────────────────────── - -green() { printf '\033[32m%s\033[0m\n' "$1"; } -red() { printf '\033[31m%s\033[0m\n' "$1"; } -yellow() { printf '\033[33m%s\033[0m\n' "$1"; } - -pass() { - green " ✓ $1" - PASS=$((PASS + 1)) -} - -fail() { - red " ✗ $1" - FAIL=$((FAIL + 1)) -} - -skip() { - yellow " ○ $1 (skipped)" - SKIP=$((SKIP + 1)) -} - -section() { - echo "" - echo "━━━ $1 ━━━" -} - -# ───────────────────────────────────────────────────────────── -# Environment Tests -# ───────────────────────────────────────────────────────────── - -test_environment() { - section "Environment" - - # Test must shim - if ./must status >/dev/null 2>&1; then - pass "must shim executes" - else - fail "must shim failed" - fi - - # Test OS detection - os=$(./must status | grep "OS:" | awk '{print $2}') - if [ -n "$os" ]; then - pass "OS detected: $os" - else - fail "OS detection failed" - fi - - # Test Nickel - if command -v nickel >/dev/null 2>&1; then - pass "Nickel installed" - else - fail "Nickel not found" - fi - - # Test Just - if command -v just >/dev/null 2>&1; then - pass "Just installed" - else - fail "Just not found" - fi - - # Test OpenSSL (for signing) - if command -v openssl >/dev/null 2>&1; then - if openssl genpkey -algorithm Ed25519 -out /dev/null 2>/dev/null; then - pass "OpenSSL with Ed25519 support" - else - skip "OpenSSL without Ed25519 (older version)" - fi - else - skip "OpenSSL not installed" - fi -} - -# ───────────────────────────────────────────────────────────── -# Schema Tests -# ───────────────────────────────────────────────────────────── - -test_schemas() { - section "Schema Validation" - - # Test pedigree.ncl - if nickel typecheck pedigree.ncl 2>/dev/null; then - pass "pedigree.ncl typechecks" - else - fail "pedigree.ncl typecheck failed" - fi - - # Test register.ncl - if nickel typecheck register.ncl 2>/dev/null; then - pass "register.ncl typechecks" - else - fail "register.ncl typecheck failed" - fi - - # Test leash.ncl - if nickel typecheck leash.ncl 2>/dev/null; then - pass "leash.ncl typechecks" - else - fail "leash.ncl typecheck failed" - fi -} - -# ───────────────────────────────────────────────────────────── -# Example Tests -# ───────────────────────────────────────────────────────────── - -test_examples() { - section "Example Components" - - # Test hello.k9 (Kennel level) - if [ -f "examples/hello.k9" ]; then - if head -1 examples/hello.k9 | grep -q "K9!"; then - pass "hello.k9 has magic number" - else - fail "hello.k9 missing magic number" - fi - else - fail "hello.k9 not found" - fi - - # Test config.k9.ncl (Yard level) - if [ -f "examples/config.k9.ncl" ]; then - if nickel typecheck examples/config.k9.ncl 2>/dev/null; then - pass "config.k9.ncl typechecks" - else - fail "config.k9.ncl typecheck failed" - fi - else - fail "config.k9.ncl not found" - fi - - # Test deploy.k9.ncl (Hunt level) - if [ -f "examples/deploy.k9.ncl" ]; then - if nickel typecheck examples/deploy.k9.ncl 2>/dev/null; then - pass "deploy.k9.ncl typechecks" - else - fail "deploy.k9.ncl typecheck failed" - fi - - # Check it declares Hunt level - if grep -q "trust_level.*'Hunt" examples/deploy.k9.ncl; then - pass "deploy.k9.ncl declares Hunt level" - else - fail "deploy.k9.ncl should declare Hunt level" - fi - else - fail "deploy.k9.ncl not found" - fi -} - -# ───────────────────────────────────────────────────────────── -# MIME Tests -# ───────────────────────────────────────────────────────────── - -test_mime() { - section "MIME Files" - - # Test k9.xml - if [ -f "mime/k9.xml" ]; then - if command -v xmllint >/dev/null 2>&1; then - if xmllint --noout mime/k9.xml 2>/dev/null; then - pass "k9.xml is valid XML" - else - fail "k9.xml is invalid XML" - fi - else - skip "xmllint not installed" - fi - - # Check for magic number definition - if grep -q 'value="K9!"' mime/k9.xml; then - pass "k9.xml defines magic number" - else - fail "k9.xml missing magic number" - fi - else - fail "mime/k9.xml not found" - fi - - # Test k9.uti.plist (macOS) - if [ -f "mime/k9.uti.plist" ]; then - if command -v xmllint >/dev/null 2>&1; then - if xmllint --noout mime/k9.uti.plist 2>/dev/null; then - pass "k9.uti.plist is valid XML" - else - fail "k9.uti.plist is invalid XML" - fi - else - skip "xmllint not installed" - fi - else - fail "mime/k9.uti.plist not found" - fi - - # Test k9.magic - if [ -f "mime/k9.magic" ]; then - if grep -q "K9!" mime/k9.magic; then - pass "k9.magic defines magic pattern" - else - fail "k9.magic missing magic pattern" - fi - else - fail "mime/k9.magic not found" - fi -} - -# ───────────────────────────────────────────────────────────── -# Signing Tests -# ───────────────────────────────────────────────────────────── - -test_signing() { - section "Signing System" - - if [ ! -f "sign.sh" ]; then - fail "sign.sh not found" - return - fi - - if [ ! -x "sign.sh" ]; then - fail "sign.sh not executable" - return - fi - - # Check OpenSSL Ed25519 support - if ! command -v openssl >/dev/null 2>&1; then - skip "OpenSSL not installed" - return - fi - - if ! openssl genpkey -algorithm Ed25519 -out /dev/null 2>/dev/null; then - skip "OpenSSL doesn't support Ed25519" - return - fi - - # Test key generation (in temp dir) - tmpdir=$(mktemp -d) - export XDG_CONFIG_HOME="$tmpdir" - - if ./sign.sh keygen test 2>/dev/null; then - pass "Key generation works" - - # Test key listing - if ./sign.sh list 2>/dev/null | grep -q "test"; then - pass "Key listing works" - else - fail "Key listing failed" - fi - - # Test signing - echo "test content" > "$tmpdir/testfile" - if ./sign.sh sign "$tmpdir/testfile" test 2>/dev/null; then - pass "Signing works" - - # Trust the key (XDG_CONFIG_HOME is $tmpdir, so keys are in $tmpdir/k9/keys/) - ./sign.sh trust "$tmpdir/k9/keys/test.pub" 2>/dev/null - - # Test verification - if ./sign.sh verify "$tmpdir/testfile" 2>/dev/null; then - pass "Verification works" - else - fail "Verification failed" - fi - else - fail "Signing failed" - fi - else - fail "Key generation failed" - fi - - rm -rf "$tmpdir" - unset XDG_CONFIG_HOME -} - -# ───────────────────────────────────────────────────────────── -# Container Tests -# ───────────────────────────────────────────────────────────── - -test_container() { - section "Container" - - if [ -f "Containerfile" ]; then - pass "Containerfile exists" - - # Check for multi-stage build - if grep -q "FROM.*AS builder" Containerfile; then - pass "Multi-stage build configured" - else - fail "Multi-stage build not configured" - fi - - # Check for non-root user - if grep -q "USER" Containerfile; then - pass "Non-root user configured" - else - fail "Running as root (security issue)" - fi - else - fail "Containerfile not found" - fi - - if [ -f "compose.yaml" ]; then - pass "compose.yaml exists" - else - skip "compose.yaml not found" - fi -} - -# ───────────────────────────────────────────────────────────── -# Main -# ───────────────────────────────────────────────────────────── - -echo "K9 SVC Test Suite" -echo "═════════════════════════════════════" - -test_environment -test_schemas -test_examples -test_mime -test_signing -test_container - -echo "" -echo "═════════════════════════════════════" -echo "Results: $(green "$PASS passed"), $(red "$FAIL failed"), $(yellow "$SKIP skipped")" -echo "" - -if [ "$FAIL" -gt 0 ]; then - exit 1 -fi - -exit 0 diff --git a/k9-svc/tools/Justfile b/k9-svc/tools/Justfile deleted file mode 100644 index 1431f9a0..00000000 --- a/k9-svc/tools/Justfile +++ /dev/null @@ -1,46 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Justfile for K9 tools - -set shell := ["bash", "-euo", "pipefail", "-c"] - -default: - @just --list --unsorted - -all: build - -build: build-k9-init build-k9-validate build-k9-sign - @echo "All K9 tools built successfully" - -build-k9-init: - @echo "Building k9-init..." - cd src/k9-init && cargo build --release - -build-k9-validate: - @echo "Building k9-validate..." - cd src/k9-validate && cargo build --release - -build-k9-sign: - @echo "Building k9-sign..." - cd src/k9-sign && cargo build --release - -install: install-k9-init install-k9-validate install-k9-sign - @echo "All K9 tools installed" - -install-k9-init: build-k9-init - sudo cp src/k9-init/target/release/k9-init /usr/local/bin/ - -install-k9-validate: build-k9-validate - sudo cp src/k9-validate/target/release/k9-validate /usr/local/bin/ - -install-k9-sign: build-k9-sign - sudo cp src/k9-sign/target/release/k9-sign /usr/local/bin/ - -test: - cd src/k9-init && cargo test - cd src/k9-validate && cargo test - cd src/k9-sign && cargo test - -clean: - cd src/k9-init && cargo clean - cd src/k9-validate && cargo clean - cd src/k9-sign && cargo clean diff --git a/k9-svc/tools/README.adoc b/k9-svc/tools/README.adoc deleted file mode 100644 index 73d4c3c5..00000000 --- a/k9-svc/tools/README.adoc +++ /dev/null @@ -1,393 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -= K9 Tools -:toc: preamble -:toclevels: 2 -:icons: font - -Essential tooling for K9 contractile development and adoption. - -== Overview - -K9 Tools provides everything you need to create, validate, sign, and deploy K9 contractiles: - -* **k9-init** - Scaffold new K9 configs from templates -* **k9-validate** - Standalone validator (without just/must dependencies) -* **k9-sign** - Simplified signing workflow with Ed25519 -* **GitHub Action** - Validate K9 contractiles in CI -* **VS Code Extension** - Syntax highlighting + validation -* **Template Library** - Common use cases (web server, build, deploy, etc.) - -== Installation - -=== From Source - -[source,bash] ----- -git clone https://github.com/hyperpolymath/k9-tools.git -cd k9-tools - -# Install all tools -make install - -# Or install individually -make install-k9-init -make install-k9-validate -make install-k9-sign ----- - -=== Package Managers - -[source,bash] ----- -# Cargo (Rust) -cargo install k9-tools - -# npm (JavaScript) -npm install -g @hyperpolymath/k9-tools - -# Homebrew (macOS/Linux) -brew install hyperpolymath/tap/k9-tools ----- - -== Quick Start - -=== Initialize a New K9 Contractile - -[source,bash] ----- -# Interactive mode -k9-init - -# From template -k9-init --template web-server - -# With options -k9-init --name my-app --security-level yard ----- - -=== Validate a K9 Contractile - -[source,bash] ----- -# Validate single file -k9-validate setup.k9.ncl - -# Validate directory -k9-validate . - -# With strict mode -k9-validate --strict setup.k9.ncl ----- - -=== Sign a K9 Contractile - -[source,bash] ----- -# Generate keypair (first time) -k9-sign keygen - -# Sign contractile -k9-sign sign setup.k9.ncl - -# Verify signature -k9-sign verify setup.k9.ncl ----- - -== Tools - -=== k9-init - -Scaffold new K9 contractiles from templates. - -**Features:** -- Interactive prompt for configuration -- Pre-built templates for common use cases -- Security level selection (kennel/yard/hunt) -- Automatic must/just/nickel generation - -**Usage:** -[source,bash] ----- -k9-init [OPTIONS] - -Options: - --template Use template (web-server, build, deploy, etc.) - --name Contractile name - --security Security level (kennel, yard, hunt) - --output Output directory - --interactive Interactive mode (default) ----- - -**Templates Available:** -- `web-server` - Deploy web server (nginx, caddy, Apache) -- `build` - Build automation (Rust, Node, Go, etc.) -- `deploy` - Deployment workflow (Docker, k8s, etc.) -- `dev-env` - Development environment setup -- `ci-cd` - CI/CD pipeline -- `backup` - Backup and restore -- `monitoring` - Monitoring setup (Prometheus, Grafana) -- `minimal` - Minimal K9 contractile - -=== k9-validate - -Standalone validator for K9 contractiles. - -**Features:** -- Schema validation (must-just-nickel structure) -- Security level checking -- Signature verification (optional) -- No runtime dependencies (just/must not required) - -**Usage:** -[source,bash] ----- -k9-validate [OPTIONS] - -Options: - --strict Strict validation (fail on warnings) - --check-signatures Verify cryptographic signatures - --schema Custom schema file - --format Output format ----- - -**Exit Codes:** -- `0` - Valid K9 contractile -- `1` - Validation errors -- `2` - Schema errors -- `3` - File not found - -=== k9-sign - -Simplified signing workflow for K9 contractiles. - -**Features:** -- Ed25519 keypair generation -- Sign contractiles with metadata -- Verify signatures -- Key management (import/export) - -**Usage:** -[source,bash] ----- -k9-sign [OPTIONS] - -Commands: - keygen Generate new Ed25519 keypair - sign Sign contractile - verify Verify signature - import Import private key - export Export public key - -Options: - --key-file Key file location (default: ~/.k9/keys/) - --output Output file for signed contractile ----- - -**Key Storage:** -- Private keys: `~/.k9/keys/private.key` (encrypted) -- Public keys: `~/.k9/keys/public.key` -- Signatures: Embedded in contractile metadata - -=== GitHub Action - -Validate K9 contractiles in CI/CD pipelines. - -**Usage:** -[source,yaml] ----- -name: Validate K9 Contractiles - -on: - push: - paths: - - '**.k9.ncl' - pull_request: - paths: - - '**.k9.ncl' - -jobs: - validate: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - name: Validate K9 Contractiles - uses: hyperpolymath/validate-k9@v1 - with: - path: '.' - strict: true - check-signatures: false ----- - -**Inputs:** -- `path` - Directory or file to validate (default: `.`) -- `strict` - Enable strict validation (default: `false`) -- `check-signatures` - Verify signatures (default: `false`) -- `fail-on-warnings` - Fail on warnings (default: `false`) - -=== VS Code Extension - -Syntax highlighting and validation for K9 contractiles. - -**Features:** -- Syntax highlighting for `.k9.ncl` files -- Real-time validation -- Auto-completion for directives -- Hover documentation -- Signature verification indicators - -**Installation:** -[source,bash] ----- -# From VS Code Marketplace -code --install-extension hyperpolymath.k9-tools - -# Or via Extensions panel -# Search: "K9 Tools" ----- - -**Features:** -- Language server protocol (LSP) integration -- Diagnostics (errors, warnings) -- Quick fixes for common issues -- Snippet library for common patterns - -== Template Library - -Pre-built templates for common K9 use cases. - -=== Available Templates - -==== web-server - -Deploy and configure web servers. - -**Variants:** -- `nginx` - nginx web server -- `caddy` - Caddy web server (automatic HTTPS) -- `apache` - Apache HTTP Server - -**Example:** -[source,bash] ----- -k9-init --template web-server/nginx ----- - -==== build - -Build automation for various languages. - -**Variants:** -- `rust` - Rust project (cargo) -- `node` - Node.js project (npm/pnpm) -- `go` - Go project -- `python` - Python project (poetry) - -**Example:** -[source,bash] ----- -k9-init --template build/rust ----- - -==== deploy - -Deployment workflows. - -**Variants:** -- `docker` - Docker deployment -- `kubernetes` - Kubernetes deployment -- `terraform` - Terraform infrastructure - -**Example:** -[source,bash] ----- -k9-init --template deploy/docker ----- - -==== dev-env - -Development environment setup. - -**Variants:** -- `minimal` - Minimal dev tools -- `full-stack` - Full-stack web development -- `data-science` - Data science environment - -**Example:** -[source,bash] ----- -k9-init --template dev-env/full-stack ----- - -== Development - -=== Building from Source - -[source,bash] ----- -# Clone repository -git clone https://github.com/hyperpolymath/k9-tools.git -cd k9-tools - -# Build all tools -make build - -# Run tests -make test - -# Install locally -make install ----- - -=== Project Structure - -[source] ----- -k9-tools/ -├── src/ -│ ├── k9-init/ # Scaffolding tool -│ ├── k9-validate/ # Validator -│ └── k9-sign/ # Signing tool -├── templates/ # Template library -│ ├── web-server/ -│ ├── build/ -│ ├── deploy/ -│ └── dev-env/ -├── github-action/ # GitHub Action -├── vscode-extension/ # VS Code extension -└── docs/ # Documentation - ----- - -=== Contributing - -See link:CONTRIBUTING.adoc[CONTRIBUTING.adoc] for guidelines. - -== Documentation - -- **Getting Started**: link:docs/GETTING-STARTED.adoc[Getting Started Guide] -- **Template Guide**: link:docs/TEMPLATES.adoc[Template Guide] -- **API Reference**: link:docs/API.adoc[API Reference] -- **Examples**: link:examples/[examples/] - -== License - -PMPL-1.0-or-later. See link:LICENSE[LICENSE]. - -== Related Projects - -- **k9-svc**: https://github.com/hyperpolymath/standards/tree/main/k9-svc -- **rsr-template-repo**: https://github.com/hyperpolymath/rsr-template-repo -- **Nickel**: https://nickel-lang.org - -== Support - -- **Issues**: https://github.com/hyperpolymath/k9-tools/issues -- **Discussions**: https://github.com/hyperpolymath/k9-tools/discussions -- **Email**: j.d.a.jewell@open.ac.uk - ---- - -**Created:** 2026-01-30 -**Author:** Jonathan D.A. Jewell -**Co-Authored-By:** Claude Sonnet 4.5 diff --git a/k9-svc/tools/github-action/action.yml b/k9-svc/tools/github-action/action.yml deleted file mode 100644 index 37d4d2be..00000000 --- a/k9-svc/tools/github-action/action.yml +++ /dev/null @@ -1,125 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: 'Validate K9 Contractiles' -description: 'Validate K9 contractiles in CI/CD pipelines' -author: 'Jonathan D.A. Jewell ' - -branding: - icon: 'check-circle' - color: 'blue' - -inputs: - path: - description: 'Directory or file to validate' - required: false - default: '.' - - strict: - description: 'Enable strict validation (fail on warnings)' - required: false - default: 'false' - - check-signatures: - description: 'Verify cryptographic signatures' - required: false - default: 'false' - - fail-on-warnings: - description: 'Treat warnings as errors' - required: false - default: 'false' - - k9-validate-version: - description: 'Version of k9-validate to use' - required: false - default: 'latest' - -outputs: - files-validated: - description: 'Number of files validated' - value: ${{ steps.validate.outputs.files-validated }} - - errors: - description: 'Number of validation errors' - value: ${{ steps.validate.outputs.errors }} - - warnings: - description: 'Number of validation warnings' - value: ${{ steps.validate.outputs.warnings }} - -runs: - using: 'composite' - steps: - - name: Install k9-validate - shell: bash - run: | - echo "Installing k9-validate..." - - # Download k9-validate binary - VERSION="${{ inputs.k9-validate-version }}" - if [ "$VERSION" = "latest" ]; then - DOWNLOAD_URL="https://github.com/hyperpolymath/k9-tools/releases/latest/download/k9-validate-linux-x64" - else - DOWNLOAD_URL="https://github.com/hyperpolymath/k9-tools/releases/download/${VERSION}/k9-validate-linux-x64" - fi - - curl -fsSL "$DOWNLOAD_URL" -o /tmp/k9-validate - chmod +x /tmp/k9-validate - - echo "✓ k9-validate installed" - - - name: Validate K9 Contractiles - id: validate - shell: bash - run: | - echo "Validating K9 contractiles in: ${{ inputs.path }}" - - # Build validation command - VALIDATE_CMD="/tmp/k9-validate ${{ inputs.path }}" - - if [ "${{ inputs.strict }}" = "true" ]; then - VALIDATE_CMD="$VALIDATE_CMD --strict" - fi - - if [ "${{ inputs.check-signatures }}" = "true" ]; then - VALIDATE_CMD="$VALIDATE_CMD --check-signatures" - fi - - VALIDATE_CMD="$VALIDATE_CMD --format json" - - # Run validation - OUTPUT=$($VALIDATE_CMD 2>&1 || true) - EXIT_CODE=$? - - echo "$OUTPUT" - - # Parse results (simplified) - FILES_VALIDATED=$(echo "$OUTPUT" | grep -c ".k9.ncl" || echo "0") - ERRORS=$(echo "$OUTPUT" | grep -c "ERROR" || echo "0") - WARNINGS=$(echo "$OUTPUT" | grep -c "WARNING" || echo "0") - - # Set outputs - echo "files-validated=$FILES_VALIDATED" >> $GITHUB_OUTPUT - echo "errors=$ERRORS" >> $GITHUB_OUTPUT - echo "warnings=$WARNINGS" >> $GITHUB_OUTPUT - - # Summary - echo "## K9 Validation Results" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "| Metric | Count |" >> $GITHUB_STEP_SUMMARY - echo "|--------|-------|" >> $GITHUB_STEP_SUMMARY - echo "| Files Validated | $FILES_VALIDATED |" >> $GITHUB_STEP_SUMMARY - echo "| Errors | $ERRORS |" >> $GITHUB_STEP_SUMMARY - echo "| Warnings | $WARNINGS |" >> $GITHUB_STEP_SUMMARY - - # Check exit status - if [ $EXIT_CODE -ne 0 ]; then - echo "❌ Validation failed" - exit 1 - fi - - if [ "$WARNINGS" -gt 0 ] && [ "${{ inputs.fail-on-warnings }}" = "true" ]; then - echo "❌ Validation failed (fail-on-warnings enabled)" - exit 1 - fi - - echo "✅ Validation passed" diff --git a/k9-svc/tools/manifest.scm b/k9-svc/tools/manifest.scm deleted file mode 100644 index dd942c7f..00000000 --- a/k9-svc/tools/manifest.scm +++ /dev/null @@ -1,24 +0,0 @@ -;;; SPDX-License-Identifier: MPL-2.0 -;;; manifest.scm — Generic Guix manifest for RSR-compliant projects -;;; -;;; Usage: -;;; guix shell -m manifest.scm -;;; - -(specifications->manifest - '(;; Core development tools - "git" - "just" - "nickel" - "curl" - "bash" - "coreutils" - - ;; Documentation - "asciidoctor" - "pandoc" - - ;; Common build dependencies - "openssl" - "zlib" - "pkg-config")) diff --git a/k9-svc/tools/src/k9-init/Cargo.lock b/k9-svc/tools/src/k9-init/Cargo.lock deleted file mode 100644 index 74f312c3..00000000 --- a/k9-svc/tools/src/k9-init/Cargo.lock +++ /dev/null @@ -1,1465 +0,0 @@ -# This file is automatically @generated by Cargo. -# It is not intended for manual editing. -version = 4 - -[[package]] -name = "aho-corasick" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301" -dependencies = [ - "memchr", -] - -[[package]] -name = "android_system_properties" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311" -dependencies = [ - "libc", -] - -[[package]] -name = "anstream" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d" -dependencies = [ - "anstyle", - "anstyle-parse", - "anstyle-query", - "anstyle-wincon", - "colorchoice", - "is_terminal_polyfill", - "utf8parse", -] - -[[package]] -name = "anstyle" -version = "1.0.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000" - -[[package]] -name = "anstyle-parse" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e" -dependencies = [ - "utf8parse", -] - -[[package]] -name = "anstyle-query" -version = "1.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" -dependencies = [ - "windows-sys 0.61.2", -] - -[[package]] -name = "anstyle-wincon" -version = "3.0.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" -dependencies = [ - "anstyle", - "once_cell_polyfill", - "windows-sys 0.61.2", -] - -[[package]] -name = "anyhow" -version = "1.0.102" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c" - -[[package]] -name = "autocfg" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" - -[[package]] -name = "bitflags" -version = "2.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" - -[[package]] -name = "block-buffer" -version = "0.10.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" -dependencies = [ - "generic-array", -] - -[[package]] -name = "bstr" -version = "1.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63044e1ae8e69f3b5a92c736ca6269b8d12fa7efe39bf34ddb06d102cf0e2cab" -dependencies = [ - "memchr", - "serde", -] - -[[package]] -name = "bumpalo" -version = "3.20.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb" - -[[package]] -name = "cc" -version = "1.2.59" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b7a4d3ec6524d28a329fc53654bbadc9bdd7b0431f5d65f1a56ffb28a1ee5283" -dependencies = [ - "find-msvc-tools", - "shlex", -] - -[[package]] -name = "cfg-if" -version = "1.0.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" - -[[package]] -name = "chrono" -version = "0.4.44" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0" -dependencies = [ - "iana-time-zone", - "js-sys", - "num-traits", - "wasm-bindgen", - "windows-link", -] - -[[package]] -name = "chrono-tz" -version = "0.9.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93698b29de5e97ad0ae26447b344c482a7284c737d9ddc5f9e52b74a336671bb" -dependencies = [ - "chrono", - "chrono-tz-build", - "phf", -] - -[[package]] -name = "chrono-tz-build" -version = "0.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c088aee841df9c3041febbb73934cfc39708749bf96dc827e3359cd39ef11b1" -dependencies = [ - "parse-zoneinfo", - "phf", - "phf_codegen", -] - -[[package]] -name = "clap" -version = "4.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351" -dependencies = [ - "clap_builder", - "clap_derive", -] - -[[package]] -name = "clap_builder" -version = "4.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" -dependencies = [ - "anstream", - "anstyle", - "clap_lex", - "strsim", -] - -[[package]] -name = "clap_derive" -version = "4.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1110bd8a634a1ab8cb04345d8d878267d57c3cf1b38d91b71af6686408bbca6a" -dependencies = [ - "heck", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "clap_lex" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" - -[[package]] -name = "colorchoice" -version = "1.0.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570" - -[[package]] -name = "console" -version = "0.15.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "054ccb5b10f9f2cbf51eb355ca1d05c2d279ce1804688d0db74b4733a5aeafd8" -dependencies = [ - "encode_unicode", - "libc", - "once_cell", - "unicode-width", - "windows-sys 0.59.0", -] - -[[package]] -name = "core-foundation-sys" -version = "0.8.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" - -[[package]] -name = "cpufeatures" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] - -[[package]] -name = "crossbeam-deque" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51" -dependencies = [ - "crossbeam-epoch", - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-epoch" -version = "0.9.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e" -dependencies = [ - "crossbeam-utils", -] - -[[package]] -name = "crossbeam-utils" -version = "0.8.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28" - -[[package]] -name = "crypto-common" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" -dependencies = [ - "generic-array", - "typenum", -] - -[[package]] -name = "deunicode" -version = "1.6.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "abd57806937c9cc163efc8ea3910e00a62e2aeb0b8119f1793a978088f8f6b04" - -[[package]] -name = "dialoguer" -version = "0.11.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "658bce805d770f407bc62102fca7c2c64ceef2fbcb2b8bd19d2765ce093980de" -dependencies = [ - "console", - "shell-words", - "tempfile", - "thiserror", - "zeroize", -] - -[[package]] -name = "digest" -version = "0.10.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" -dependencies = [ - "block-buffer", - "crypto-common", -] - -[[package]] -name = "encode_unicode" -version = "1.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0" - -[[package]] -name = "equivalent" -version = "1.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f" - -[[package]] -name = "errno" -version = "0.3.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" -dependencies = [ - "libc", - "windows-sys 0.61.2", -] - -[[package]] -name = "fastrand" -version = "2.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be" - -[[package]] -name = "find-msvc-tools" -version = "0.1.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" - -[[package]] -name = "foldhash" -version = "0.1.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" - -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - -[[package]] -name = "getrandom" -version = "0.2.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" -dependencies = [ - "cfg-if", - "libc", - "wasi", -] - -[[package]] -name = "getrandom" -version = "0.4.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" -dependencies = [ - "cfg-if", - "libc", - "r-efi", - "wasip2", - "wasip3", -] - -[[package]] -name = "globset" -version = "0.4.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3" -dependencies = [ - "aho-corasick", - "bstr", - "log", - "regex-automata", - "regex-syntax", -] - -[[package]] -name = "globwalk" -version = "0.9.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757" -dependencies = [ - "bitflags", - "ignore", - "walkdir", -] - -[[package]] -name = "hashbrown" -version = "0.15.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1" -dependencies = [ - "foldhash", -] - -[[package]] -name = "hashbrown" -version = "0.16.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100" - -[[package]] -name = "heck" -version = "0.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" - -[[package]] -name = "humansize" -version = "2.1.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7" -dependencies = [ - "libm", -] - -[[package]] -name = "iana-time-zone" -version = "0.1.65" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470" -dependencies = [ - "android_system_properties", - "core-foundation-sys", - "iana-time-zone-haiku", - "js-sys", - "log", - "wasm-bindgen", - "windows-core", -] - -[[package]] -name = "iana-time-zone-haiku" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f" -dependencies = [ - "cc", -] - -[[package]] -name = "id-arena" -version = "2.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954" - -[[package]] -name = "ignore" -version = "0.4.25" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d3d782a365a015e0f5c04902246139249abf769125006fbe7649e2ee88169b4a" -dependencies = [ - "crossbeam-deque", - "globset", - "log", - "memchr", - "regex-automata", - "same-file", - "walkdir", - "winapi-util", -] - -[[package]] -name = "indexmap" -version = "2.13.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "45a8a2b9cb3e0b0c1803dbb0758ffac5de2f425b23c28f518faabd9d805342ff" -dependencies = [ - "equivalent", - "hashbrown 0.16.1", - "serde", - "serde_core", -] - -[[package]] -name = "is_terminal_polyfill" -version = "1.70.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695" - -[[package]] -name = "itoa" -version = "1.0.18" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" - -[[package]] -name = "js-sys" -version = "0.3.94" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2e04e2ef80ce82e13552136fabeef8a5ed1f985a96805761cbb9a2c34e7664d9" -dependencies = [ - "once_cell", - "wasm-bindgen", -] - -[[package]] -name = "k9-init" -version = "1.0.0" -dependencies = [ - "anyhow", - "chrono", - "clap", - "dialoguer", - "serde", - "serde_json", - "tera", - "toml", - "walkdir", -] - -[[package]] -name = "lazy_static" -version = "1.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe" - -[[package]] -name = "leb128fmt" -version = "0.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2" - -[[package]] -name = "libc" -version = "0.2.184" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "48f5d2a454e16a5ea0f4ced81bd44e4cfc7bd3a507b61887c99fd3538b28e4af" - -[[package]] -name = "libm" -version = "0.2.16" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981" - -[[package]] -name = "linux-raw-sys" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53" - -[[package]] -name = "log" -version = "0.4.29" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897" - -[[package]] -name = "memchr" -version = "2.8.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79" - -[[package]] -name = "num-traits" -version = "0.2.19" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841" -dependencies = [ - "autocfg", -] - -[[package]] -name = "once_cell" -version = "1.21.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" - -[[package]] -name = "once_cell_polyfill" -version = "1.70.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" - -[[package]] -name = "parse-zoneinfo" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f2a05b18d44e2957b88f96ba460715e295bc1d7510468a2f3d3b44535d26c24" -dependencies = [ - "regex", -] - -[[package]] -name = "percent-encoding" -version = "2.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220" - -[[package]] -name = "pest" -version = "2.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662" -dependencies = [ - "memchr", - "ucd-trie", -] - -[[package]] -name = "pest_derive" -version = "2.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77" -dependencies = [ - "pest", - "pest_generator", -] - -[[package]] -name = "pest_generator" -version = "2.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f" -dependencies = [ - "pest", - "pest_meta", - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "pest_meta" -version = "2.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220" -dependencies = [ - "pest", - "sha2", -] - -[[package]] -name = "phf" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078" -dependencies = [ - "phf_shared", -] - -[[package]] -name = "phf_codegen" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "aef8048c789fa5e851558d709946d6d79a8ff88c0440c587967f8e94bfb1216a" -dependencies = [ - "phf_generator", - "phf_shared", -] - -[[package]] -name = "phf_generator" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d" -dependencies = [ - "phf_shared", - "rand", -] - -[[package]] -name = "phf_shared" -version = "0.11.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5" -dependencies = [ - "siphasher", -] - -[[package]] -name = "ppv-lite86" -version = "0.2.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9" -dependencies = [ - "zerocopy", -] - -[[package]] -name = "prettyplease" -version = "0.2.37" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b" -dependencies = [ - "proc-macro2", - "syn", -] - -[[package]] -name = "proc-macro2" -version = "1.0.106" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "quote" -version = "1.0.45" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" -dependencies = [ - "proc-macro2", -] - -[[package]] -name = "r-efi" -version = "6.0.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf" - -[[package]] -name = "rand" -version = "0.8.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a" -dependencies = [ - "libc", - "rand_chacha", - "rand_core", -] - -[[package]] -name = "rand_chacha" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88" -dependencies = [ - "ppv-lite86", - "rand_core", -] - -[[package]] -name = "rand_core" -version = "0.6.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c" -dependencies = [ - "getrandom 0.2.17", -] - -[[package]] -name = "regex" -version = "1.12.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276" -dependencies = [ - "aho-corasick", - "memchr", - "regex-automata", - "regex-syntax", -] - -[[package]] -name = "regex-automata" -version = "0.4.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f" -dependencies = [ - "aho-corasick", - "memchr", - "regex-syntax", -] - -[[package]] -name = "regex-syntax" -version = "0.8.10" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a" - -[[package]] -name = "rustix" -version = "1.1.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190" -dependencies = [ - "bitflags", - "errno", - "libc", - "linux-raw-sys", - "windows-sys 0.61.2", -] - -[[package]] -name = "rustversion" -version = "1.0.22" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" - -[[package]] -name = "same-file" -version = "1.0.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502" -dependencies = [ - "winapi-util", -] - -[[package]] -name = "semver" -version = "1.0.28" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd" - -[[package]] -name = "serde" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e" -dependencies = [ - "serde_core", - "serde_derive", -] - -[[package]] -name = "serde_core" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad" -dependencies = [ - "serde_derive", -] - -[[package]] -name = "serde_derive" -version = "1.0.228" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "serde_json" -version = "1.0.149" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86" -dependencies = [ - "itoa", - "memchr", - "serde", - "serde_core", - "zmij", -] - -[[package]] -name = "serde_spanned" -version = "0.6.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3" -dependencies = [ - "serde", -] - -[[package]] -name = "sha2" -version = "0.10.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" -dependencies = [ - "cfg-if", - "cpufeatures", - "digest", -] - -[[package]] -name = "shell-words" -version = "1.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc6fe69c597f9c37bfeeeeeb33da3530379845f10be461a66d16d03eca2ded77" - -[[package]] -name = "shlex" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" - -[[package]] -name = "siphasher" -version = "1.0.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e" - -[[package]] -name = "slug" -version = "0.1.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "882a80f72ee45de3cc9a5afeb2da0331d58df69e4e7d8eeb5d3c7784ae67e724" -dependencies = [ - "deunicode", - "wasm-bindgen", -] - -[[package]] -name = "strsim" -version = "0.11.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f" - -[[package]] -name = "syn" -version = "2.0.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" -dependencies = [ - "proc-macro2", - "quote", - "unicode-ident", -] - -[[package]] -name = "tempfile" -version = "3.27.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd" -dependencies = [ - "fastrand", - "getrandom 0.4.2", - "once_cell", - "rustix", - "windows-sys 0.61.2", -] - -[[package]] -name = "tera" -version = "1.20.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e8004bca281f2d32df3bacd59bc67b312cb4c70cea46cbd79dbe8ac5ed206722" -dependencies = [ - "chrono", - "chrono-tz", - "globwalk", - "humansize", - "lazy_static", - "percent-encoding", - "pest", - "pest_derive", - "rand", - "regex", - "serde", - "serde_json", - "slug", - "unicode-segmentation", -] - -[[package]] -name = "thiserror" -version = "1.0.69" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52" -dependencies = [ - "thiserror-impl", -] - -[[package]] -name = "thiserror-impl" -version = "1.0.69" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "toml" -version = "0.8.23" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362" -dependencies = [ - "serde", - "serde_spanned", - "toml_datetime", - "toml_edit", -] - -[[package]] -name = "toml_datetime" -version = "0.6.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c" -dependencies = [ - "serde", -] - -[[package]] -name = "toml_edit" -version = "0.22.27" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a" -dependencies = [ - "indexmap", - "serde", - "serde_spanned", - "toml_datetime", - "toml_write", - "winnow", -] - -[[package]] -name = "toml_write" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5d99f8c9a7727884afe522e9bd5edbfc91a3312b36a77b5fb8926e4c31a41801" - -[[package]] -name = "typenum" -version = "1.19.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb" - -[[package]] -name = "ucd-trie" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971" - -[[package]] -name = "unicode-ident" -version = "1.0.24" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" - -[[package]] -name = "unicode-segmentation" -version = "1.13.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9629274872b2bfaf8d66f5f15725007f635594914870f65218920345aa11aa8c" - -[[package]] -name = "unicode-width" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254" - -[[package]] -name = "unicode-xid" -version = "0.2.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853" - -[[package]] -name = "utf8parse" -version = "0.2.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" - -[[package]] -name = "version_check" -version = "0.9.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" - -[[package]] -name = "walkdir" -version = "2.5.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b" -dependencies = [ - "same-file", - "winapi-util", -] - -[[package]] -name = "wasi" -version = "0.11.1+wasi-snapshot-preview1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b" - -[[package]] -name = "wasip2" -version = "1.0.2+wasi-0.2.9" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5" -dependencies = [ - "wit-bindgen", -] - -[[package]] -name = "wasip3" -version = "0.4.0+wasi-0.3.0-rc-2026-01-06" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5" -dependencies = [ - "wit-bindgen", -] - -[[package]] -name = "wasm-bindgen" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0551fc1bb415591e3372d0bc4780db7e587d84e2a7e79da121051c5c4b89d0b0" -dependencies = [ - "cfg-if", - "once_cell", - "rustversion", - "wasm-bindgen-macro", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-macro" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7fbdf9a35adf44786aecd5ff89b4563a90325f9da0923236f6104e603c7e86be" -dependencies = [ - "quote", - "wasm-bindgen-macro-support", -] - -[[package]] -name = "wasm-bindgen-macro-support" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "dca9693ef2bab6d4e6707234500350d8dad079eb508dca05530c85dc3a529ff2" -dependencies = [ - "bumpalo", - "proc-macro2", - "quote", - "syn", - "wasm-bindgen-shared", -] - -[[package]] -name = "wasm-bindgen-shared" -version = "0.2.117" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "39129a682a6d2d841b6c429d0c51e5cb0ed1a03829d8b3d1e69a011e62cb3d3b" -dependencies = [ - "unicode-ident", -] - -[[package]] -name = "wasm-encoder" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319" -dependencies = [ - "leb128fmt", - "wasmparser", -] - -[[package]] -name = "wasm-metadata" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909" -dependencies = [ - "anyhow", - "indexmap", - "wasm-encoder", - "wasmparser", -] - -[[package]] -name = "wasmparser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe" -dependencies = [ - "bitflags", - "hashbrown 0.15.5", - "indexmap", - "semver", -] - -[[package]] -name = "winapi-util" -version = "0.1.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" -dependencies = [ - "windows-sys 0.61.2", -] - -[[package]] -name = "windows-core" -version = "0.62.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb" -dependencies = [ - "windows-implement", - "windows-interface", - "windows-link", - "windows-result", - "windows-strings", -] - -[[package]] -name = "windows-implement" -version = "0.60.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "windows-interface" -version = "0.59.3" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "windows-link" -version = "0.2.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" - -[[package]] -name = "windows-result" -version = "0.4.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-strings" -version = "0.5.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-sys" -version = "0.59.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" -dependencies = [ - "windows-targets", -] - -[[package]] -name = "windows-sys" -version = "0.61.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" -dependencies = [ - "windows-link", -] - -[[package]] -name = "windows-targets" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" -dependencies = [ - "windows_aarch64_gnullvm", - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_gnullvm", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_gnullvm", - "windows_x86_64_msvc", -] - -[[package]] -name = "windows_aarch64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" - -[[package]] -name = "windows_aarch64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" - -[[package]] -name = "windows_i686_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" - -[[package]] -name = "windows_i686_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" - -[[package]] -name = "windows_i686_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" - -[[package]] -name = "windows_x86_64_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" - -[[package]] -name = "windows_x86_64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" - -[[package]] -name = "windows_x86_64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" - -[[package]] -name = "winnow" -version = "0.7.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945" -dependencies = [ - "memchr", -] - -[[package]] -name = "wit-bindgen" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5" -dependencies = [ - "wit-bindgen-rust-macro", -] - -[[package]] -name = "wit-bindgen-core" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc" -dependencies = [ - "anyhow", - "heck", - "wit-parser", -] - -[[package]] -name = "wit-bindgen-rust" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21" -dependencies = [ - "anyhow", - "heck", - "indexmap", - "prettyplease", - "syn", - "wasm-metadata", - "wit-bindgen-core", - "wit-component", -] - -[[package]] -name = "wit-bindgen-rust-macro" -version = "0.51.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a" -dependencies = [ - "anyhow", - "prettyplease", - "proc-macro2", - "quote", - "syn", - "wit-bindgen-core", - "wit-bindgen-rust", -] - -[[package]] -name = "wit-component" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2" -dependencies = [ - "anyhow", - "bitflags", - "indexmap", - "log", - "serde", - "serde_derive", - "serde_json", - "wasm-encoder", - "wasm-metadata", - "wasmparser", - "wit-parser", -] - -[[package]] -name = "wit-parser" -version = "0.244.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736" -dependencies = [ - "anyhow", - "id-arena", - "indexmap", - "log", - "semver", - "serde", - "serde_derive", - "serde_json", - "unicode-xid", - "wasmparser", -] - -[[package]] -name = "zerocopy" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "eed437bf9d6692032087e337407a86f04cd8d6a16a37199ed57949d415bd68e9" -dependencies = [ - "zerocopy-derive", -] - -[[package]] -name = "zerocopy-derive" -version = "0.8.48" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70e3cd084b1788766f53af483dd21f93881ff30d7320490ec3ef7526d203bad4" -dependencies = [ - "proc-macro2", - "quote", - "syn", -] - -[[package]] -name = "zeroize" -version = "1.8.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0" - -[[package]] -name = "zmij" -version = "1.0.21" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa" diff --git a/k9-svc/tools/src/k9-init/Cargo.toml b/k9-svc/tools/src/k9-init/Cargo.toml deleted file mode 100644 index 55a417b7..00000000 --- a/k9-svc/tools/src/k9-init/Cargo.toml +++ /dev/null @@ -1,26 +0,0 @@ -[package] -name = "k9-init" -version = "1.0.0" -edition = "2021" -authors = ["Jonathan D.A. Jewell "] -license = "PMPL-1.0-or-later" -description = "Scaffold new K9 contractiles from templates" -homepage = "https://github.com/hyperpolymath/k9-tools" -repository = "https://github.com/hyperpolymath/k9-tools" -keywords = ["k9", "nickel", "infrastructure", "scaffold"] -categories = ["command-line-utilities", "development-tools"] - -[dependencies] -clap = { version = "4.5", features = ["derive"] } -anyhow = "1.0" -serde = { version = "1.0", features = ["derive"] } -serde_json = "1.0" -toml = "0.8" -dialoguer = "0.11" -tera = "1.20" -walkdir = "2.4" -chrono = "0.4" - -[[bin]] -name = "k9-init" -path = "src/main.rs" diff --git a/k9-svc/tools/src/k9-init/src/main.rs b/k9-svc/tools/src/k9-init/src/main.rs deleted file mode 100644 index 4fb5eeb5..00000000 --- a/k9-svc/tools/src/k9-init/src/main.rs +++ /dev/null @@ -1,594 +0,0 @@ -// SPDX-License-Identifier: MPL-2.0 -//! k9-init: Scaffold new K9 contractiles from templates - -#![forbid(unsafe_code)] -use anyhow::{Context, Result}; -use clap::Parser; -use dialoguer::{Input, Select}; -use std::fs; -use std::path::PathBuf; -use tera::{Context as TeraContext, Tera}; - -#[derive(Parser, Debug)] -#[command(name = "k9-init")] -#[command(about = "Scaffold new K9 contractiles from templates", long_about = None)] -struct Args { - /// Template name (web-server, build, deploy, dev-env, etc.) - #[arg(short, long)] - template: Option, - - /// Contractile name - #[arg(short, long)] - name: Option, - - /// Security level (kennel, yard, hunt) - #[arg(short, long)] - security: Option, - - /// Output directory - #[arg(short, long, default_value = ".")] - output: PathBuf, - - /// Non-interactive mode (use all defaults/provided values) - #[arg(long)] - non_interactive: bool, -} - -#[derive(Debug)] -struct ContractileConfig { - name: String, - security_level: SecurityLevel, - template: Template, - author: String, -} - -#[derive(Debug, Clone, Copy)] -enum SecurityLevel { - Kennel, - Yard, - Hunt, -} - -impl SecurityLevel { - fn as_str(&self) -> &str { - match self { - SecurityLevel::Kennel => "kennel", - SecurityLevel::Yard => "yard", - SecurityLevel::Hunt => "hunt", - } - } - - fn description(&self) -> &str { - match self { - SecurityLevel::Kennel => "Read-only, safe operations (ls, cat, stat)", - SecurityLevel::Yard => "File writes, git ops, package installs", - SecurityLevel::Hunt => "Full system access (requires signature)", - } - } -} - -#[derive(Debug, Clone)] -enum Template { - WebServer(String), // nginx, caddy, apache - Build(String), // rust, node, go, python - Deploy(String), // docker, kubernetes, terraform - DevEnv(String), // minimal, full-stack, data-science - CiCd, - Backup, - Monitoring, - Minimal, -} - -impl Template { - fn name(&self) -> String { - match self { - Template::WebServer(variant) => format!("web-server/{}", variant), - Template::Build(variant) => format!("build/{}", variant), - Template::Deploy(variant) => format!("deploy/{}", variant), - Template::DevEnv(variant) => format!("dev-env/{}", variant), - Template::CiCd => "ci-cd".to_string(), - Template::Backup => "backup".to_string(), - Template::Monitoring => "monitoring".to_string(), - Template::Minimal => "minimal".to_string(), - } - } -} - -fn main() -> Result<()> { - let args = Args::parse(); - - println!("╔══════════════════════════════════════════════════════════╗"); - println!("║ K9 Init - Scaffold K9 Contractiles ║"); - println!("╚══════════════════════════════════════════════════════════╝"); - println!(); - - let config = if args.non_interactive { - build_config_non_interactive(&args)? - } else { - build_config_interactive(&args)? - }; - - scaffold_contractile(&config, &args.output)?; - - println!(); - println!("✅ K9 contractile scaffolded successfully!"); - println!(); - println!("Next steps:"); - println!(" 1. cd {}", config.name); - println!(" 2. Review {}.k9.ncl", config.name); - println!(" 3. Validate: k9-validate {}.k9.ncl", config.name); - println!(" 4. Test: just --list"); - println!(" 5. Sign: k9-sign sign {}.k9.ncl", config.name); - println!(); - - Ok(()) -} - -fn build_config_interactive(args: &Args) -> Result { - // Contractile name - let name = if let Some(name) = &args.name { - name.clone() - } else { - Input::::new() - .with_prompt("Contractile name") - .default("my-contractile".to_string()) - .interact_text()? - }; - - // Security level - let security_level = if let Some(level) = &args.security { - match level.as_str() { - "kennel" => SecurityLevel::Kennel, - "yard" => SecurityLevel::Yard, - "hunt" => SecurityLevel::Hunt, - _ => anyhow::bail!("Invalid security level: {}", level), - } - } else { - let levels = vec![ - format!("kennel - {}", SecurityLevel::Kennel.description()), - format!("yard - {}", SecurityLevel::Yard.description()), - format!("hunt - {}", SecurityLevel::Hunt.description()), - ]; - let selection = Select::new() - .with_prompt("Security level") - .items(&levels) - .default(0) - .interact()?; - - match selection { - 0 => SecurityLevel::Kennel, - 1 => SecurityLevel::Yard, - 2 => SecurityLevel::Hunt, - _ => unreachable!(), - } - }; - - // Template - let template = if let Some(template_name) = &args.template { - parse_template(template_name)? - } else { - let templates = vec![ - "web-server/nginx - Deploy nginx web server", - "web-server/caddy - Deploy Caddy web server", - "build/rust - Rust build automation", - "build/node - Node.js build automation", - "deploy/docker - Docker deployment", - "deploy/kubernetes - Kubernetes deployment", - "dev-env/minimal - Minimal development environment", - "dev-env/full-stack - Full-stack development environment", - "ci-cd - CI/CD pipeline", - "minimal - Minimal K9 contractile", - ]; - let selection = Select::new() - .with_prompt("Template") - .items(&templates) - .default(0) - .interact()?; - - match selection { - 0 => Template::WebServer("nginx".to_string()), - 1 => Template::WebServer("caddy".to_string()), - 2 => Template::Build("rust".to_string()), - 3 => Template::Build("node".to_string()), - 4 => Template::Deploy("docker".to_string()), - 5 => Template::Deploy("kubernetes".to_string()), - 6 => Template::DevEnv("minimal".to_string()), - 7 => Template::DevEnv("full-stack".to_string()), - 8 => Template::CiCd, - 9 => Template::Minimal, - _ => unreachable!(), - } - }; - - // Author - let author = Input::::new() - .with_prompt("Author") - .default("Jonathan D.A. Jewell ".to_string()) - .interact_text()?; - - Ok(ContractileConfig { - name, - security_level, - template, - author, - }) -} - -fn build_config_non_interactive(args: &Args) -> Result { - let name = args.name.clone().unwrap_or_else(|| "my-contractile".to_string()); - let security_level = match args.security.as_deref() { - Some("kennel") => SecurityLevel::Kennel, - Some("yard") => SecurityLevel::Yard, - Some("hunt") => SecurityLevel::Hunt, - Some(other) => anyhow::bail!("Invalid security level: {}", other), - None => SecurityLevel::Kennel, // Default - }; - let template = if let Some(template_name) = &args.template { - parse_template(template_name)? - } else { - Template::Minimal // Default - }; - let author = "Jonathan D.A. Jewell ".to_string(); - - Ok(ContractileConfig { - name, - security_level, - template, - author, - }) -} - -fn parse_template(name: &str) -> Result