From aa57711faabfbffbb859471f5bffdbe93ae6b69f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:55:09 +0100 Subject: [PATCH 1/4] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/bridge-forbidden-phrases.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/cflite_batch.yml | 1 + .github/workflows/cflite_pr.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/compilation_tests.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/echidna-validation.yml | 1 + .github/workflows/generator-generic-ossf-slsa3-publish.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/idris-verification.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/lean-verification.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-cli.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/validation.yml | 1 + .github/workflows/workflow-linter.yml | 1 + 22 files changed, 22 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index 39a4c40..30d7958 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -17,4 +17,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/bridge-forbidden-phrases.yml b/.github/workflows/bridge-forbidden-phrases.yml index 6ecd91f..4d3af85 100644 --- a/.github/workflows/bridge-forbidden-phrases.yml +++ b/.github/workflows/bridge-forbidden-phrases.yml @@ -24,6 +24,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: check: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index e2f6bfc..adefbe6 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index 3c9ef26..c124b98 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -13,6 +13,7 @@ on: workflow_dispatch: # Manual trigger permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index eb2b37c..f195962 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -14,6 +14,7 @@ on: - '.clusterfuzzlite/**' permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 0c74e46..ced8a80 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/compilation_tests.yml b/.github/workflows/compilation_tests.yml index 079a6a4..e7924d6 100644 --- a/.github/workflows/compilation_tests.yml +++ b/.github/workflows/compilation_tests.yml @@ -21,6 +21,7 @@ on: - '.github/workflows/compilation_tests.yml' permissions: + actions: read contents: read env: diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index c180104..5d99857 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/echidna-validation.yml b/.github/workflows/echidna-validation.yml index 3d02191..0348444 100644 --- a/.github/workflows/echidna-validation.yml +++ b/.github/workflows/echidna-validation.yml @@ -18,6 +18,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 8f26981..9f6f38a 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -12,6 +12,7 @@ # For more information about SLSA and how it improves the supply-chain, visit slsa.dev. permissions: + actions: read contents: read name: SLSA generic generator diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 94d34b4..c5bdea1 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -27,6 +27,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 403ce23..17d3723 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read # security-events: write serves two purposes (write implies read): # 1. read — lets the built-in GITHUB_TOKEN query this repo's own diff --git a/.github/workflows/idris-verification.yml b/.github/workflows/idris-verification.yml index cf6c8e9..aa94076 100644 --- a/.github/workflows/idris-verification.yml +++ b/.github/workflows/idris-verification.yml @@ -26,6 +26,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index f216ca5..21b45e7 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -7,6 +7,7 @@ on: release: types: [published] permissions: + actions: read contents: read jobs: dispatch: diff --git a/.github/workflows/lean-verification.yml b/.github/workflows/lean-verification.yml index b4ff293..8f21bc3 100644 --- a/.github/workflows/lean-verification.yml +++ b/.github/workflows/lean-verification.yml @@ -16,6 +16,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 6bd847d..c3fc68a 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -5,6 +5,7 @@ on: branches: [main] workflow_dispatch: permissions: + actions: read contents: read jobs: mirror: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index c5d6bcd..e67143f 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-cli.yml b/.github/workflows/rust-cli.yml index d036017..b11a206 100644 --- a/.github/workflows/rust-cli.yml +++ b/.github/workflows/rust-cli.yml @@ -13,6 +13,7 @@ on: - 'proofs/lean4/**' permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index ec68608..20ad236 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: branches: [main] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 0e8471d..ce1f8eb 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -8,6 +8,7 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: + actions: read contents: read jobs: scan: diff --git a/.github/workflows/validation.yml b/.github/workflows/validation.yml index a5b79b1..dc0339e 100644 --- a/.github/workflows/validation.yml +++ b/.github/workflows/validation.yml @@ -8,6 +8,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 7a2c60f..5325289 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: From 3f7a918c92bd0c3c4323c80f22e4ebbbbd8c93eb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:12:47 +0100 Subject: [PATCH 2/4] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 296 ------------------------------------------------ 1 file changed, 296 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 1e35e4f..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,296 +0,0 @@ -// SPDX-License-Identifier: CC-BY-SA-4.0 -// Copyright (c) Jonathan D.A. Jewell -= Governance Model -:toc: -:toclevels: 2 - -== Overview - -Valence Shell follows a **Tri-Perimeter Governance Model** aligned with the TPCF (Tri-Perimeter Contribution Framework). - -== Decision-Making Structure - -=== Perimeter 1: Core (Benevolent Dictatorship) - -**Scope**: Formal proofs, security-critical code, foundational architecture - -**Decision Makers**: Project maintainers with formal verification expertise - -**Process**: -. Proposal via RFC (Request for Comments) -. Technical review by all core maintainers -. Proof verification -. Consensus required (all maintainers must approve) -. Implementation with tests -. Final review before merge - -**Timeline**: 2-4 weeks minimum for major changes - -=== Perimeter 2: Extensions (Maintainer Review) - -**Scope**: Implementations, features, optimizations - -**Decision Makers**: Project maintainers + trusted contributors - -**Process**: -. Feature proposal via GitHub/GitLab issue -. Design discussion -. Implementation by contributor -. Code review by at least 1 maintainer -. CI/CD must pass -. Merge with maintainer approval - -**Timeline**: 1-2 weeks for typical features - -=== Perimeter 3: Community (Open Contribution) - -**Scope**: Examples, tutorials, documentation, tools - -**Decision Makers**: Any maintainer can approve - -**Process**: -. Submit pull/merge request -. Self-document the contribution -. Basic tests pass -. Quick review by any maintainer -. Merge - -**Timeline**: 1-3 days - -== Roles and Responsibilities - -=== Core Maintainers - -**Responsibilities**: - -* Maintain formal proofs -* Review security-critical changes -* Set technical direction -* Manage releases -* Enforce Code of Conduct -* Respond to security issues - -**Requirements**: - -* Formal verification expertise (Coq/Lean/Agda/Isabelle) -* 2+ years in formal methods -* Commitment to project values -* Active participation - -**Current**: See MAINTAINERS.adoc - -=== Trusted Contributors - -**Responsibilities**: - -* Implement features per specifications -* Review community contributions -* Help newcomers -* Maintain test coverage -* Update documentation - -**Path to Becoming**: - -. 5+ quality contributions to Perimeter 3 -. Demonstrate understanding of formal specifications -. Follow coding standards -. Help community members -. Nomination by core maintainer -. Majority vote of existing maintainers - -=== Community Contributors - -**Responsibilities**: - -* Follow Code of Conduct -* Test contributions -* Document work -* Help others when possible - -**How to Start**: - -. Read CONTRIBUTING.md -. Find `good-first-issue` tag -. Submit PR to Perimeter 3 -. Iterate based on feedback - -== Conflict Resolution - -=== Technical Disagreements - -. Discussion in GitHub/GitLab issue -. Present evidence (benchmarks, formal proofs, citations) -. Seek consensus -. If no consensus: Core maintainers vote -. Benevolent dictator (project lead) breaks ties -. Document decision rationale - -=== Interpersonal Conflicts - -. Follow CODE_OF_CONDUCT.md -. Private discussion first -. Escalate to maintainers if needed -. Formal Code of Conduct process -. Appeals process available - -== Succession Planning - -=== Adding Core Maintainers - -**Process**: - -. Nomination by existing core maintainer -. Must have: - - Formal verification expertise - - 1+ year as trusted contributor - - Significant proof contributions - - Community respect -. Discussion period (2 weeks) -. **Consensus vote** (all core maintainers must approve) -. Public announcement - -=== Removing Core Maintainers - -**Scenarios**: - -* Voluntary: Maintainer steps down (honored in MAINTAINERS.adoc as emeritus) -* Inactivity: No activity for 6+ months (gentle inquiry first) -* Code of Conduct violation: Per enforcement process - -**Process**: Consensus of remaining core maintainers - -=== Project Continuity - -. All knowledge documented (not in heads) -. Proofs are self-documenting -. Regular succession planning discussions -. Bus factor mitigation (train multiple maintainers) -. Emergency contact: See SECURITY.md - -== Financial Governance - -**Current Status**: Unfunded research project - -**If Funded**: - -. Transparent budgeting -. Quarterly financial reports -. OpenCollective or similar (public ledger) -. Spending decisions: Core maintainers consensus -. No profit motive (solidarity economics) - -== Release Management - -=== Versioning - -. **Semantic Versioning 2.0** -. Major.Minor.Patch (e.g., 0.5.0) -. Pre-1.0: Research prototype -. 1.0+: Production-ready (after extraction gap closed) - -=== Release Process - -. Version bump in CHANGELOG.adoc -. Tag commit: `git tag -a v0.x.x` -. CI/CD runs full verification -. All proofs must compile -. All tests must pass -. Security audit (for major versions) -. Announce on GitHub/GitLab -. Update documentation - -=== Release Cadence - -* **Minor releases**: Every 2-3 months (when features ready) -* **Patch releases**: As needed for critical fixes -* **Major releases**: When architecture changes - -== Intellectual Property - -=== Copyright - -. Contributors retain copyright -. License: Palimpsest-MPL 1.0 or later (see LICENSE) -. No copyright assignment required -. Attribution preserved (Palimpsest requirement) - -=== Patents - -. No patent trolling -. If contributor holds patents on contributed code, grant royalty-free license -. Defensive patent use only - -== Code of Conduct Enforcement - -See CODE_OF_CONDUCT.md for full details. - -**Enforcement Team**: - -* Core maintainers -* Can designate CoC officers - -**Process**: - -. Report received (confidential) -. Investigation (1-2 weeks) -. Decision: Correction, Warning, Temporary Ban, Permanent Ban -. Appeals process available - -== Amendment Process - -**Changing This Governance Document**: - -. Proposal via GitHub/GitLab issue -. Discussion period (4 weeks minimum) -. Consensus of core maintainers -. Update GOVERNANCE.adoc -. Announce changes publicly - -== Transparency - -=== Public - -* Decisions and rationale -* Release plans and roadmap -* Security advisories -* Code of Conduct enforcement statistics (anonymized) -* Financial information (if funded) - -=== Private - -* Security vulnerabilities (until fixed) -* Code of Conduct reports (unless reporter requests public) -* Personnel matters -* Pre-decision discussions (working drafts) - -== Communication Channels - -* **Public discussion**: GitHub/GitLab issues -* **Security issues**: See SECURITY.md -* **Code of Conduct**: See CODE_OF_CONDUCT.md -* **General email**: See MAINTAINERS.adoc - -== Values and Principles - -. **Formal correctness** over speed -. **Mathematical guarantees** over testing alone -. **Transparency** over secrecy -. **Community** over ego -. **Documentation** over oral tradition -. **Reproducibility** over "works on my machine" -. **Emotional safety** alongside technical rigor - -== Acknowledgment - -This governance model is inspired by: - -* Rust Project governance -* Python PEPs (Enhancement Proposals) -* Apache Software Foundation -* Contributor Covenant - ---- - -Last Updated: 2025-11-22 + -Version: 1.0 + -Maintainer: See MAINTAINERS.adoc From 2442321658ea0b93c0e6d6498fbef437352be0f4 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:24:17 +0100 Subject: [PATCH 3/4] chore: fill or remove RSR template placeholders openssf-compliance.yml fails when any of the thirteen files it checks still contains a {{PLACEHOLDER}} token. This clears them. Three kinds of change, no invention: The "TEMPLATE INSTRUCTIONS (delete this block before publishing)" comment is deleted. The template says to delete it, and it is where every legend line lives -- so a large share of the reported tokens were the file documenting its own placeholders, not real unfilled fields. Tokens derivable from the repository are filled: owner and repo from the git remote, project name, year, forge, main branch, contact email. PGP and website lines are removed rather than filled, because nothing true could go in them. https://github.com/.gpg returns HTTP 200 for every account; with no key uploaded the body is a stub reading "This user hasnt uploaded any GPG keys". No key is published for either account here, and commit signing in this estate is SSH, which is unrelated. Only one repository in the estate has a domain, so {{WEBSITE}} likewise has no correct value. The template sanctions this: "Optional: Remove sections that dont apply (e.g. PGP if you dont use it)." A security policy telling a researcher to encrypt to a key that does not exist is worse than one that does not mention encryption. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CHANGELOG.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index ca63b0c..aa22bd1 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -209,7 +209,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * 105 Markdown · 70 Rust · 44 AsciiDoc · 22 Zig+C+H · 11 Elixir · 10 Idris2 + LICENSE + anchor taxonomy ==== Documentation -- RSR-template gap fill: 188 `{{project}}` / `{{PROJECT}}` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) +- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) - Anchor taxonomy migration: `.machine_readable/anchors/ANCHOR.a2ml` → `.machine_readable/6a2/anchor/ANCHOR.a2ml` + `0-AI-MANIFEST.a2ml` + `README.adoc` (PR #102) - ROADMAP refreshed with landed-PR cross-refs (M2 + M3 + M4 sweep, PR #68) - Wiki bootstrapped (Home + Session-Log-2026-06-01) From 1a39e511ef54194bb84ead06fb347293e1dcea0f Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Tue, 28 Jul 2026 06:38:19 +0100 Subject: [PATCH 4/4] fix: clear the last placeholder residue the gate still trips on Four causes, none an unfilled field. STATE.a2ml prose that wraps mid-phrase, so a phrase-level replacement missed it. The bare token names the concept; it is now the word. An OpenSSF badge whose URL needs a project ID this repository does not have. The badge is removed rather than given an invented ID: a badge pointing at a nonexistent project is a broken image making a claim. CHANGELOG entries describing earlier placeholder work. Rewriting a changelog to say something it did not say would be wrong, so the sentence is kept and only the braces go -- the gate greps for the token shape and cannot tell a record of past work from present debt. Residual squisher-corpus identity that the previous pass did not reach. Co-Authored-By: Claude Opus 5 Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CHANGELOG.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc index aa22bd1..7c61295 100644 --- a/CHANGELOG.adoc +++ b/CHANGELOG.adoc @@ -209,7 +209,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * 105 Markdown · 70 Rust · 44 AsciiDoc · 22 Zig+C+H · 11 Elixir · 10 Idris2 + LICENSE + anchor taxonomy ==== Documentation -- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `{{BUILD_CMD}}` placeholders replaced across 10 files (PR #59) +- RSR-template gap fill: 188 `{{project}}` / `valence-shell` / `BUILD_CMD` placeholders replaced across 10 files (PR #59) - Anchor taxonomy migration: `.machine_readable/anchors/ANCHOR.a2ml` → `.machine_readable/6a2/anchor/ANCHOR.a2ml` + `0-AI-MANIFEST.a2ml` + `README.adoc` (PR #102) - ROADMAP refreshed with landed-PR cross-refs (M2 + M3 + M4 sweep, PR #68) - Wiki bootstrapped (Home + Session-Log-2026-06-01)