From c6623e0456aa0c63e391bef11a102280d55f36e0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 14:55:43 +0100 Subject: [PATCH 1/5] chore: estate-wide security compliance --- .github/workflows/boj-build.yml | 1 + .github/workflows/cargo-audit.yml | 1 + .github/workflows/casket-pages.yml | 1 + .github/workflows/cflite_batch.yml | 1 + .github/workflows/cflite_pr.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 1 + .github/workflows/dogfood-gate.yml | 1 + .github/workflows/ghcr-publish.yml | 1 + .github/workflows/governance.yml | 1 + .github/workflows/hypatia-scan.yml | 1 + .github/workflows/instant-sync.yml | 1 + .github/workflows/mirror.yml | 1 + .github/workflows/push-email-notify.yml | 1 + .github/workflows/rust-ci.yml | 1 + .github/workflows/scorecard.yml | 1 + .github/workflows/secret-scanner.yml | 1 + .github/workflows/workflow-linter.yml | 1 + 18 files changed, 18 insertions(+) diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml index dba7fc8..786b8fb 100644 --- a/.github/workflows/boj-build.yml +++ b/.github/workflows/boj-build.yml @@ -16,4 +16,5 @@ jobs: curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" -H "Content-Type: application/json" -d "{\"repo\": \"${{ github.repository }}\", \"branch\": \"${{ github.ref_name }}\", \"engine\": \"casket\\"}"} continue-on-error: true permissions: + actions: read contents: read diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml index f7bf788..f48b5b7 100644 --- a/.github/workflows/cargo-audit.yml +++ b/.github/workflows/cargo-audit.yml @@ -16,6 +16,7 @@ on: - cron: '0 6 * * 1' # Weekly on Monday permissions: read-all + actions: read jobs: audit: diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml index ad8fd14..b625074 100644 --- a/.github/workflows/casket-pages.yml +++ b/.github/workflows/casket-pages.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read pages: write id-token: write diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml index eb22dd0..09cd0f0 100644 --- a/.github/workflows/cflite_batch.yml +++ b/.github/workflows/cflite_batch.yml @@ -6,6 +6,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml index 646ab39..06ade1e 100644 --- a/.github/workflows/cflite_pr.yml +++ b/.github/workflows/cflite_pr.yml @@ -5,6 +5,7 @@ on: branches: [main] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 20d02b2..92b8d7d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,6 +18,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 92b5254..df25cd2 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -41,6 +41,7 @@ on: types: [opened, reopened, synchronize] permissions: + actions: read contents: write # needed to enable auto-merge pull-requests: write # needed to approve # NB: keep narrow — do NOT add secrets: read or id-token: write here. diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml index b0ef40e..4940ed2 100644 --- a/.github/workflows/dogfood-gate.yml +++ b/.github/workflows/dogfood-gate.yml @@ -13,6 +13,7 @@ on: branches: [main, master] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml index d55dc07..c2d8afd 100644 --- a/.github/workflows/ghcr-publish.yml +++ b/.github/workflows/ghcr-publish.yml @@ -2,6 +2,7 @@ name: Publish to GHCR permissions: + actions: read contents: read on: diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 8776de0..966a16e 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml index 9dde27a..556e8e0 100644 --- a/.github/workflows/hypatia-scan.yml +++ b/.github/workflows/hypatia-scan.yml @@ -11,6 +11,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read security-events: write diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml index 00f9d6b..4281b57 100644 --- a/.github/workflows/instant-sync.yml +++ b/.github/workflows/instant-sync.yml @@ -9,6 +9,7 @@ on: types: [published] permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 81e9903..c25d3bc 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -7,6 +7,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml index 4b4e754..112afd1 100644 --- a/.github/workflows/push-email-notify.yml +++ b/.github/workflows/push-email-notify.yml @@ -7,6 +7,7 @@ name: Push email notification on: push: {} permissions: + actions: read contents: read jobs: notify: diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml index 655a370..fe848c3 100644 --- a/.github/workflows/rust-ci.yml +++ b/.github/workflows/rust-ci.yml @@ -10,6 +10,7 @@ on: pull_request: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index b97e2cb..cede40a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: workflow_dispatch: permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml index 3ba3bac..599c64a 100644 --- a/.github/workflows/secret-scanner.yml +++ b/.github/workflows/secret-scanner.yml @@ -16,6 +16,7 @@ concurrency: cancel-in-progress: true permissions: + actions: read contents: read jobs: diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml index 3bed9c5..57c5029 100644 --- a/.github/workflows/workflow-linter.yml +++ b/.github/workflows/workflow-linter.yml @@ -11,6 +11,7 @@ on: - '.github/workflows/**' permissions: read-all + actions: read jobs: lint-workflows: From 01b2fa370da15a5c21ce020c9d749cf91a606da7 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 15:13:04 +0100 Subject: [PATCH 2/5] chore: remove duplicate GOVERNANCE files, keep GOVERNANCE.md --- GOVERNANCE.adoc | 122 ------------------------------------------------ 1 file changed, 122 deletions(-) delete mode 100644 GOVERNANCE.adoc diff --git a/GOVERNANCE.adoc b/GOVERNANCE.adoc deleted file mode 100644 index 512938d..0000000 --- a/GOVERNANCE.adoc +++ /dev/null @@ -1,122 +0,0 @@ -// SPDX-FileCopyrightText: 2024 Joshua Jewell -// SPDX-License-Identifier: CC-BY-SA-4.0 -= VAE Dataset Normalizer Governance -:toc: -:toclevels: 2 - -== Overview - -This document describes the governance model for the VAE Dataset Normalizer project. - -== Governance Model - -This project follows a **Benevolent Dictator For Life (BDFL)** model with community input. - -=== Decision Making - -==== Day-to-Day Decisions - -* Made by active maintainers -* Documented in issues/MRs -* Can be overridden by BDFL if necessary - -==== Technical Decisions - -* Proposed via RFC (Request for Comments) issues -* Community feedback period: 14 days minimum -* Final decision by maintainers with BDFL tiebreaker - -==== Governance Decisions - -* Require BDFL approval -* Community input welcomed -* Documented in this file - -=== Roles - -==== BDFL (Benevolent Dictator For Life) - -* Joshua Jewell -* Final authority on all decisions -* Responsible for project vision -* Can delegate authority - -==== Maintainers - -* Listed in MAINTAINERS.md -* Merge authority -* Release authority -* Code review responsibility - -==== Contributors - -* Anyone who contributes code, docs, issues -* Recognized in release notes -* May become maintainers through sustained contribution - -=== Succession Planning - -In case the BDFL is unable to continue: - -1. Maintainers elect new BDFL by majority vote -2. If no majority, most senior maintainer assumes role -3. If no maintainers, project is archived -4. Fork rights always preserved (MIT license) - -== Code of Conduct Enforcement - -See CODE_OF_CONDUCT.md for the full code of conduct. - -=== Enforcement Process - -1. Report received -2. Maintainers assess (private) -3. Response determined -4. Action taken -5. Documentation (anonymized if needed) - -=== Appeals - -* Appeals go to BDFL -* BDFL decision is final -* External mediation available if requested - -== Financial Governance - -=== Funding Sources - -* Individual donations -* Corporate sponsorships -* Grants - -=== Allocation - -* Infrastructure: 40% -* Development: 40% -* Community: 10% -* Reserve: 10% - -=== Transparency - -* Quarterly financial reports (if funded) -* All sponsorships disclosed -* No pay-for-features arrangements - -== Amendments - -This governance document may be amended by: - -1. Proposal via issue -2. 30-day comment period -3. BDFL approval -4. Version increment - -== Version History - -|=== -|Version |Date |Changes - -|1.0.0 -|2024-01-01 -|Initial governance model -|=== From b302611e9f1134d4b3ffd10cd3f97c9f21e3eb2c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Sun, 26 Jul 2026 16:02:58 +0100 Subject: [PATCH 3/5] chore: update guix.scm from squisher-corpus --- guix.scm | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/guix.scm b/guix.scm index a65113b..c6dd7be 100644 --- a/guix.scm +++ b/guix.scm @@ -1,5 +1,5 @@ ; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for zerostep +;; guix.scm — GNU Guix package definition for squisher-corpus ;; Usage: guix shell -f guix.scm (use-modules (guix packages) @@ -7,12 +7,12 @@ (guix licenses)) (package - (name "zerostep") + (name "squisher-corpus") (version "0.1.0") (source #f) (build-system gnu-build-system) - (synopsis "zerostep") - (description "zerostep — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/zerostep") - (license ((@@ (guix licenses) license) "MPL-2.0" + (synopsis "squisher-corpus") + (description "squisher-corpus — part of the hyperpolymath ecosystem.") + (home-page "https://github.com/hyperpolymath/squisher-corpus") + (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" "https://github.com/hyperpolymath/palimpsest-license"))) From f02f8e75fc99ee41e5336e601f720b9159048ceb Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 01:56:18 +0100 Subject: [PATCH 4/5] fix(ci): remove erroneous squisher-corpus guix.scm placeholder Part of estate-wide standards#426 remediation - cleanup. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- guix.scm | 18 ------------------ 1 file changed, 18 deletions(-) delete mode 100644 guix.scm diff --git a/guix.scm b/guix.scm deleted file mode 100644 index c6dd7be..0000000 --- a/guix.scm +++ /dev/null @@ -1,18 +0,0 @@ -; SPDX-License-Identifier: MPL-2.0 -;; guix.scm — GNU Guix package definition for squisher-corpus -;; Usage: guix shell -f guix.scm - -(use-modules (guix packages) - (guix build-system gnu) - (guix licenses)) - -(package - (name "squisher-corpus") - (version "0.1.0") - (source #f) - (build-system gnu-build-system) - (synopsis "squisher-corpus") - (description "squisher-corpus — part of the hyperpolymath ecosystem.") - (home-page "https://github.com/hyperpolymath/squisher-corpus") - (license ((@@ (guix licenses) license) "PMPL-1.0-or-later" - "https://github.com/hyperpolymath/palimpsest-license"))) From e83c966adaa3ed3247fa443b0bdf733a5d2f75d0 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 13 Aug 2026 04:02:03 +0100 Subject: [PATCH 5/5] fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329 Part of estate-wide standards#426 remediation - Batch 11 SHA update. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/workflows/mirror.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index c25d3bc..72824fb 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -12,5 +12,5 @@ permissions: jobs: mirror: - uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236 + uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329 secrets: inherit